DjVuLibre 3.5.29 IW44EncodeCodec Integer Overflow (Negative Left Shift in IW44Image::Map::Encode)

[Ron E <ronaldjedgerson () gmail com>]

The DjVuLibre document compression library (tested version 3.5.29) is
vulnerable to an integer overflow caused by a left shift of a negative
signed integer in the IW44EncodeCodec.cpp component. When processing
crafted PPM input passed through the c44 utility, negative pixel values are
left-shifted in functions such as filter_fh, filter_fv, and
IW44Image::Map::Encode::create. This results in undefined behavior and
corrupted intermediate state during encoding. An attacker can trigger the
condition by supplying specially crafted image data, potentially leading to
memory corruption, application crash*, *or information disclosure depending
on compiler optimizations and runtime environment.


*Impact:*

   - Crash (DoS) confirmed with UBSan/ASan.
   - Possible memory corruption due to undefined behavior on signed shifts

*Proof of Concept:*

convert -size 500x500 gradient: bad.ppm

ASAN_OPTIONS=detect_leaks=0,abort_on_error=1 \

UBSAN_OPTIONS=print_stacktrace=1 \

./tools/c44 bad.ppm out.djvu


*Sanitizer Output:*

IW44EncodeCodec.cpp:936:30: runtime error: left shift of negative value -128

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
IW44EncodeCodec.cpp:936:30
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/