full-disclosure - [FD] DjVuLibre 3.5.29 IW44EncodeCodec Integer Overflow (Negative Left Shift in IW44Image::Map::Encode)

Open Source and information security mailing list archives

Message-ID: <CAFmK-Gz2RWnVusKcPMkPmGg62JSVvLazg2xD-ZEv73UmMZJ+dg@mail.gmail.com>
Date: Sat, 6 Sep 2025 03:29:38 -0400
From: Ron E <ronaldjedgerson@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] DjVuLibre 3.5.29 IW44EncodeCodec Integer Overflow (Negative
 Left Shift in IW44Image::Map::Encode)

The DjVuLibre document compression library (tested version 3.5.29) is
vulnerable to an integer overflow caused by a left shift of a negative
signed integer in the IW44EncodeCodec.cpp component. When processing
crafted PPM input passed through the c44 utility, negative pixel values are
left-shifted in functions such as filter_fh, filter_fv, and
IW44Image::Map::Encode::create. This results in undefined behavior and
corrupted intermediate state during encoding. An attacker can trigger the
condition by supplying specially crafted image data, potentially leading to
memory corruption, application crash*, *or information disclosure depending
on compiler optimizations and runtime environment.

*Impact:*

   - Crash (DoS) confirmed with UBSan/ASan.
   - Possible memory corruption due to undefined behavior on signed shifts

*Proof of Concept:*

convert -size 500x500 gradient: bad.ppm

ASAN_OPTIONS=detect_leaks=0,abort_on_error=1 \

UBSAN_OPTIONS=print_stacktrace=1 \

./tools/c44 bad.ppm out.djvu

*Sanitizer Output:*

IW44EncodeCodec.cpp:936:30: runtime error: left shift of negative value -128

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
IW44EncodeCodec.cpp:936:30
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives