Mono libgdiplus Image Processing Three Integer Overflow vulnerabilities
30 Sep. 2010
Summary
Three vulnerabilities were discovered in libgdiplus for Mono, which can be exploited by malicious people to compromise an application using the library.
1) An integer overflow error within the "gdip_load_tiff_image()" function in src/tiffcodec.c can be exploited to cause a heap-based buffer overflow by e.g. processing specially crafted TIFF images in an application using the library.
2) An integer overflow error within the "gdip_load_jpeg_image_internal()" function in src/jpegcodec.c can be exploited to cause a heap-based buffer overflow by e.g. processing specially crafted JPEG images in an application using the library.
3) An integer overflow error within the "gdip_read_bmp_image()" function in src/bmpcodec.c can be exploited to cause a heap-based buffer overflow by e.g. processing specially crafted BMP images in an application using the library.
Workaround:
Do not process untrusted images in an application using the library.
