New issue
Advanced search Search tips

Issue 880322 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Sep 6
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug-Security

Blocking:
issue 62400



Sign in to add a comment

Security: Update third_party/libpng to mitigate CVE-2016-10087

Project Member Reported by rharrison@chromium.org, Sep 4

Issue description

Update libpng DEP to 1.6.27 or newer.

Our libpng is currently only used in XFA builds and one of our testing tools. It is not currently in any released versions of Chrome. This needs to be resolved before launching XFA.
 
Looks like Chromium is on 1.6.34. I've forgotten about it because it's not in DEPS.
Weird this bug didn't get autodate'd when CLs when in. https://pdfium-review.googlesource.com/c/pdfium/+/41910 did the roll, but it needed to be reverted.
Project Member

Comment 3 by bugdroid1@chromium.org, Sep 5

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium/+/424621e3129f7029283f72e953fe0c69f982d257

commit 424621e3129f7029283f72e953fe0c69f982d257
Author: Lei Zhang <thestig@chromium.org>
Date: Tue Sep 04 22:42:56 2018

Revert "Update libpng from 1.6.22 -> 1.6.34"

This reverts commit 6b2e2f0ec7c5f629c5270d14c2339197af7392d8.

Reason for revert: Broke Chromium integration.

Original change's description:
> Update libpng from 1.6.22 -> 1.6.34
> 
> Updates third_party/libpng16 to Chromium's third_party/libpng @
> e87a02987101e2dbe319a4aba6b52470f7624b4a and applies PDFium specific
> patches.
> 
> BUG= chromium:880322 
> 
> Change-Id: I6724f55099c70a79da6d6e4863b9c6c9157ec571
> Reviewed-on: https://pdfium-review.googlesource.com/41910
> Reviewed-by: Lei Zhang <thestig@chromium.org>
> Commit-Queue: Ryan Harrison <rharrison@chromium.org>

TBR=thestig@chromium.org,rharrison@chromium.org

Change-Id: I2fd1f78e5d07ca983b2430bf078544185292ee1d
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug:  chromium:880322 
Reviewed-on: https://pdfium-review.googlesource.com/41970
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>

[modify] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/pngprefix.h
[modify] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/pngrutil.c
[rename] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/contrib/intel/filter_sse2_intrinsics.c
[modify] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/pngread.c
[modify] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/pngpread.c
[modify] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/pnglibconf.h
[modify] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/pngtrans.c
[modify] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/pngget.c
[add] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/0003-check-errors-in-set-pcal.patch
[modify] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/pngrtran.c
[modify] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/arm/filter_neon.S
[modify] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/pngwrite.c
[delete] https://crrev.com/d51c66c57a4fa6033f025d6ddd5d17a7d4e1d001/third_party/libpng16/arm/palette_neon_intrinsics.c
[rename] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/contrib/intel/intel_init.c
[modify] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/pngwtran.c
[modify] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/pngerror.c
[add] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/0004-invalid-icc.patch
[modify] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/pngmem.c
[add] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/contrib/intel/INSTALL
[modify] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/pngpriv.h
[modify] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/README.pdfium
[delete] https://crrev.com/d51c66c57a4fa6033f025d6ddd5d17a7d4e1d001/third_party/libpng16/LICENSE
[add] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/contrib/intel/intel_sse.patch
[modify] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/pngset.c
[modify] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/png.c
[modify] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/pngrio.c
[modify] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/pngwio.c
[modify] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/pngconf.h
[modify] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/png.h
[modify] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/BUILD.gn
[modify] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/pnginfo.h
[modify] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/pngstruct.h

Project Member

Comment 4 by bugdroid1@chromium.org, Sep 5

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium/+/6b2e2f0ec7c5f629c5270d14c2339197af7392d8

commit 6b2e2f0ec7c5f629c5270d14c2339197af7392d8
Author: Ryan Harrison <rharrison@chromium.org>
Date: Tue Sep 04 18:58:21 2018

Update libpng from 1.6.22 -> 1.6.34

Updates third_party/libpng16 to Chromium's third_party/libpng @
e87a02987101e2dbe319a4aba6b52470f7624b4a and applies PDFium specific
patches.

BUG= chromium:880322 

Change-Id: I6724f55099c70a79da6d6e4863b9c6c9157ec571
Reviewed-on: https://pdfium-review.googlesource.com/41910
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Ryan Harrison <rharrison@chromium.org>

[modify] https://crrev.com/6b2e2f0ec7c5f629c5270d14c2339197af7392d8/third_party/libpng16/pngprefix.h
[modify] https://crrev.com/6b2e2f0ec7c5f629c5270d14c2339197af7392d8/third_party/libpng16/pngrutil.c
[modify] https://crrev.com/6b2e2f0ec7c5f629c5270d14c2339197af7392d8/third_party/libpng16/pngread.c
[modify] https://crrev.com/6b2e2f0ec7c5f629c5270d14c2339197af7392d8/third_party/libpng16/pngpread.c
[modify] https://crrev.com/6b2e2f0ec7c5f629c5270d14c2339197af7392d8/third_party/libpng16/pnglibconf.h
[modify] https://crrev.com/6b2e2f0ec7c5f629c5270d14c2339197af7392d8/third_party/libpng16/pngtrans.c
[modify] https://crrev.com/6b2e2f0ec7c5f629c5270d14c2339197af7392d8/third_party/libpng16/pngget.c
[delete] https://crrev.com/d8b5feae1180185b7d1a41682b2b1a565dd5c630/third_party/libpng16/0003-check-errors-in-set-pcal.patch
[rename] https://crrev.com/6b2e2f0ec7c5f629c5270d14c2339197af7392d8/third_party/libpng16/intel/intel_init.c
[modify] https://crrev.com/6b2e2f0ec7c5f629c5270d14c2339197af7392d8/third_party/libpng16/pngrtran.c
[rename] https://crrev.com/6b2e2f0ec7c5f629c5270d14c2339197af7392d8/third_party/libpng16/intel/filter_sse2_intrinsics.c
[modify] https://crrev.com/6b2e2f0ec7c5f629c5270d14c2339197af7392d8/third_party/libpng16/arm/filter_neon.S
[modify] https://crrev.com/6b2e2f0ec7c5f629c5270d14c2339197af7392d8/third_party/libpng16/pngwrite.c
[add] https://crrev.com/6b2e2f0ec7c5f629c5270d14c2339197af7392d8/third_party/libpng16/arm/palette_neon_intrinsics.c
[modify] https://crrev.com/6b2e2f0ec7c5f629c5270d14c2339197af7392d8/third_party/libpng16/pngwtran.c
[modify] https://crrev.com/6b2e2f0ec7c5f629c5270d14c2339197af7392d8/third_party/libpng16/pngerror.c
[delete] https://crrev.com/d8b5feae1180185b7d1a41682b2b1a565dd5c630/third_party/libpng16/0004-invalid-icc.patch
[modify] https://crrev.com/6b2e2f0ec7c5f629c5270d14c2339197af7392d8/third_party/libpng16/pngmem.c
[delete] https://crrev.com/d8b5feae1180185b7d1a41682b2b1a565dd5c630/third_party/libpng16/contrib/intel/INSTALL
[modify] https://crrev.com/6b2e2f0ec7c5f629c5270d14c2339197af7392d8/third_party/libpng16/pngpriv.h
[modify] https://crrev.com/6b2e2f0ec7c5f629c5270d14c2339197af7392d8/third_party/libpng16/README.pdfium
[add] https://crrev.com/6b2e2f0ec7c5f629c5270d14c2339197af7392d8/third_party/libpng16/LICENSE
[delete] https://crrev.com/d8b5feae1180185b7d1a41682b2b1a565dd5c630/third_party/libpng16/contrib/intel/intel_sse.patch
[modify] https://crrev.com/6b2e2f0ec7c5f629c5270d14c2339197af7392d8/third_party/libpng16/pngset.c
[modify] https://crrev.com/6b2e2f0ec7c5f629c5270d14c2339197af7392d8/third_party/libpng16/png.c
[modify] https://crrev.com/6b2e2f0ec7c5f629c5270d14c2339197af7392d8/third_party/libpng16/pngrio.c
[modify] https://crrev.com/6b2e2f0ec7c5f629c5270d14c2339197af7392d8/third_party/libpng16/pngwio.c
[modify] https://crrev.com/6b2e2f0ec7c5f629c5270d14c2339197af7392d8/third_party/libpng16/pngconf.h
[modify] https://crrev.com/6b2e2f0ec7c5f629c5270d14c2339197af7392d8/third_party/libpng16/png.h
[modify] https://crrev.com/6b2e2f0ec7c5f629c5270d14c2339197af7392d8/third_party/BUILD.gn
[modify] https://crrev.com/6b2e2f0ec7c5f629c5270d14c2339197af7392d8/third_party/libpng16/pnginfo.h
[modify] https://crrev.com/6b2e2f0ec7c5f629c5270d14c2339197af7392d8/third_party/libpng16/pngstruct.h

Project Member

Comment 5 by bugdroid1@chromium.org, Sep 5

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium/+/cc5f350ab9c825884424faaacc2fa3c403615220

commit cc5f350ab9c825884424faaacc2fa3c403615220
Author: Ryan Harrison <rharrison@chromium.org>
Date: Wed Sep 05 18:37:28 2018

Update libpng from 1.6.22 -> 1.6.34

Updates third_party/libpng16 to Chromium's third_party/libpng @
a0e5c6a798a45a0dca175e2774ae0edc6aafc696 and applies PDFium specific
patches.

Originally landed as https://pdfium-review.googlesource.com/41910, but
reverted.

Bug= chromium:880322 

Change-Id: Ib8249cb156135d028c02f67f9559bdd8695c04f5
Reviewed-on: https://pdfium-review.googlesource.com/42030
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Ryan Harrison <rharrison@chromium.org>

[modify] https://crrev.com/cc5f350ab9c825884424faaacc2fa3c403615220/third_party/libpng16/pngprefix.h
[modify] https://crrev.com/cc5f350ab9c825884424faaacc2fa3c403615220/third_party/libpng16/pngrutil.c
[modify] https://crrev.com/cc5f350ab9c825884424faaacc2fa3c403615220/third_party/libpng16/pngread.c
[modify] https://crrev.com/cc5f350ab9c825884424faaacc2fa3c403615220/third_party/libpng16/pngpread.c
[modify] https://crrev.com/cc5f350ab9c825884424faaacc2fa3c403615220/third_party/libpng16/pnglibconf.h
[modify] https://crrev.com/cc5f350ab9c825884424faaacc2fa3c403615220/third_party/libpng16/pngtrans.c
[modify] https://crrev.com/cc5f350ab9c825884424faaacc2fa3c403615220/third_party/libpng16/pngget.c
[delete] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/0003-check-errors-in-set-pcal.patch
[rename] https://crrev.com/cc5f350ab9c825884424faaacc2fa3c403615220/third_party/libpng16/intel/intel_init.c
[modify] https://crrev.com/cc5f350ab9c825884424faaacc2fa3c403615220/third_party/libpng16/pngrtran.c
[rename] https://crrev.com/cc5f350ab9c825884424faaacc2fa3c403615220/third_party/libpng16/intel/filter_sse2_intrinsics.c
[modify] https://crrev.com/cc5f350ab9c825884424faaacc2fa3c403615220/third_party/libpng16/arm/filter_neon.S
[modify] https://crrev.com/cc5f350ab9c825884424faaacc2fa3c403615220/third_party/libpng16/pngwrite.c
[add] https://crrev.com/cc5f350ab9c825884424faaacc2fa3c403615220/third_party/libpng16/arm/palette_neon_intrinsics.c
[modify] https://crrev.com/cc5f350ab9c825884424faaacc2fa3c403615220/third_party/libpng16/pngwtran.c
[modify] https://crrev.com/cc5f350ab9c825884424faaacc2fa3c403615220/third_party/libpng16/pngerror.c
[delete] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/0004-invalid-icc.patch
[modify] https://crrev.com/cc5f350ab9c825884424faaacc2fa3c403615220/third_party/libpng16/pngmem.c
[delete] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/contrib/intel/INSTALL
[modify] https://crrev.com/cc5f350ab9c825884424faaacc2fa3c403615220/third_party/libpng16/pngpriv.h
[modify] https://crrev.com/cc5f350ab9c825884424faaacc2fa3c403615220/third_party/libpng16/README.pdfium
[add] https://crrev.com/cc5f350ab9c825884424faaacc2fa3c403615220/third_party/libpng16/LICENSE
[delete] https://crrev.com/424621e3129f7029283f72e953fe0c69f982d257/third_party/libpng16/contrib/intel/intel_sse.patch
[modify] https://crrev.com/cc5f350ab9c825884424faaacc2fa3c403615220/third_party/libpng16/pngset.c
[modify] https://crrev.com/cc5f350ab9c825884424faaacc2fa3c403615220/third_party/libpng16/png.c
[modify] https://crrev.com/cc5f350ab9c825884424faaacc2fa3c403615220/third_party/libpng16/pngrio.c
[modify] https://crrev.com/cc5f350ab9c825884424faaacc2fa3c403615220/third_party/libpng16/pngwio.c
[modify] https://crrev.com/cc5f350ab9c825884424faaacc2fa3c403615220/third_party/libpng16/pngconf.h
[modify] https://crrev.com/cc5f350ab9c825884424faaacc2fa3c403615220/third_party/libpng16/png.h
[modify] https://crrev.com/cc5f350ab9c825884424faaacc2fa3c403615220/third_party/BUILD.gn
[modify] https://crrev.com/cc5f350ab9c825884424faaacc2fa3c403615220/third_party/libpng16/pnginfo.h
[modify] https://crrev.com/cc5f350ab9c825884424faaacc2fa3c403615220/third_party/libpng16/pngstruct.h

Project Member

Comment 6 by bugdroid1@chromium.org, Sep 5

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/69ee978e3646c36317f0b38ca39f1fa5be6a3477

commit 69ee978e3646c36317f0b38ca39f1fa5be6a3477
Author: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Tue Sep 04 23:51:47 2018

Roll src/third_party/pdfium a38996be8593..424621e3129f (6 commits)

https://pdfium.googlesource.com/pdfium.git/+log/a38996be8593..424621e3129f


git log a38996be8593..424621e3129f --date=short --no-merges --format='%ad %ae %s'
2018-09-04 thestig@chromium.org Revert "Update libpng from 1.6.22 -> 1.6.34"
2018-09-04 tsepez@chromium.org Consolidate some common code in ccoded_progressivedecoder.
2018-09-04 tsepez@chromium.org Fix some more span/memcpy interactions.
2018-09-04 tsepez@chromium.org Avoid CHECK in fpdf_parser_decode.cpp (memcpy empty span)
2018-09-04 rharrison@chromium.org Update libpng from 1.6.22 -> 1.6.34
2018-09-04 thestig@chromium.org Remove unneeded fpdf_parser_decode.h #includes.


Created with:
  gclient setdep -r src/third_party/pdfium@424621e3129f

The AutoRoll server is located here: https://autoroll.skia.org/r/pdfium-autoroll

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.



BUG= chromium:880322 , chromium:879910 , chromium:880322 
TBR=dsinclair@chromium.org

Change-Id: Ic8ca7cd74d184268e659f7ba9bb048abba5705c7
Reviewed-on: https://chromium-review.googlesource.com/1205592
Reviewed-by: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Commit-Queue: pdfium-chromium-autoroll <pdfium-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#588700}
[modify] https://crrev.com/69ee978e3646c36317f0b38ca39f1fa5be6a3477/DEPS

Status: Fixed (was: Started)
Project Member

Comment 8 by sheriffbot@chromium.org, Sep 7

Labels: Restrict-View-SecurityNotify
Project Member

Comment 9 by sheriffbot@chromium.org, Dec 14

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment