Posted by Ron E on Sep 08
The DjVuLibre document compression library (tested version 3.5.29) is
vulnerable to an integer overflow caused by a left shift of a negative
signed integer in the IW44EncodeCodec.cpp component. When processing
crafted PPM input passed through the c44 utility, negative pixel values are
left-shifted in functions such as filter_fh, filter_fv, and
IW44Image::Map::Encode::create. This results in undefined behavior and
corrupted intermediate state…
– Read More – Full Disclosure
