GD图形库JIS编码字体缓冲区溢出漏洞

GD Graphics Library是一款流行的图形库，用于动态图象建立。 GD图形库处理JIS编码字体存在缓冲区溢出，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 当处理特殊畸形的字符串时如果使用了JIS编码字体，由于NULL终止符的增加，会导致不可预料的结果，可能导致以应用程序进程权限任意指令执行。 RedHat Enterprise Linux WS 5 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux ES 5 RedHat Enterprise Linux ES 4 RedHat Enterprise Linux AS 5 RedHat Enterprise Linux AS 4 GD Graphics Library gdlib 2.0.33 + Trustix Secure Linux 2.2 GD Graphics Library gdlib 2.0.28 + RedHat Fedora Core3 GD Graphics Library gdlib 2.0.27 GD Graphics Library gdlib 2.0.26 GD Graphics Library gdlib 2.0.23 + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia32 GD Graphics Library gdlib 2.0.22 GD Graphics Library gdlib 2.0.21 + RedHat Fedora Core2 GD Graphics Library gdlib 2.0.20 GD Graphics Library gdlib 2.0.15 GD Graphics Library gdlib 2.0.1 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 可参考如下补丁方案： Index: gdft.c =================================================================== RCS file: /repository/gd/libgd/gdft.c,v retrieving revision 1.28 diff -u -p -r1.28 gdft.c --- gdft.c 3 Jan 2007 21:21:21 -0000 1.28 +++ gdft.c 24 Jan 2007 23:00:55 -0000 @@ -1178,7 +1178,7 @@ fprintf(stderr,"dpi=%d,%d metric_res=%d { ch = c & 0xFF; /* don't extend sign */ } - next++; + if (*next) next++; } break; case gdFTEX_Big5: