mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
35 lines
1.6 KiB
TOML
35 lines
1.6 KiB
TOML
|
# libpng -- 91k lines of C across 101 files.
|
||
|
|
#
|
||
|
|
# This is the ENVELOPE checkout, and the only question it answers is whether one CPG over a real C library
|
||
|
|
# is affordable: build time, query time, peak memory, and whether the region ranker produces a sane number
|
||
|
|
# of regions rather than thousands.
|
||
|
|
#
|
||
|
|
# Its known CVE is deliberately marked out of scope. An out-of-bounds read is not a family this engine
|
||
|
|
# arbitrates -- there is no taint sanitizer lattice, guard dominance or constant abstraction that decides
|
||
|
|
# it -- so "not found" here is not a miss, and recording it as one would be the easiest way to make a
|
||
|
|
# measurement lie.
|
||
|
|
|
||
|
|
name = "libpng"
|
||
|
|
url = "https://github.com/glennrp/libpng.git"
|
||
|
|
commit = "cf53e54ccf631d8de68a30ebb3b8eeed1d6f1a08"
|
||
|
|
language = "c"
|
||
|
|
license = "libpng-2.0"
|
||
|
|
license_file = "LICENSE"
|
||
|
|
measures = ["envelope"]
|
||
|
|
note = """
|
||
|
|
The pinned commit is the parent of 788a624d7387a758ffd5c7ab010f1870dea753a1, the commit that added the
|
||
|
|
missing clamp; `git describe` calls it v1.6.51-1-gcf53e54cc. The licence file is `LICENSE` at this commit; it was renamed
|
||
|
|
to `LICENSE.md` later, which is why the recipe names the file and the verifier checks it. Nothing is vendored from this repository -- the
|
||
|
|
recipe fetches it on request and CI never does.
|
||
|
|
"""
|
||
|
|
|
||
|
|
[[known]]
|
||
|
|
id = "CVE-2025-66293"
|
||
|
|
family = "memory_safety"
|
||
|
|
weakness = "out-of-bounds read: an unclamped composited component indexes the sRGB conversion table"
|
||
|
|
file = "pngread.c"
|
||
|
|
function = "png_image_read_composite"
|
||
|
|
line = 3279
|
||
|
|
reference = "fixed in 788a624d7387a758ffd5c7ab010f1870dea753a1; the CVE is named in the code comment added by d1ec15266204deb4102d2b5e40216bb7637261c8"
|
||
|
|
in_scope = false
|