convertbmp: detect invalid file dimensions early
width/length dimensions read from bmp headers are not necessarily valid. For instance they may have been maliciously set to very large values with the intention to cause DoS (large memory allocation, stack overflow). In these cases we want to detect the invalid size as early as possible. This commit introduces a counter which verifies that the number of written bytes corresponds to the advertized width/length. Fixes #1059 (CVE-2018-6616).
This commit is contained in:
parent
e7640f58f1
commit
8ee335227b
|
@ -534,14 +534,14 @@ static OPJ_BOOL bmp_read_raw_data(FILE* IN, OPJ_UINT8* pData, OPJ_UINT32 stride,
|
||||||
static OPJ_BOOL bmp_read_rle8_data(FILE* IN, OPJ_UINT8* pData,
|
static OPJ_BOOL bmp_read_rle8_data(FILE* IN, OPJ_UINT8* pData,
|
||||||
OPJ_UINT32 stride, OPJ_UINT32 width, OPJ_UINT32 height)
|
OPJ_UINT32 stride, OPJ_UINT32 width, OPJ_UINT32 height)
|
||||||
{
|
{
|
||||||
OPJ_UINT32 x, y;
|
OPJ_UINT32 x, y, written;
|
||||||
OPJ_UINT8 *pix;
|
OPJ_UINT8 *pix;
|
||||||
const OPJ_UINT8 *beyond;
|
const OPJ_UINT8 *beyond;
|
||||||
|
|
||||||
beyond = pData + stride * height;
|
beyond = pData + stride * height;
|
||||||
pix = pData;
|
pix = pData;
|
||||||
|
|
||||||
x = y = 0U;
|
x = y = written = 0U;
|
||||||
while (y < height) {
|
while (y < height) {
|
||||||
int c = getc(IN);
|
int c = getc(IN);
|
||||||
if (c == EOF) {
|
if (c == EOF) {
|
||||||
|
@ -561,6 +561,7 @@ static OPJ_BOOL bmp_read_rle8_data(FILE* IN, OPJ_UINT8* pData,
|
||||||
for (j = 0; (j < c) && (x < width) &&
|
for (j = 0; (j < c) && (x < width) &&
|
||||||
((OPJ_SIZE_T)pix < (OPJ_SIZE_T)beyond); j++, x++, pix++) {
|
((OPJ_SIZE_T)pix < (OPJ_SIZE_T)beyond); j++, x++, pix++) {
|
||||||
*pix = c1;
|
*pix = c1;
|
||||||
|
written++;
|
||||||
}
|
}
|
||||||
} else {
|
} else {
|
||||||
c = getc(IN);
|
c = getc(IN);
|
||||||
|
@ -598,6 +599,7 @@ static OPJ_BOOL bmp_read_rle8_data(FILE* IN, OPJ_UINT8* pData,
|
||||||
}
|
}
|
||||||
c1 = (OPJ_UINT8)c1_int;
|
c1 = (OPJ_UINT8)c1_int;
|
||||||
*pix = c1;
|
*pix = c1;
|
||||||
|
written++;
|
||||||
}
|
}
|
||||||
if ((OPJ_UINT32)c & 1U) { /* skip padding byte */
|
if ((OPJ_UINT32)c & 1U) { /* skip padding byte */
|
||||||
c = getc(IN);
|
c = getc(IN);
|
||||||
|
@ -608,6 +610,12 @@ static OPJ_BOOL bmp_read_rle8_data(FILE* IN, OPJ_UINT8* pData,
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}/* while() */
|
}/* while() */
|
||||||
|
|
||||||
|
if (written != width * height) {
|
||||||
|
fprintf(stderr, "warning, image's actual size does not match advertized one\n");
|
||||||
|
return OPJ_FALSE;
|
||||||
|
}
|
||||||
|
|
||||||
return OPJ_TRUE;
|
return OPJ_TRUE;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue