Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
systemsmanagement:Ardana:9:CentOS:7.5
python-Pillow
006-Catch-SGI-buffer-overruns.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 006-Catch-SGI-buffer-overruns.patch of Package python-Pillow
From a79b65c47c7dc6fe623aadf09aa6192fc54548f3 Mon Sep 17 00:00:00 2001 From: Andrew Murray <radarhere@users.noreply.github.com> Date: Wed, 1 Jan 2020 14:16:45 +1100 Subject: [PATCH] Catch SGI buffer overruns --- Tests/test_image.py | 2 ++ src/libImaging/SgiRleDecode.c | 23 +++++++++++++++++------ 2 files changed, 19 insertions(+), 6 deletions(-) diff --git a/Tests/test_image.py b/Tests/test_image.py index 33657d56cf..2982d16d70 100644 --- a/Tests/test_image.py +++ b/Tests/test_image.py @@ -538,6 +538,8 @@ def test_overrun(self): for file in [ "fli_overrun.bin", "sgi_overrun.bin", + "sgi_overrun_expandrow.bin", + "sgi_overrun_expandrow2.bin", "pcx_overrun.bin", "pcx_overrun2.bin", ]: diff --git a/src/libImaging/SgiRleDecode.c b/src/libImaging/SgiRleDecode.c index 8a81ba8e6c..1ba56b8c7b 100644 --- a/src/libImaging/SgiRleDecode.c +++ b/src/libImaging/SgiRleDecode.c @@ -25,7 +25,7 @@ static void read4B(UINT32* dest, UINT8* buf) *dest = (UINT32)((buf[0] << 24) | (buf[1] << 16) | (buf[2] << 8) | buf[3]); } -static int expandrow(UINT8* dest, UINT8* src, int n, int z) +static int expandrow(UINT8* dest, UINT8* src, int n, int z, int xsize) { UINT8 pixel, count; @@ -37,6 +37,9 @@ static int expandrow(UINT8* dest, UINT8* src, int n, int z) count = pixel & RLE_MAX_RUN; if (!count) return count; + if (count > xsize) { + return -1; + } if (pixel & RLE_COPY_FLAG) { while(count--) { *dest = *src++; @@ -56,7 +59,7 @@ static int expandrow(UINT8* dest, UINT8* src, int n, int z) return 0; } -static int expandrow2(UINT16* dest, UINT16* src, int n, int z) +static int expandrow2(UINT16* dest, UINT16* src, int n, int z, int xsize) { UINT8 pixel, count; @@ -70,6 +73,9 @@ static int expandrow2(UINT8* dest, const UINT8* src, int n, int z) count = pixel & RLE_MAX_RUN; if (!count) return count; + if (count > xsize) { + return -1; + } if (pixel & RLE_COPY_FLAG) { while(count--) { *dest = *src++; @@ -95,6 +101,7 @@ ImagingSgiRleDecode(Imaging im, ImagingCodecState state, UINT8 *ptr; SGISTATE *c; int err = 0; + int status; /* Get all data from File descriptor */ c = (SGISTATE*)state->context; @@ -163,12 +170,16 @@ ImagingSgiRleDecode(Imaging im, ImagingCodecState state, /* row decompression */ if (c->bpc ==1) { - if(expandrow(&state->buffer[c->channo], &ptr[c->rleoffset], c->rlelength, im->bands)) - goto sgi_finish_decode; + status = expandrow(&state->buffer[c->channo], &ptr[c->rleoffset], c->rlelength, im->bands, im->xsize); } else { - if(expandrow2((UINT16*)&state->buffer[c->channo * 2], (UINT16*)&ptr[c->rleoffset], c->rlelength, im->bands)) - goto sgi_finish_decode; + status = expandrow2(&state->buffer[c->channo * 2], &ptr[c->rleoffset], c->rlelength, im->bands, im->xsize); + } + if (status == -1) { + state->errcode = IMAGING_CODEC_OVERRUN; + return -1; + } else if (status == 1) { + goto sgi_finish_decode; } state->count += c->rlelength;
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor