|
 |
1f2c39 |
commit 78a56b21340157775be2462a19276b4d31d2bd01
|
|
|
1f2c39 |
Author: Andrea Mazzoleni <amadvance@gmail.com>
|
|
|
1f2c39 |
Date: Fri Jan 4 20:49:25 2019 +0100
|
|
|
1f2c39 |
|
|
|
1f2c39 |
Fix a buffer overflow caused by invalid images
|
|
|
1f2c39 |
|
|
|
1f2c39 |
diff --git a/lib/png.c b/lib/png.c
|
|
|
1f2c39 |
index 0939a5a..cbf140b 100644
|
|
|
1f2c39 |
--- a/lib/png.c
|
|
|
1f2c39 |
+++ b/lib/png.c
|
|
|
1f2c39 |
@@ -603,6 +603,7 @@ adv_error adv_png_read_ihdr(
|
|
|
1f2c39 |
unsigned pixel;
|
|
|
1f2c39 |
unsigned width;
|
|
|
1f2c39 |
unsigned width_align;
|
|
|
1f2c39 |
+ unsigned scanline;
|
|
|
1f2c39 |
unsigned height;
|
|
|
1f2c39 |
unsigned depth;
|
|
|
1f2c39 |
int r;
|
|
|
1f2c39 |
@@ -719,9 +720,23 @@ adv_error adv_png_read_ihdr(
|
|
|
1f2c39 |
goto err_ptr;
|
|
|
1f2c39 |
}
|
|
|
1f2c39 |
|
|
|
1f2c39 |
- *dat_size = height * (width_align * pixel + 1);
|
|
|
1f2c39 |
+ /* check for overflow */
|
|
|
1f2c39 |
+ if (pixel == 0 || width_align >= UINT_MAX / pixel) {
|
|
|
1f2c39 |
+ error_set("Invalid image size");
|
|
|
1f2c39 |
+ goto err_ptr;
|
|
|
1f2c39 |
+ }
|
|
|
1f2c39 |
+
|
|
|
1f2c39 |
+ scanline = width_align * pixel + 1;
|
|
|
1f2c39 |
+
|
|
|
1f2c39 |
+ /* check for overflow */
|
|
|
1f2c39 |
+ if (scanline == 0 || height >= UINT_MAX / scanline) {
|
|
|
1f2c39 |
+ error_set("Invalid image size");
|
|
|
1f2c39 |
+ goto err_ptr;
|
|
|
1f2c39 |
+ }
|
|
|
1f2c39 |
+
|
|
|
1f2c39 |
+ *dat_size = height * scanline;
|
|
|
1f2c39 |
*dat_ptr = malloc(*dat_size);
|
|
|
1f2c39 |
- *pix_scanline = width_align * pixel + 1;
|
|
|
1f2c39 |
+ *pix_scanline = scanline;
|
|
|
1f2c39 |
*pix_ptr = *dat_ptr + 1;
|
|
|
1f2c39 |
|
|
|
1f2c39 |
z.zalloc = 0;
|
|
|
1f2c39 |
diff -up advancecomp-1.15/portable.h.me advancecomp-1.15/portable.h
|
|
|
1f2c39 |
--- advancecomp-1.15/portable.h.me 2019-05-17 15:15:08.109528451 +0200
|
|
|
1f2c39 |
+++ advancecomp-1.15/portable.h 2019-05-17 15:15:38.318620937 +0200
|
|
|
1f2c39 |
@@ -39,6 +39,7 @@ extern "C" {
|
|
|
1f2c39 |
#include <assert.h>
|
|
|
1f2c39 |
#include <errno.h>
|
|
|
1f2c39 |
#include <signal.h>
|
|
|
1f2c39 |
+#include <limits.h>
|
|
|
1f2c39 |
|
|
|
1f2c39 |
#if HAVE_UNISTD_H
|
|
|
1f2c39 |
#include <unistd.h>
|