|
 |
295e85 |
From 1b917c3f7dd86336a9f6fda4456422c419dfe88c Mon Sep 17 00:00:00 2001
|
|
|
295e85 |
From: clanmills <robin@clanmills.com>
|
|
|
295e85 |
Date: Tue, 1 Oct 2019 17:39:44 +0100
|
|
|
295e85 |
Subject: [PATCH] Fix #1011 fix_1011_jp2_readmetadata_loop
|
|
|
295e85 |
|
|
|
295e85 |
---
|
|
|
295e85 |
src/jp2image.cpp | 25 +++++++++++++++----
|
|
|
295e85 |
test/data/Jp2Image_readMetadata_loop.poc | Bin 0 -> 738 bytes
|
|
|
295e85 |
tests/bugfixes/github/test_CVE_2017_17725.py | 4 +--
|
|
|
295e85 |
tests/bugfixes/github/test_issue_1011.py | 13 ++++++++++
|
|
|
295e85 |
4 files changed, 35 insertions(+), 7 deletions(-)
|
|
|
295e85 |
create mode 100755 test/data/Jp2Image_readMetadata_loop.poc
|
|
|
295e85 |
create mode 100644 tests/bugfixes/github/test_issue_1011.py
|
|
|
295e85 |
|
|
|
295e85 |
diff --git a/src/jp2image.cpp b/src/jp2image.cpp
|
|
|
295e85 |
index d5cd1340a..0de088d62 100644
|
|
|
295e85 |
--- a/src/jp2image.cpp
|
|
|
295e85 |
+++ b/src/jp2image.cpp
|
|
|
295e85 |
@@ -18,10 +18,6 @@
|
|
|
295e85 |
* Foundation, Inc., 51 Franklin Street, 5th Floor, Boston, MA 02110-1301 USA.
|
|
|
295e85 |
*/
|
|
|
295e85 |
|
|
|
295e85 |
-/*
|
|
|
295e85 |
- File: jp2image.cpp
|
|
|
295e85 |
-*/
|
|
|
295e85 |
-
|
|
|
295e85 |
// *****************************************************************************
|
|
|
295e85 |
|
|
|
295e85 |
// included header files
|
|
|
295e85 |
@@ -197,6 +193,16 @@ namespace Exiv2
|
|
|
295e85 |
return result;
|
|
|
295e85 |
}
|
|
|
295e85 |
|
|
|
295e85 |
+static void boxes_check(size_t b,size_t m)
|
|
|
295e85 |
+{
|
|
|
295e85 |
+ if ( b > m ) {
|
|
|
295e85 |
+#ifdef EXIV2_DEBUG_MESSAGES
|
|
|
295e85 |
+ std::cout << "Exiv2::Jp2Image::readMetadata box maximum exceeded" << std::endl;
|
|
|
295e85 |
+#endif
|
|
|
295e85 |
+ throw Error(kerCorruptedMetadata);
|
|
|
295e85 |
+ }
|
|
|
295e85 |
+}
|
|
|
295e85 |
+
|
|
|
295e85 |
void Jp2Image::readMetadata()
|
|
|
295e85 |
{
|
|
|
295e85 |
#ifdef EXIV2_DEBUG_MESSAGES
|
|
|
295e85 |
@@ -219,9 +225,12 @@ namespace Exiv2
|
|
|
295e85 |
Jp2BoxHeader subBox = {0,0};
|
|
|
295e85 |
Jp2ImageHeaderBox ihdr = {0,0,0,0,0,0,0,0};
|
|
|
295e85 |
Jp2UuidBox uuid = {{0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}};
|
|
|
295e85 |
+ size_t boxes = 0 ;
|
|
|
295e85 |
+ size_t boxem = 1000 ; // boxes max
|
|
|
295e85 |
|
|
|
295e85 |
while (io_->read((byte*)&box, sizeof(box)) == sizeof(box))
|
|
|
295e85 |
{
|
|
|
295e85 |
+ boxes_check(boxes++,boxem );
|
|
|
295e85 |
position = io_->tell();
|
|
|
295e85 |
box.length = getLong((byte*)&box.length, bigEndian);
|
|
|
295e85 |
box.type = getLong((byte*)&box.type, bigEndian);
|
|
|
295e85 |
@@ -251,8 +260,12 @@ namespace Exiv2
|
|
|
295e85 |
|
|
|
295e85 |
while (io_->read((byte*)&subBox, sizeof(subBox)) == sizeof(subBox) && subBox.length )
|
|
|
295e85 |
{
|
|
|
295e85 |
+ boxes_check(boxes++, boxem) ;
|
|
|
295e85 |
subBox.length = getLong((byte*)&subBox.length, bigEndian);
|
|
|
295e85 |
subBox.type = getLong((byte*)&subBox.type, bigEndian);
|
|
|
295e85 |
+ if (subBox.length > io_->size() ) {
|
|
|
295e85 |
+ throw Error(kerCorruptedMetadata);
|
|
|
295e85 |
+ }
|
|
|
295e85 |
#ifdef EXIV2_DEBUG_MESSAGES
|
|
|
295e85 |
std::cout << "Exiv2::Jp2Image::readMetadata: "
|
|
|
295e85 |
<< "subBox = " << toAscii(subBox.type) << " length = " << subBox.length << std::endl;
|
|
|
295e85 |
@@ -308,7 +321,9 @@ namespace Exiv2
|
|
|
295e85 |
}
|
|
|
295e85 |
|
|
|
295e85 |
io_->seek(restore,BasicIo::beg);
|
|
|
295e85 |
- io_->seek(subBox.length, Exiv2::BasicIo::cur);
|
|
|
295e85 |
+ if ( io_->seek(subBox.length, Exiv2::BasicIo::cur) != 0 ) {
|
|
|
295e85 |
+ throw Error(kerCorruptedMetadata);
|
|
|
295e85 |
+ }
|
|
|
295e85 |
restore = io_->tell();
|
|
|
295e85 |
}
|
|
|
295e85 |
break;
|
|
|
295e85 |
diff --git a/tests/bugfixes/github/test_CVE_2017_17725.py b/tests/bugfixes/github/test_CVE_2017_17725.py
|
|
|
295e85 |
index 1127b9806..670a75d8d 100644
|
|
|
295e85 |
--- a/tests/bugfixes/github/test_CVE_2017_17725.py
|
|
|
295e85 |
+++ b/tests/bugfixes/github/test_CVE_2017_17725.py
|
|
|
295e85 |
@@ -11,7 +11,7 @@ class TestCvePoC(metaclass=system_tests.CaseMeta):
|
|
|
295e85 |
filename = "$data_path/poc_2017-12-12_issue188"
|
|
|
295e85 |
commands = ["$exiv2 " + filename]
|
|
|
295e85 |
stdout = [""]
|
|
|
295e85 |
- stderr = ["""$exiv2_overflow_exception_message """ + filename + """:
|
|
|
295e85 |
-$addition_overflow_message
|
|
|
295e85 |
+ stderr = ["""$exiv2_exception_message """ + filename + """:
|
|
|
295e85 |
+$kerCorruptedMetadata
|
|
|
295e85 |
"""]
|
|
|
295e85 |
retval = [1]
|