|
 |
d78456 |
From f13ebca839e55d0c7ea1c7f57ae667c47fe9c0d5 Mon Sep 17 00:00:00 2001
|
|
|
d78456 |
From: Kevin Backhouse <kevinbackhouse@github.com>
|
|
|
d78456 |
Date: Mon, 5 Jul 2021 10:39:08 +0100
|
|
|
d78456 |
Subject: [PATCH 1/2] Regression test for
|
|
|
d78456 |
https://github.com/Exiv2/exiv2/security/advisories/GHSA-583f-w9pm-99r2
|
|
|
d78456 |
|
|
|
d78456 |
---
|
|
|
d78456 |
test/data/issue_ghsa_583f_w9pm_99r2_poc.jp2 | Bin 0 -> 32768 bytes
|
|
|
d78456 |
.../github/test_issue_ghsa_583f_w9pm_99r2.py | 18 ++++++++++++++++++
|
|
|
d78456 |
2 files changed, 18 insertions(+)
|
|
|
d78456 |
create mode 100644 test/data/issue_ghsa_583f_w9pm_99r2_poc.jp2
|
|
|
d78456 |
create mode 100644 tests/bugfixes/github/test_issue_ghsa_583f_w9pm_99r2.py
|
|
|
d78456 |
|
|
|
d78456 |
diff --git a/tests/bugfixes/github/test_issue_ghsa_583f_w9pm_99r2.py b/tests/bugfixes/github/test_issue_ghsa_583f_w9pm_99r2.py
|
|
|
d78456 |
new file mode 100644
|
|
|
d78456 |
index 000000000..808916aee
|
|
|
d78456 |
--- /dev/null
|
|
|
d78456 |
+++ b/tests/bugfixes/github/test_issue_ghsa_583f_w9pm_99r2.py
|
|
|
d78456 |
@@ -0,0 +1,18 @@
|
|
|
d78456 |
+# -*- coding: utf-8 -*-
|
|
|
d78456 |
+
|
|
|
d78456 |
+from system_tests import CaseMeta, path, check_no_ASAN_UBSAN_errors
|
|
|
d78456 |
+
|
|
|
d78456 |
+class Jp2ImagePrintStructureICC(metaclass=CaseMeta):
|
|
|
d78456 |
+ """
|
|
|
d78456 |
+ Regression test for the bug described in:
|
|
|
d78456 |
+ https://github.com/Exiv2/exiv2/security/advisories/GHSA-583f-w9pm-99r2
|
|
|
d78456 |
+ """
|
|
|
d78456 |
+ url = "https://github.com/Exiv2/exiv2/security/advisories/GHSA-583f-w9pm-99r2"
|
|
|
d78456 |
+
|
|
|
d78456 |
+ filename = path("$data_path/issue_ghsa_583f_w9pm_99r2_poc.jp2")
|
|
|
d78456 |
+ commands = ["$exiv2 -p C $filename"]
|
|
|
d78456 |
+ stdout = [""]
|
|
|
d78456 |
+ stderr = ["""Exiv2 exception in print action for file $filename:
|
|
|
d78456 |
+$kerCorruptedMetadata
|
|
|
d78456 |
+"""]
|
|
|
d78456 |
+ retval = [1]
|
|
|
d78456 |
|
|
|
d78456 |
From dbf472751fc8b87ea7d1de02f54eaf64233a2fb6 Mon Sep 17 00:00:00 2001
|
|
|
d78456 |
From: Kevin Backhouse <kevinbackhouse@github.com>
|
|
|
d78456 |
Date: Mon, 5 Jul 2021 10:40:03 +0100
|
|
|
d78456 |
Subject: [PATCH 2/2] Better bounds checking in Jp2Image::printStructure
|
|
|
d78456 |
|
|
|
d78456 |
---
|
|
|
d78456 |
src/jp2image.cpp | 2 ++
|
|
|
d78456 |
1 file changed, 2 insertions(+)
|
|
|
d78456 |
|
|
|
d78456 |
diff --git a/src/jp2image.cpp b/src/jp2image.cpp
|
|
|
d78456 |
index 3bf356629..2d6dc2118 100644
|
|
|
d78456 |
--- a/src/jp2image.cpp
|
|
|
d78456 |
+++ b/src/jp2image.cpp
|
|
|
d78456 |
@@ -538,6 +538,7 @@ static void boxes_check(size_t b,size_t m)
|
|
|
d78456 |
|
|
|
d78456 |
if (subBox.type == kJp2BoxTypeColorHeader) {
|
|
|
d78456 |
long pad = 3; // don't know why there are 3 padding bytes
|
|
|
d78456 |
+ enforce(data.size_ >= pad, kerCorruptedMetadata);
|
|
|
d78456 |
if (bPrint) {
|
|
|
d78456 |
out << " | pad:";
|
|
|
d78456 |
for (int i = 0; i < 3; i++)
|
|
|
d78456 |
@@ -547,6 +548,7 @@ static void boxes_check(size_t b,size_t m)
|
|
|
d78456 |
if (bPrint) {
|
|
|
d78456 |
out << " | iccLength:" << iccLength;
|
|
|
d78456 |
}
|
|
|
d78456 |
+ enforce(iccLength <= data.size_ - pad, kerCorruptedMetadata);
|
|
|
d78456 |
if (bICC) {
|
|
|
d78456 |
out.write((const char*)data.pData_ + pad, iccLength);
|
|
|
d78456 |
}
|