|
 |
8703cb |
From 399719595f413158b3510128eb85f944654f960c Mon Sep 17 00:00:00 2001
|
|
|
8703cb |
From: DRC <information@libjpeg-turbo.org>
|
|
|
8703cb |
Date: Tue, 12 Jun 2018 20:27:00 -0500
|
|
|
8703cb |
Subject: [PATCH] tjLoadImage(): Fix FPE triggered by malformed BMP
|
|
|
8703cb |
|
|
|
8703cb |
In rdbmp.c, it is necessary to guard against 32-bit overflow/wraparound
|
|
|
8703cb |
when allocating the row buffer, because since BMP files have 32-bit
|
|
|
8703cb |
width and height fields, the value of biWidth can be up to 4294967295.
|
|
|
8703cb |
Specifically, if biWidth is 1073741824 and cinfo->input_components = 4,
|
|
|
8703cb |
then the samplesperrow argument in alloc_sarray() would wrap around to
|
|
|
8703cb |
0, and a division by zero error would occur at line 458 in jmemmgr.c.
|
|
|
8703cb |
|
|
|
8703cb |
If biWidth is set to a higher value, then samplesperrow would wrap
|
|
|
8703cb |
around to a small number, which would likely cause a buffer overflow
|
|
|
8703cb |
(this has not been tested or verified.)
|
|
|
8703cb |
---
|
|
|
8703cb |
rdbmp.c | 6 ++++++
|
|
|
8703cb |
1 file changed, 6 insertions(+)
|
|
|
8703cb |
|
|
|
8703cb |
diff --git a/rdbmp.c b/rdbmp.c
|
|
|
8703cb |
index eaa7086..4104b68 100644
|
|
|
8703cb |
--- a/rdbmp.c
|
|
|
8703cb |
+++ b/rdbmp.c
|
|
|
8703cb |
@@ -434,6 +434,12 @@ start_input_bmp (j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
|
|
|
8703cb |
progress->total_extra_passes++; /* count file input as separate pass */
|
|
|
8703cb |
}
|
|
|
8703cb |
|
|
|
8703cb |
+ /* Ensure that biWidth * cinfo->input_components doesn't exceed the maximum
|
|
|
8703cb |
+ value of the JDIMENSION type. This is only a danger with BMP files, since
|
|
|
8703cb |
+ their width and height fields are 32-bit integers. */
|
|
|
8703cb |
+ if ((unsigned long long)biWidth *
|
|
|
8703cb |
+ (unsigned long long)cinfo->input_components > 0xFFFFFFFFULL)
|
|
|
8703cb |
+ ERREXIT(cinfo, JERR_WIDTH_OVERFLOW);
|
|
|
8703cb |
/* Allocate one-row buffer for returned data */
|
|
|
8703cb |
source->pub.buffer = (*cinfo->mem->alloc_sarray)
|
|
|
8703cb |
((j_common_ptr) cinfo, JPOOL_IMAGE,
|
|
|
8703cb |
--
|
|
|
8703cb |
2.17.1
|
|
|
8703cb |
|