|
 |
50a37d |
From 1dd0fb64bd3cc221b5877ece4ce2f300245b638f Mon Sep 17 00:00:00 2001
|
|
|
50a37d |
From: Lumir Balhar <lbalhar@redhat.com>
|
|
|
50a37d |
Date: Mon, 17 Feb 2020 14:19:32 +0100
|
|
|
50a37d |
Subject: [PATCH] CVE-2020-5311
|
|
|
50a37d |
|
|
|
50a37d |
---
|
|
|
50a37d |
src/libImaging/SgiRleDecode.c | 23 +++++++++++++++++------
|
|
|
50a37d |
1 file changed, 17 insertions(+), 6 deletions(-)
|
|
|
50a37d |
|
|
|
50a37d |
diff --git a/src/libImaging/SgiRleDecode.c b/src/libImaging/SgiRleDecode.c
|
|
|
50a37d |
index 39e7b3a..6367ae7 100644
|
|
|
50a37d |
--- a/src/libImaging/SgiRleDecode.c
|
|
|
50a37d |
+++ b/src/libImaging/SgiRleDecode.c
|
|
|
50a37d |
@@ -25,7 +25,7 @@ static void read4B(UINT32* dest, UINT8* buf)
|
|
|
50a37d |
*dest = (UINT32)((buf[0] << 24) | (buf[1] << 16) | (buf[2] << 8) | buf[3]);
|
|
|
50a37d |
}
|
|
|
50a37d |
|
|
|
50a37d |
-static int expandrow(UINT8* dest, UINT8* src, int n, int z)
|
|
|
50a37d |
+static int expandrow(UINT8* dest, UINT8* src, int n, int z, int xsize)
|
|
|
50a37d |
{
|
|
|
50a37d |
UINT8 pixel, count;
|
|
|
50a37d |
|
|
|
50a37d |
@@ -37,6 +37,9 @@ static int expandrow(UINT8* dest, UINT8* src, int n, int z)
|
|
|
50a37d |
count = pixel & RLE_MAX_RUN;
|
|
|
50a37d |
if (!count)
|
|
|
50a37d |
return count;
|
|
|
50a37d |
+ if (count > xsize) {
|
|
|
50a37d |
+ return -1;
|
|
|
50a37d |
+ }
|
|
|
50a37d |
if (pixel & RLE_COPY_FLAG) {
|
|
|
50a37d |
while(count--) {
|
|
|
50a37d |
*dest = *src++;
|
|
|
50a37d |
@@ -56,7 +59,7 @@ static int expandrow(UINT8* dest, UINT8* src, int n, int z)
|
|
|
50a37d |
return 0;
|
|
|
50a37d |
}
|
|
|
50a37d |
|
|
|
50a37d |
-static int expandrow2(UINT16* dest, UINT16* src, int n, int z)
|
|
|
50a37d |
+static int expandrow2(UINT16* dest, UINT16* src, int n, int z, int xsize)
|
|
|
50a37d |
{
|
|
|
50a37d |
UINT8 pixel, count;
|
|
|
50a37d |
|
|
|
50a37d |
@@ -70,6 +73,9 @@ static int expandrow2(UINT16* dest, UINT16* src, int n, int z)
|
|
|
50a37d |
count = pixel & RLE_MAX_RUN;
|
|
|
50a37d |
if (!count)
|
|
|
50a37d |
return count;
|
|
|
50a37d |
+ if (count > xsize) {
|
|
|
50a37d |
+ return -1;
|
|
|
50a37d |
+ }
|
|
|
50a37d |
if (pixel & RLE_COPY_FLAG) {
|
|
|
50a37d |
while(count--) {
|
|
|
50a37d |
*dest = *src++;
|
|
|
50a37d |
@@ -95,6 +101,7 @@ ImagingSgiRleDecode(Imaging im, ImagingCodecState state,
|
|
|
50a37d |
UINT8 *ptr;
|
|
|
50a37d |
SGISTATE *c;
|
|
|
50a37d |
int err = 0;
|
|
|
50a37d |
+ int status;
|
|
|
50a37d |
|
|
|
50a37d |
/* Get all data from File descriptor */
|
|
|
50a37d |
c = (SGISTATE*)state->context;
|
|
|
50a37d |
@@ -163,12 +170,16 @@ ImagingSgiRleDecode(Imaging im, ImagingCodecState state,
|
|
|
50a37d |
|
|
|
50a37d |
/* row decompression */
|
|
|
50a37d |
if (c->bpc ==1) {
|
|
|
50a37d |
- if(expandrow(&state->buffer[c->channo], &ptr[c->rleoffset], c->rlelength, im->bands))
|
|
|
50a37d |
- goto sgi_finish_decode;
|
|
|
50a37d |
+ status = expandrow(&state->buffer[c->channo], &ptr[c->rleoffset], c->rlelength, im->bands, im->xsize);
|
|
|
50a37d |
}
|
|
|
50a37d |
else {
|
|
|
50a37d |
- if(expandrow2((UINT16*)&state->buffer[c->channo * 2], (UINT16*)&ptr[c->rleoffset], c->rlelength, im->bands))
|
|
|
50a37d |
- goto sgi_finish_decode;
|
|
|
50a37d |
+ status = expandrow2(&state->buffer[c->channo * 2], &ptr[c->rleoffset], c->rlelength, im->bands, im->xsize);
|
|
|
50a37d |
+ }
|
|
|
50a37d |
+ if (status == -1) {
|
|
|
50a37d |
+ state->errcode = IMAGING_CODEC_OVERRUN;
|
|
|
50a37d |
+ return -1;
|
|
|
50a37d |
+ } else if (status == 1) {
|
|
|
50a37d |
+ goto sgi_finish_decode;
|
|
|
50a37d |
}
|
|
|
50a37d |
|
|
|
50a37d |
state->count += c->rlelength;
|
|
|
50a37d |
--
|
|
|
50a37d |
2.24.1
|
|
|
50a37d |
|