|
 |
ec3b89 |
From 6cad2f6857ab669139e5d417139b5795fae4afdf Mon Sep 17 00:00:00 2001
|
|
|
ec3b89 |
From: Lumir Balhar <lbalhar@redhat.com>
|
|
|
ec3b89 |
Date: Fri, 14 Feb 2020 09:43:57 +0100
|
|
|
ec3b89 |
Subject: [PATCH] CVE-2020-5312_CVE-2019-16865
|
|
|
ec3b89 |
|
|
|
ec3b89 |
---
|
|
|
ec3b89 |
.../PIL/PsdImagePlugin.py | 6 ++++--
|
|
|
ec3b89 |
.../libImaging/FliDecode.c | 14 +++++++++++---
|
|
|
ec3b89 |
.../libImaging/PcxDecode.c | 8 ++++++++
|
|
|
ec3b89 |
.../libImaging/RawDecode.c | 11 +++++++++--
|
|
|
ec3b89 |
4 files changed, 32 insertions(+), 7 deletions(-)
|
|
|
ec3b89 |
|
|
|
ec3b89 |
diff --git a/python-imaging-Pillow-d1c6db8/PIL/PsdImagePlugin.py b/python-imaging-Pillow-d1c6db8/PIL/PsdImagePlugin.py
|
|
|
ec3b89 |
index 2192015..9072875 100644
|
|
|
ec3b89 |
--- a/python-imaging-Pillow-d1c6db8/PIL/PsdImagePlugin.py
|
|
|
ec3b89 |
+++ b/python-imaging-Pillow-d1c6db8/PIL/PsdImagePlugin.py
|
|
|
ec3b89 |
@@ -202,9 +202,11 @@ def _layerinfo(file):
|
|
|
ec3b89 |
# skip over blend flags and extra information
|
|
|
ec3b89 |
filler = read(12)
|
|
|
ec3b89 |
name = ""
|
|
|
ec3b89 |
- size = i32(read(4))
|
|
|
ec3b89 |
+ size = i32(read(4)) # length of the extra data field
|
|
|
ec3b89 |
combined = 0
|
|
|
ec3b89 |
if size:
|
|
|
ec3b89 |
+ data_end = file.tell() + size
|
|
|
ec3b89 |
+
|
|
|
ec3b89 |
length = i32(read(4))
|
|
|
ec3b89 |
if length:
|
|
|
ec3b89 |
mask_y = i32(read(4)); mask_x = i32(read(4))
|
|
|
ec3b89 |
@@ -223,7 +225,7 @@ def _layerinfo(file):
|
|
|
ec3b89 |
name = read(length).decode('latin-1', 'replace')
|
|
|
ec3b89 |
combined += length + 1
|
|
|
ec3b89 |
|
|
|
ec3b89 |
- file.seek(size - combined, 1)
|
|
|
ec3b89 |
+ file.seek(data_end)
|
|
|
ec3b89 |
layers.append((name, mode, (x0, y0, x1, y1)))
|
|
|
ec3b89 |
|
|
|
ec3b89 |
# get tiles
|
|
|
ec3b89 |
diff --git a/python-imaging-Pillow-d1c6db8/libImaging/FliDecode.c b/python-imaging-Pillow-d1c6db8/libImaging/FliDecode.c
|
|
|
ec3b89 |
index 75eebe8..940171f 100644
|
|
|
ec3b89 |
--- a/python-imaging-Pillow-d1c6db8/libImaging/FliDecode.c
|
|
|
ec3b89 |
+++ b/python-imaging-Pillow-d1c6db8/libImaging/FliDecode.c
|
|
|
ec3b89 |
@@ -30,7 +30,7 @@ ImagingFliDecode(Imaging im, ImagingCodecState state, UINT8* buf, int bytes)
|
|
|
ec3b89 |
{
|
|
|
ec3b89 |
UINT8* ptr;
|
|
|
ec3b89 |
int framesize;
|
|
|
ec3b89 |
- int c, chunks;
|
|
|
ec3b89 |
+ int c, chunks, advance;
|
|
|
ec3b89 |
int l, lines;
|
|
|
ec3b89 |
int i, j, x = 0, y, ymax;
|
|
|
ec3b89 |
|
|
|
ec3b89 |
@@ -59,10 +59,16 @@ ImagingFliDecode(Imaging im, ImagingCodecState state, UINT8* buf, int bytes)
|
|
|
ec3b89 |
|
|
|
ec3b89 |
chunks = I16(ptr+6);
|
|
|
ec3b89 |
ptr += 16;
|
|
|
ec3b89 |
+ bytes -= 16;
|
|
|
ec3b89 |
|
|
|
ec3b89 |
/* Process subchunks */
|
|
|
ec3b89 |
for (c = 0; c < chunks; c++) {
|
|
|
ec3b89 |
- UINT8 *data = ptr + 6;
|
|
|
ec3b89 |
+ UINT8* data;
|
|
|
ec3b89 |
+ if (bytes < 10) {
|
|
|
ec3b89 |
+ state->errcode = IMAGING_CODEC_OVERRUN;
|
|
|
ec3b89 |
+ return -1;
|
|
|
ec3b89 |
+ }
|
|
|
ec3b89 |
+ data = ptr + 6;
|
|
|
ec3b89 |
switch (I16(ptr+4)) {
|
|
|
ec3b89 |
case 4: case 11:
|
|
|
ec3b89 |
/* FLI COLOR chunk */
|
|
|
ec3b89 |
@@ -198,7 +204,9 @@ ImagingFliDecode(Imaging im, ImagingCodecState state, UINT8* buf, int bytes)
|
|
|
ec3b89 |
state->errcode = IMAGING_CODEC_UNKNOWN;
|
|
|
ec3b89 |
return -1;
|
|
|
ec3b89 |
}
|
|
|
ec3b89 |
- ptr += I32(ptr);
|
|
|
ec3b89 |
+ advance = I32(ptr);
|
|
|
ec3b89 |
+ ptr += advance;
|
|
|
ec3b89 |
+ bytes -= advance;
|
|
|
ec3b89 |
}
|
|
|
ec3b89 |
|
|
|
ec3b89 |
return -1; /* end of frame */
|
|
|
ec3b89 |
diff --git a/python-imaging-Pillow-d1c6db8/libImaging/PcxDecode.c b/python-imaging-Pillow-d1c6db8/libImaging/PcxDecode.c
|
|
|
ec3b89 |
index ab82b23..4a1d92a 100644
|
|
|
ec3b89 |
--- a/python-imaging-Pillow-d1c6db8/libImaging/PcxDecode.c
|
|
|
ec3b89 |
+++ b/python-imaging-Pillow-d1c6db8/libImaging/PcxDecode.c
|
|
|
ec3b89 |
@@ -22,6 +22,14 @@ ImagingPcxDecode(Imaging im, ImagingCodecState state, UINT8* buf, int bytes)
|
|
|
ec3b89 |
UINT8 n;
|
|
|
ec3b89 |
UINT8* ptr;
|
|
|
ec3b89 |
|
|
|
ec3b89 |
+ if (strcmp(im->mode, "1") == 0 && state->xsize > state->bytes * 8) {
|
|
|
ec3b89 |
+ state->errcode = IMAGING_CODEC_OVERRUN;
|
|
|
ec3b89 |
+ return -1;
|
|
|
ec3b89 |
+ } else if (strcmp(im->mode, "P") == 0 && state->xsize > state->bytes) {
|
|
|
ec3b89 |
+ state->errcode = IMAGING_CODEC_OVERRUN;
|
|
|
ec3b89 |
+ return -1;
|
|
|
ec3b89 |
+ }
|
|
|
ec3b89 |
+
|
|
|
ec3b89 |
ptr = buf;
|
|
|
ec3b89 |
|
|
|
ec3b89 |
for (;;) {
|
|
|
ec3b89 |
diff --git a/python-imaging-Pillow-d1c6db8/libImaging/RawDecode.c b/python-imaging-Pillow-d1c6db8/libImaging/RawDecode.c
|
|
|
ec3b89 |
index 5aadb2b..b8b667e 100644
|
|
|
ec3b89 |
--- a/python-imaging-Pillow-d1c6db8/libImaging/RawDecode.c
|
|
|
ec3b89 |
+++ b/python-imaging-Pillow-d1c6db8/libImaging/RawDecode.c
|
|
|
ec3b89 |
@@ -33,8 +33,15 @@ ImagingRawDecode(Imaging im, ImagingCodecState state, UINT8* buf, int bytes)
|
|
|
ec3b89 |
|
|
|
ec3b89 |
/* get size of image data and padding */
|
|
|
ec3b89 |
state->bytes = (state->xsize * state->bits + 7) / 8;
|
|
|
ec3b89 |
- rawstate->skip = (rawstate->stride) ?
|
|
|
ec3b89 |
- rawstate->stride - state->bytes : 0;
|
|
|
ec3b89 |
+ if (rawstate->stride) {
|
|
|
ec3b89 |
+ rawstate->skip = rawstate->stride - state->bytes;
|
|
|
ec3b89 |
+ if (rawstate->skip < 0) {
|
|
|
ec3b89 |
+ state->errcode = IMAGING_CODEC_CONFIG;
|
|
|
ec3b89 |
+ return -1;
|
|
|
ec3b89 |
+ }
|
|
|
ec3b89 |
+ } else {
|
|
|
ec3b89 |
+ rawstate->skip = 0;
|
|
|
ec3b89 |
+ }
|
|
|
ec3b89 |
|
|
|
ec3b89 |
/* check image orientation */
|
|
|
ec3b89 |
if (state->ystep < 0) {
|
|
|
ec3b89 |
--
|
|
|
ec3b89 |
2.24.1
|
|
|
ec3b89 |
|