Repository navigation
Conversation
LoadPixelDataRLE8() let the position in the scanline grow beyond the image width: through the RLE_DELTA command, and by adding the full length of an absolute run even if only a part of it fits. After that, "width - bits" is negative, and the absolute mode passed it as the size to read_proc, which is converted to a huge unsigned value. The rest of the file is then written behind the scanline. - Keep the horizontal position inside [0, width] and the scanline inside [0, height] when applying RLE_DELTA, and when advancing after an absolute run. - Read into the scanline only the part of an absolute run which fits and skip the rest of the run. The same clamping is applied to encoded runs, which were already safe. - Do not call read_proc with a zero size. Add a TestAPI test that decodes valid RLE8 data, runs which are longer than the scanline, deltas outside of the image, and checks that truncated data is rejected. The test images are built in the test code. The test is built only if the BMP plugin is built in (see TEST_WITH_BMP).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the heap overflow in the BMP RLE8 decoder that is already public as CVE-2020-21427.
Problem
In
LoadPixelDataRLE8, the run length is used as a read size without checking it against the space left in the scanline. Whenbitshas advanced pastwidth(an over-long run, or an RLE_DELTA that moves right),width - bitsis negative and is passed toread_procas a huge unsigned size, writing outside the scanline buffer. The same happens in the absolute mode path.Change
width - bits(never below 0).bitsandscanlineare clamped to the image bounds.Tests
New
TestAPI/testBMP.cpp(testBMPRLE8), built from in-memory 8-bit RLE8 BMPs:No crafted exploit input is included; the malformed cases are ordinary truncated or over-long streams.
The test is gated by
TEST_WITH_BMP(on by default; compiled out when the BMP plugin is disabled), matching the PCX decoder test.