[gimp] PCX: Avoid segmentation fault with invalid file.
- From: Jehan Pagès <jehanp src gnome org>
- To: commits-list gnome org
- Cc:
- Subject: [gimp] PCX: Avoid segmentation fault with invalid file.
- Date: Sat, 8 Apr 2017 15:29:50 +0000 (UTC)
commit 10f12bdcbd475b215a4d98a0db21c98debf872d5
Author: Tobias Stoeckmann <tobias stoeckmann org>
Date: Thu Apr 6 21:37:50 2017 +0200
PCX: Avoid segmentation fault with invalid file.
If a PCX file contains a bytesperline entry which is too small, it is
possible to trigger an out of boundary read, which can lead to a
segmentation fault.
The bytesperline validation is incomplete. While checking if enough
bytes per line exist, the integer truncation during the division must be
taken into account.
An example would be a 1x1 PCX file with a bpp of 1 (monochrome). The
current check allows a bytesperline field of 0, which in turn would lead
to a 0 byte allocation in load_1. Yet, the code would access index 0.
Signed-off-by: Tobias Stoeckmann <tobias stoeckmann org>
plug-ins/common/file-pcx.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
---
diff --git a/plug-ins/common/file-pcx.c b/plug-ins/common/file-pcx.c
index fcda727..56267d7 100644
--- a/plug-ins/common/file-pcx.c
+++ b/plug-ins/common/file-pcx.c
@@ -409,7 +409,7 @@ load_image (const gchar *filename,
fclose (fd);
return -1;
}
- if (bytesperline < (width * pcx_header.bpp) / 8)
+ if (bytesperline < ((width * pcx_header.bpp + 7) / 8))
{
g_message (_("Invalid number of bytes per line in PCX header"));
fclose (fd);
[
Date Prev][
Date Next] [
Thread Prev][
Thread Next]
[
Thread Index]
[
Date Index]
[
Author Index]