python-pillow/Pillow
1
1
Fork 0
mirror of https://github.com/python-pillow/Pillow.git synced 2025-01-26 09:14:27 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4504 from hugovk/sgi_fixes

Browse Source 
Fix buffer overflow in SGI-RLE decoding
This commit is contained in:
Hugo van Kemenade 2020-04-01 12:27:14 +03:00 committed by GitHub
commit 2ef59fdbae
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 20 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
Tests/images/sgi_crash.bin Normal file
View File

Binary file not shown.

BIN
Tests/images/sgi_overrun_expandrowF04.bin Normal file
View File

Binary file not shown.

14
Tests/test_sgi_crash.py Normal file
View File

@ -0,0 +1,14 @@
#!/usr/bin/env python
import pytest
from PIL import Image
@pytest.mark.parametrize(
"test_file",
["Tests/images/sgi_overrun_expandrowF04.bin", "Tests/images/sgi_crash.bin"],
)
def test_crashes(test_file):
with open(test_file, "rb") as f:
im = Image.open(f)
with pytest.raises(IOError):
im.load()

8
src/libImaging/SgiRleDecode.c
View File

@ -28,6 +28,7 @@ static void read4B(UINT32* dest, UINT8* buf)
static int expandrow(UINT8* dest, UINT8* src, int n, int z, int xsize)
{
UINT8 pixel, count;
int x = 0;
for (;n > 0; n--)
{
@ -37,9 +38,10 @@ static int expandrow(UINT8* dest, UINT8* src, int n, int z, int xsize)
count = pixel & RLE_MAX_RUN;
if (!count)
return count;
if (count > xsize) {
if (x + count > xsize) {
return -1;
}
x += count;
if (pixel & RLE_COPY_FLAG) {
while(count--) {
*dest = *src++;
@ -63,6 +65,7 @@ static int expandrow2(UINT8* dest, const UINT8* src, int n, int z, int xsize)
{
UINT8 pixel, count;
int x = 0;
for (;n > 0; n--)
{
@ -73,9 +76,10 @@ static int expandrow2(UINT8* dest, const UINT8* src, int n, int z, int xsize)
count = pixel & RLE_MAX_RUN;
if (!count)
return count;
if (count > xsize) {
if (x + count > xsize) {
return -1;
}
x += count;
if (pixel & RLE_COPY_FLAG) {
while(count--) {
memcpy(dest, src, 2);