mirror of
https://github.com/python-pillow/Pillow.git
synced 2024-12-25 01:16:16 +03:00
Fix OOB read in SgiRleDecode.c
* From Pillow 4.3.0->8.1.0 * CVE-2021-25293
This commit is contained in:
parent
3fee28eb94
commit
4853e522bd
BIN
Tests/images/crash-465703f71a0f0094873a3e0e82c9f798161171b8.sgi
Normal file
BIN
Tests/images/crash-465703f71a0f0094873a3e0e82c9f798161171b8.sgi
Normal file
Binary file not shown.
BIN
Tests/images/crash-64834657ee604b8797bf99eac6a194c124a9a8ba.sgi
Normal file
BIN
Tests/images/crash-64834657ee604b8797bf99eac6a194c124a9a8ba.sgi
Normal file
Binary file not shown.
BIN
Tests/images/crash-754d9c7ec485ffb76a90eeaab191ef69a2a3a3cd.sgi
Normal file
BIN
Tests/images/crash-754d9c7ec485ffb76a90eeaab191ef69a2a3a3cd.sgi
Normal file
Binary file not shown.
BIN
Tests/images/crash-abcf1c97b8fe42a6c68f1fb0b978530c98d57ced.sgi
Normal file
BIN
Tests/images/crash-abcf1c97b8fe42a6c68f1fb0b978530c98d57ced.sgi
Normal file
Binary file not shown.
BIN
Tests/images/crash-b82e64d4f3f76d7465b6af535283029eda211259.sgi
Normal file
BIN
Tests/images/crash-b82e64d4f3f76d7465b6af535283029eda211259.sgi
Normal file
Binary file not shown.
BIN
Tests/images/crash-c1b2595b8b0b92cc5f38b6635e98e3a119ade807.sgi
Normal file
BIN
Tests/images/crash-c1b2595b8b0b92cc5f38b6635e98e3a119ade807.sgi
Normal file
Binary file not shown.
BIN
Tests/images/crash-db8bfa78b19721225425530c5946217720d7df4e.sgi
Normal file
BIN
Tests/images/crash-db8bfa78b19721225425530c5946217720d7df4e.sgi
Normal file
Binary file not shown.
|
@ -11,6 +11,13 @@ from PIL import Image
|
||||||
"Tests/images/sgi_crash.bin",
|
"Tests/images/sgi_crash.bin",
|
||||||
"Tests/images/crash-6b7f2244da6d0ae297ee0754a424213444e92778.sgi",
|
"Tests/images/crash-6b7f2244da6d0ae297ee0754a424213444e92778.sgi",
|
||||||
"Tests/images/ossfuzz-5730089102868480.sgi",
|
"Tests/images/ossfuzz-5730089102868480.sgi",
|
||||||
|
"Tests/images/crash-754d9c7ec485ffb76a90eeaab191ef69a2a3a3cd.sgi",
|
||||||
|
"Tests/images/crash-465703f71a0f0094873a3e0e82c9f798161171b8.sgi",
|
||||||
|
"Tests/images/crash-64834657ee604b8797bf99eac6a194c124a9a8ba.sgi",
|
||||||
|
"Tests/images/crash-abcf1c97b8fe42a6c68f1fb0b978530c98d57ced.sgi",
|
||||||
|
"Tests/images/crash-b82e64d4f3f76d7465b6af535283029eda211259.sgi",
|
||||||
|
"Tests/images/crash-c1b2595b8b0b92cc5f38b6635e98e3a119ade807.sgi",
|
||||||
|
"Tests/images/crash-db8bfa78b19721225425530c5946217720d7df4e.sgi",
|
||||||
],
|
],
|
||||||
)
|
)
|
||||||
def test_crashes(test_file):
|
def test_crashes(test_file):
|
||||||
|
|
|
@ -25,12 +25,58 @@ read4B(UINT32 *dest, UINT8 *buf) {
|
||||||
*dest = (UINT32)((buf[0] << 24) | (buf[1] << 16) | (buf[2] << 8) | buf[3]);
|
*dest = (UINT32)((buf[0] << 24) | (buf[1] << 16) | (buf[2] << 8) | buf[3]);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
SgiRleDecoding is done in a single channel row oriented set of RLE chunks.
|
||||||
|
|
||||||
|
* The file is arranged as
|
||||||
|
- SGI Header
|
||||||
|
- Rle Offset Table
|
||||||
|
- Rle Length Table
|
||||||
|
- Scanline Data
|
||||||
|
|
||||||
|
* Each RLE atom is c->bpc bytes wide (1 or 2)
|
||||||
|
|
||||||
|
* Each RLE Chunk is [specifier atom] [ 1 or n data atoms ]
|
||||||
|
|
||||||
|
* Copy Atoms are a byte with the high bit set, and the low 7 are
|
||||||
|
the number of bytes to copy from the source to the
|
||||||
|
destination. e.g.
|
||||||
|
|
||||||
|
CBBBBBBBB or 0CHLHLHLHLHLHL (B=byte, H/L = Hi low bytes)
|
||||||
|
|
||||||
|
* Run atoms do not have the high bit set, and the low 7 bits are
|
||||||
|
the number of copies of the next atom to copy to the
|
||||||
|
destination. e.g.:
|
||||||
|
|
||||||
|
RB -> BBBBB or RHL -> HLHLHLHLHL
|
||||||
|
|
||||||
|
The upshot of this is, there is no way to determine the required
|
||||||
|
length of the input buffer from reloffset and rlelength without
|
||||||
|
going through the data at that scan line.
|
||||||
|
|
||||||
|
Furthermore, there's no requirement that individual scan lines
|
||||||
|
pointed to from the rleoffset table are in any sort of order or
|
||||||
|
used only once, or even disjoint. There's also no requirement that
|
||||||
|
all of the data in the scan line area of the image file be used
|
||||||
|
|
||||||
|
*/
|
||||||
static int
|
static int
|
||||||
expandrow(UINT8 *dest, UINT8 *src, int n, int z, int xsize) {
|
expandrow(UINT8 *dest, UINT8 *src, int n, int z, int xsize, UINT8 *end_of_buffer) {
|
||||||
|
/*
|
||||||
|
* n here is the number of rlechunks
|
||||||
|
* z is the number of channels, for calculating the interleave
|
||||||
|
* offset to go to RGBA style pixels
|
||||||
|
* xsize is the row width
|
||||||
|
* end_of_buffer is the address of the end of the input buffer
|
||||||
|
*/
|
||||||
|
|
||||||
UINT8 pixel, count;
|
UINT8 pixel, count;
|
||||||
int x = 0;
|
int x = 0;
|
||||||
|
|
||||||
for (; n > 0; n--) {
|
for (; n > 0; n--) {
|
||||||
|
if (src > end_of_buffer) {
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
pixel = *src++;
|
pixel = *src++;
|
||||||
if (n == 1 && pixel != 0) {
|
if (n == 1 && pixel != 0) {
|
||||||
return n;
|
return n;
|
||||||
|
@ -44,12 +90,18 @@ expandrow(UINT8 *dest, UINT8 *src, int n, int z, int xsize) {
|
||||||
}
|
}
|
||||||
x += count;
|
x += count;
|
||||||
if (pixel & RLE_COPY_FLAG) {
|
if (pixel & RLE_COPY_FLAG) {
|
||||||
|
if (src + count > end_of_buffer) {
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
while (count--) {
|
while (count--) {
|
||||||
*dest = *src++;
|
*dest = *src++;
|
||||||
dest += z;
|
dest += z;
|
||||||
}
|
}
|
||||||
|
|
||||||
} else {
|
} else {
|
||||||
|
if (src > end_of_buffer) {
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
pixel = *src++;
|
pixel = *src++;
|
||||||
while (count--) {
|
while (count--) {
|
||||||
*dest = pixel;
|
*dest = pixel;
|
||||||
|
@ -61,12 +113,14 @@ expandrow(UINT8 *dest, UINT8 *src, int n, int z, int xsize) {
|
||||||
}
|
}
|
||||||
|
|
||||||
static int
|
static int
|
||||||
expandrow2(UINT8 *dest, const UINT8 *src, int n, int z, int xsize) {
|
expandrow2(UINT8 *dest, const UINT8 *src, int n, int z, int xsize, UINT8 *end_of_buffer) {
|
||||||
UINT8 pixel, count;
|
UINT8 pixel, count;
|
||||||
|
|
||||||
int x = 0;
|
int x = 0;
|
||||||
|
|
||||||
for (; n > 0; n--) {
|
for (; n > 0; n--) {
|
||||||
|
if (src + 1 > end_of_buffer) {
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
pixel = src[1];
|
pixel = src[1];
|
||||||
src += 2;
|
src += 2;
|
||||||
if (n == 1 && pixel != 0) {
|
if (n == 1 && pixel != 0) {
|
||||||
|
@ -81,12 +135,18 @@ expandrow2(UINT8 *dest, const UINT8 *src, int n, int z, int xsize) {
|
||||||
}
|
}
|
||||||
x += count;
|
x += count;
|
||||||
if (pixel & RLE_COPY_FLAG) {
|
if (pixel & RLE_COPY_FLAG) {
|
||||||
|
if (src + 2 * count > end_of_buffer) {
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
while (count--) {
|
while (count--) {
|
||||||
memcpy(dest, src, 2);
|
memcpy(dest, src, 2);
|
||||||
src += 2;
|
src += 2;
|
||||||
dest += z * 2;
|
dest += z * 2;
|
||||||
}
|
}
|
||||||
} else {
|
} else {
|
||||||
|
if (src + 2 > end_of_buffer) {
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
while (count--) {
|
while (count--) {
|
||||||
memcpy(dest, src, 2);
|
memcpy(dest, src, 2);
|
||||||
dest += z * 2;
|
dest += z * 2;
|
||||||
|
@ -132,7 +192,11 @@ ImagingSgiRleDecode(Imaging im, ImagingCodecState state, UINT8 *buf, Py_ssize_t
|
||||||
return -1;
|
return -1;
|
||||||
}
|
}
|
||||||
_imaging_seek_pyFd(state->fd, SGI_HEADER_SIZE, SEEK_SET);
|
_imaging_seek_pyFd(state->fd, SGI_HEADER_SIZE, SEEK_SET);
|
||||||
_imaging_read_pyFd(state->fd, (char *)ptr, c->bufsize);
|
if (_imaging_read_pyFd(state->fd, (char *)ptr, c->bufsize) != c->bufsize) {
|
||||||
|
state->errcode = IMAGING_CODEC_UNKNOWN;
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
/* decoder initialization */
|
/* decoder initialization */
|
||||||
state->count = 0;
|
state->count = 0;
|
||||||
|
@ -166,20 +230,20 @@ ImagingSgiRleDecode(Imaging im, ImagingCodecState state, UINT8 *buf, Py_ssize_t
|
||||||
read4B(&c->lengthtab[c->tabindex], &ptr[c->bufindex]);
|
read4B(&c->lengthtab[c->tabindex], &ptr[c->bufindex]);
|
||||||
}
|
}
|
||||||
|
|
||||||
state->count += c->tablen * sizeof(UINT32) * 2;
|
|
||||||
|
|
||||||
/* read compressed rows */
|
/* read compressed rows */
|
||||||
for (c->rowno = 0; c->rowno < im->ysize; c->rowno++, state->y += state->ystep) {
|
for (c->rowno = 0; c->rowno < im->ysize; c->rowno++, state->y += state->ystep) {
|
||||||
for (c->channo = 0; c->channo < im->bands; c->channo++) {
|
for (c->channo = 0; c->channo < im->bands; c->channo++) {
|
||||||
c->rleoffset = c->starttab[c->rowno + c->channo * im->ysize];
|
c->rleoffset = c->starttab[c->rowno + c->channo * im->ysize];
|
||||||
c->rlelength = c->lengthtab[c->rowno + c->channo * im->ysize];
|
c->rlelength = c->lengthtab[c->rowno + c->channo * im->ysize];
|
||||||
c->rleoffset -= SGI_HEADER_SIZE;
|
|
||||||
|
|
||||||
if (c->rleoffset + c->rlelength > c->bufsize) {
|
// Check for underflow of rleoffset-SGI_HEADER_SIZE
|
||||||
|
if (c->rleoffset < SGI_HEADER_SIZE) {
|
||||||
state->errcode = IMAGING_CODEC_OVERRUN;
|
state->errcode = IMAGING_CODEC_OVERRUN;
|
||||||
goto sgi_finish_decode;
|
goto sgi_finish_decode;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
c->rleoffset -= SGI_HEADER_SIZE;
|
||||||
|
|
||||||
/* row decompression */
|
/* row decompression */
|
||||||
if (c->bpc == 1) {
|
if (c->bpc == 1) {
|
||||||
status = expandrow(
|
status = expandrow(
|
||||||
|
@ -187,14 +251,16 @@ ImagingSgiRleDecode(Imaging im, ImagingCodecState state, UINT8 *buf, Py_ssize_t
|
||||||
&ptr[c->rleoffset],
|
&ptr[c->rleoffset],
|
||||||
c->rlelength,
|
c->rlelength,
|
||||||
im->bands,
|
im->bands,
|
||||||
im->xsize);
|
im->xsize,
|
||||||
|
&ptr[c->bufsize-1]);
|
||||||
} else {
|
} else {
|
||||||
status = expandrow2(
|
status = expandrow2(
|
||||||
&state->buffer[c->channo * 2],
|
&state->buffer[c->channo * 2],
|
||||||
&ptr[c->rleoffset],
|
&ptr[c->rleoffset],
|
||||||
c->rlelength,
|
c->rlelength,
|
||||||
im->bands,
|
im->bands,
|
||||||
im->xsize);
|
im->xsize,
|
||||||
|
&ptr[c->bufsize-1]);
|
||||||
}
|
}
|
||||||
if (status == -1) {
|
if (status == -1) {
|
||||||
state->errcode = IMAGING_CODEC_OVERRUN;
|
state->errcode = IMAGING_CODEC_OVERRUN;
|
||||||
|
@ -203,15 +269,12 @@ ImagingSgiRleDecode(Imaging im, ImagingCodecState state, UINT8 *buf, Py_ssize_t
|
||||||
goto sgi_finish_decode;
|
goto sgi_finish_decode;
|
||||||
}
|
}
|
||||||
|
|
||||||
state->count += c->rlelength;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/* store decompressed data in image */
|
/* store decompressed data in image */
|
||||||
state->shuffle((UINT8 *)im->image[state->y], state->buffer, im->xsize);
|
state->shuffle((UINT8 *)im->image[state->y], state->buffer, im->xsize);
|
||||||
}
|
}
|
||||||
|
|
||||||
c->bufsize++;
|
|
||||||
|
|
||||||
sgi_finish_decode:;
|
sgi_finish_decode:;
|
||||||
|
|
||||||
free(c->starttab);
|
free(c->starttab);
|
||||||
|
@ -221,5 +284,5 @@ sgi_finish_decode:;
|
||||||
state->errcode = err;
|
state->errcode = err;
|
||||||
return -1;
|
return -1;
|
||||||
}
|
}
|
||||||
return state->count - c->bufsize;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue
Block a user