python-pillow/Pillow
1
1
Fork 0
mirror of https://github.com/python-pillow/Pillow.git synced 2025-01-29 02:34:10 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fix OOB Advance Values

Browse Source
This commit is contained in:
Eric Soroos 2020-03-05 09:51:32 +00:00 committed by Hugo
parent c88b0204d7
commit c5edc361fd
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/libImaging/FliDecode.c
View File

@ -83,7 +83,7 @@ ImagingFliDecode(Imaging im, ImagingCodecState state, UINT8* buf, Py_ssize_t byt
break; /* ignored; handled by Python code */ break; /* ignored; handled by Python code */
case 7: case 7:
/* FLI SS2 chunk (word delta) */ /* FLI SS2 chunk (word delta) */
/* OOB ok, we've got 10 bytes min on entry */ /* OOB ok, we've got 4 bytes min on entry */
lines = I16(data); data += 2; lines = I16(data); data += 2;
for (l = y = 0; l < lines && y < state->ysize; l++, y++) { for (l = y = 0; l < lines && y < state->ysize; l++, y++) {
UINT8* buf = (UINT8*) im->image[y]; UINT8* buf = (UINT8*) im->image[y];
@ -229,6 +229,10 @@ ImagingFliDecode(Imaging im, ImagingCodecState state, UINT8* buf, Py_ssize_t byt
return -1; return -1;
} }
advance = I32(ptr); advance = I32(ptr);
if (advance < 0 || advance > bytes) {
state->errcode = IMAGING_CODEC_OVERRUN;
return -1;
}
ptr += advance; ptr += advance;
bytes -= advance; bytes -= advance;
} }