python-pillow/Pillow
1
1
Fork 0
mirror of https://github.com/python-pillow/Pillow.git synced 2024-12-25 17:36:18 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #5175 from radarhere/tiff

Browse Source 
Fix TIFF OOB Write error
This commit is contained in:
Andrew Murray 2021-01-02 21:13:28 +11:00 committed by GitHub
commit c8dd1c8422
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 210 additions and 175 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
Tests/images/crash-2020-10-test.tif Normal file
View File

Binary file not shown.

7
Tests/test_tiff_crashes.py
View File

@ -19,7 +19,12 @@ from .helper import on_ci
@pytest.mark.parametrize(
"test_file", ["Tests/images/crash_1.tif", "Tests/images/crash_2.tif"]
"test_file",
[
"Tests/images/crash_1.tif",
"Tests/images/crash_2.tif",
"Tests/images/crash-2020-10-test.tif",
],
)
@pytest.mark.filterwarnings("ignore:Possibly corrupt EXIF data")
@pytest.mark.filterwarnings("ignore:Metadata warning")

378
src/libImaging/TiffDecode.c
View File

@ -181,111 +181,171 @@ int ImagingLibTiffInit(ImagingCodecState state, int fp, uint32 offset) {
}
int ReadTile(TIFF* tiff, UINT32 col, UINT32 row, UINT32* buffer) {
uint16 photometric = 0;
TIFFGetField(tiff, TIFFTAG_PHOTOMETRIC, &photometric);
int _decodeStripYCbCr(Imaging im, ImagingCodecState state, TIFF *tiff) {
// To avoid dealing with YCbCr subsampling, let libtiff handle it
if (photometric == PHOTOMETRIC_YCBCR) {
UINT32 tile_width, tile_height, swap_line_size, i_row;
UINT32* swap_line;
// Use a TIFFRGBAImage wrapping the tiff image, and let libtiff handle
// all of the conversion. Metadata read from the TIFFRGBAImage could
// be different from the metadata that the base tiff returns.
TIFFGetField(tiff, TIFFTAG_TILEWIDTH, &tile_width);
TIFFGetField(tiff, TIFFTAG_TILELENGTH, &tile_height);
INT32 strip_row;
UINT8 *new_data;
UINT32 rows_per_strip, row_byte_size, rows_to_read;
int ret;
TIFFRGBAImage img;
char emsg[1024] = "";
swap_line_size = tile_width * sizeof(UINT32);
if (tile_width != swap_line_size / sizeof(UINT32)) {
return -1;
}
/* Read the tile into an RGBA array */
if (!TIFFReadRGBATile(tiff, col, row, buffer)) {
return -1;
}
swap_line = (UINT32*)malloc(swap_line_size);
if (swap_line == NULL) {
return -1;
}
/*
* For some reason the TIFFReadRGBATile() function chooses the
* lower left corner as the origin. Vertically mirror scanlines.
*/
for(i_row = 0; i_row < tile_height / 2; i_row++) {
UINT32 *top_line, *bottom_line;
top_line = buffer + tile_width * i_row;
bottom_line = buffer + tile_width * (tile_height - i_row - 1);
memcpy(swap_line, top_line, 4*tile_width);
memcpy(top_line, bottom_line, 4*tile_width);
memcpy(bottom_line, swap_line, 4*tile_width);
}
free(swap_line);
return 0;
ret = TIFFGetFieldDefaulted(tiff, TIFFTAG_ROWSPERSTRIP, &rows_per_strip);
if (ret != 1) {
rows_per_strip = state->ysize;
}
TRACE(("RowsPerStrip: %u \n", rows_per_strip));
if (TIFFReadTile(tiff, (tdata_t)buffer, col, row, 0, 0) == -1) {
TRACE(("Decode Error, Tile at %dx%d\n", col, row));
if (!(TIFFRGBAImageOK(tiff, emsg) && TIFFRGBAImageBegin(&img, tiff, 0, emsg))) {
TRACE(("Decode error, msg: %s", emsg));
state->errcode = IMAGING_CODEC_BROKEN;
// nothing to clean up, just return
return -1;
}
TRACE(("Successfully read tile at %dx%d; \n\n", col, row));
img.req_orientation = ORIENTATION_TOPLEFT;
img.col_offset = 0;
if (state->xsize != img.width || state->ysize != img.height) {
TRACE(("Inconsistent Image Error: %d =? %d, %d =? %d",
state->xsize, img.width, state->ysize, img.height));
state->errcode = IMAGING_CODEC_BROKEN;
goto decodeycbcr_err;
}
/* overflow check for row byte size */
if (INT_MAX / 4 < img.width) {
state->errcode = IMAGING_CODEC_MEMORY;
goto decodeycbcr_err;
}
// TiffRGBAImages are 32bits/pixel.
row_byte_size = img.width * 4;
/* overflow check for realloc */
if (INT_MAX / row_byte_size < rows_per_strip) {
state->errcode = IMAGING_CODEC_MEMORY;
goto decodeycbcr_err;
}
state->bytes = rows_per_strip * row_byte_size;
TRACE(("StripSize: %d \n", state->bytes));
/* realloc to fit whole strip */
/* malloc check above */
new_data = realloc (state->buffer, state->bytes);
if (!new_data) {
state->errcode = IMAGING_CODEC_MEMORY;
goto decodeycbcr_err;
}
state->buffer = new_data;
for (; state->y < state->ysize; state->y += rows_per_strip) {
img.row_offset = state->y;
rows_to_read = min(rows_per_strip, img.height - state->y);
if (TIFFRGBAImageGet(&img, (UINT32 *)state->buffer, img.width, rows_to_read) == -1) {
TRACE(("Decode Error, y: %d\n", state->y ));
state->errcode = IMAGING_CODEC_BROKEN;
goto decodeycbcr_err;
}
TRACE(("Decoded strip for row %d \n", state->y));
// iterate over each row in the strip and stuff data into image
for (strip_row = 0; strip_row < min((INT32) rows_per_strip, state->ysize - state->y); strip_row++) {
TRACE(("Writing data into line %d ; \n", state->y + strip_row));
// UINT8 * bbb = state->buffer + strip_row * (state->bytes / rows_per_strip);
// TRACE(("chars: %x %x %x %x\n", ((UINT8 *)bbb)[0], ((UINT8 *)bbb)[1], ((UINT8 *)bbb)[2], ((UINT8 *)bbb)[3]));
state->shuffle((UINT8*) im->image[state->y + state->yoff + strip_row] +
state->xoff * im->pixelsize,
state->buffer + strip_row * row_byte_size,
state->xsize);
}
}
decodeycbcr_err:
TIFFRGBAImageEnd(&img);
if (state->errcode != 0) {
return -1;
}
return 0;
}
int ReadStrip(TIFF* tiff, UINT32 row, UINT32* buffer) {
uint16 photometric = 0; // init to not PHOTOMETRIC_YCBCR
TIFFGetField(tiff, TIFFTAG_PHOTOMETRIC, &photometric);
int _decodeStrip(Imaging im, ImagingCodecState state, TIFF *tiff) {
INT32 strip_row;
UINT8 *new_data;
UINT32 rows_per_strip, row_byte_size;
int ret;
// To avoid dealing with YCbCr subsampling, let libtiff handle it
if (photometric == PHOTOMETRIC_YCBCR) {
TIFFRGBAImage img;
char emsg[1024] = "";
UINT32 rows_per_strip, rows_to_read;
int ok;
TIFFGetFieldDefaulted(tiff, TIFFTAG_ROWSPERSTRIP, &rows_per_strip);
if ((row % rows_per_strip) != 0) {
TRACE(("Row passed to ReadStrip() must be first in a strip."));
return -1;
}
if (TIFFRGBAImageOK(tiff, emsg) && TIFFRGBAImageBegin(&img, tiff, 0, emsg)) {
TRACE(("Initialized RGBAImage\n"));
img.req_orientation = ORIENTATION_TOPLEFT;
img.row_offset = row;
img.col_offset = 0;
rows_to_read = min(rows_per_strip, img.height - row);
TRACE(("rows to read: %d\n", rows_to_read));
ok = TIFFRGBAImageGet(&img, buffer, img.width, rows_to_read);
TIFFRGBAImageEnd(&img);
} else {
ok = 0;
}
if (ok == 0) {
TRACE(("Decode Error, row %d; msg: %s\n", row, emsg));
return -1;
}
return 0;
ret = TIFFGetField(tiff, TIFFTAG_ROWSPERSTRIP, &rows_per_strip);
if (ret != 1) {
rows_per_strip = state->ysize;
}
TRACE(("RowsPerStrip: %u \n", rows_per_strip));
if (TIFFReadEncodedStrip(tiff, TIFFComputeStrip(tiff, row, 0), (tdata_t)buffer, -1) == -1) {
TRACE(("Decode Error, strip %d\n", TIFFComputeStrip(tiff, row, 0)));
// We could use TIFFStripSize, but for YCbCr data it returns subsampled data size
row_byte_size = (state->xsize * state->bits + 7) / 8;
/* overflow check for realloc */
if (INT_MAX / row_byte_size < rows_per_strip) {
state->errcode = IMAGING_CODEC_MEMORY;
return -1;
}
state->bytes = rows_per_strip * row_byte_size;
TRACE(("StripSize: %d \n", state->bytes));
if (TIFFStripSize(tiff) > state->bytes) {
// If the strip size as expected by LibTiff isn't what we're expecting, abort.
// man: TIFFStripSize returns the equivalent size for a strip of data as it would be returned in a
// call to TIFFReadEncodedStrip ...
state->errcode = IMAGING_CODEC_MEMORY;
return -1;
}
/* realloc to fit whole strip */
/* malloc check above */
new_data = realloc (state->buffer, state->bytes);
if (!new_data) {
state->errcode = IMAGING_CODEC_MEMORY;
return -1;
}
state->buffer = new_data;
for (; state->y < state->ysize; state->y += rows_per_strip) {
if (TIFFReadEncodedStrip(tiff, TIFFComputeStrip(tiff, state->y, 0), (tdata_t)state->buffer, -1) == -1) {
TRACE(("Decode Error, strip %d\n", TIFFComputeStrip(tiff, state->y, 0)));
state->errcode = IMAGING_CODEC_BROKEN;
return -1;
}
TRACE(("Decoded strip for row %d \n", state->y));
// iterate over each row in the strip and stuff data into image
for (strip_row = 0; strip_row < min((INT32) rows_per_strip, state->ysize - state->y); strip_row++) {
TRACE(("Writing data into line %d ; \n", state->y + strip_row));
// UINT8 * bbb = state->buffer + strip_row * (state->bytes / rows_per_strip);
// TRACE(("chars: %x %x %x %x\n", ((UINT8 *)bbb)[0], ((UINT8 *)bbb)[1], ((UINT8 *)bbb)[2], ((UINT8 *)bbb)[3]));
state->shuffle((UINT8*) im->image[state->y + state->yoff + strip_row] +
state->xoff * im->pixelsize,
state->buffer + strip_row * row_byte_size,
state->xsize);
}
}
return 0;
}
@ -294,6 +354,8 @@ int ImagingLibTiffDecode(Imaging im, ImagingCodecState state, UINT8* buffer, Py_
char *filename = "tempfile.tif";
char *mode = "r";
TIFF *tiff;
uint16 photometric = 0; // init to not PHOTOMETRIC_YCBCR
int isYCbCr = 0;
/* buffer is the encoded file, bytes is the length of the encoded file */
/* it all ends up in state->buffer, which is a uint8* from Imaging.h */
@ -350,13 +412,17 @@ int ImagingLibTiffDecode(Imaging im, ImagingCodecState state, UINT8* buffer, Py_
rv = TIFFSetSubDirectory(tiff, ifdoffset);
if (!rv){
TRACE(("error in TIFFSetSubDirectory"));
return -1;
goto decode_err;
}
}
TIFFGetField(tiff, TIFFTAG_PHOTOMETRIC, &photometric);
isYCbCr = photometric == PHOTOMETRIC_YCBCR;
if (TIFFIsTiled(tiff)) {
INT32 x, y, tile_y;
UINT32 tile_width, tile_length, current_tile_width, row_byte_size;
UINT32 tile_width, tile_length, current_tile_length, current_line, current_tile_width, row_byte_size;
UINT8 *new_data;
TIFFGetField(tiff, TIFFTAG_TILEWIDTH, &tile_width);
@ -365,18 +431,26 @@ int ImagingLibTiffDecode(Imaging im, ImagingCodecState state, UINT8* buffer, Py_
/* overflow check for row_byte_size calculation */
if ((UINT32) INT_MAX / state->bits < tile_width) {
state->errcode = IMAGING_CODEC_MEMORY;
TIFFClose(tiff);
return -1;
goto decode_err;
}
// We could use TIFFTileSize, but for YCbCr data it returns subsampled data size
row_byte_size = (tile_width * state->bits + 7) / 8;
if (isYCbCr) {
row_byte_size = tile_width * 4;
/* sanity check, we use this value in shuffle below */
if (im->pixelsize != 4) {
state->errcode = IMAGING_CODEC_BROKEN;
goto decode_err;
}
} else {
// We could use TIFFTileSize, but for YCbCr data it returns subsampled data size
row_byte_size = (tile_width * state->bits + 7) / 8;
}
/* overflow check for realloc */
if (INT_MAX / row_byte_size < tile_length) {
state->errcode = IMAGING_CODEC_MEMORY;
TIFFClose(tiff);
return -1;
goto decode_err;
}
state->bytes = row_byte_size * tile_length;
@ -384,8 +458,7 @@ int ImagingLibTiffDecode(Imaging im, ImagingCodecState state, UINT8* buffer, Py_
if (TIFFTileSize(tiff) > state->bytes) {
// If the strip size as expected by LibTiff isn't what we're expecting, abort.
state->errcode = IMAGING_CODEC_MEMORY;
TIFFClose(tiff);
return -1;
goto decode_err;
}
/* realloc to fit whole tile */
@ -393,8 +466,7 @@ int ImagingLibTiffDecode(Imaging im, ImagingCodecState state, UINT8* buffer, Py_
new_data = realloc (state->buffer, state->bytes);
if (!new_data) {
state->errcode = IMAGING_CODEC_MEMORY;
TIFFClose(tiff);
return -1;
goto decode_err;
}
state->buffer = new_data;
@ -403,103 +475,61 @@ int ImagingLibTiffDecode(Imaging im, ImagingCodecState state, UINT8* buffer, Py_
for (y = state->yoff; y < state->ysize; y += tile_length) {
for (x = state->xoff; x < state->xsize; x += tile_width) {
if (ReadTile(tiff, x, y, (UINT32*) state->buffer) == -1) {
TRACE(("Decode Error, Tile at %dx%d\n", x, y));
state->errcode = IMAGING_CODEC_BROKEN;
TIFFClose(tiff);
return -1;
if (isYCbCr) {
/* To avoid dealing with YCbCr subsampling, let libtiff handle it */
if (!TIFFReadRGBATile(tiff, x, y, (UINT32 *)state->buffer)) {
TRACE(("Decode Error, Tile at %dx%d\n", x, y));
state->errcode = IMAGING_CODEC_BROKEN;
goto decode_err;
}
} else {
if (TIFFReadTile(tiff, (tdata_t)state->buffer, x, y, 0, 0) == -1) {
TRACE(("Decode Error, Tile at %dx%d\n", x, y));
state->errcode = IMAGING_CODEC_BROKEN;
goto decode_err;
}
}
TRACE(("Read tile at %dx%d; \n\n", x, y));
current_tile_width = min((INT32) tile_width, state->xsize - x);
current_tile_length = min((INT32) tile_length, state->ysize - y);
// iterate over each line in the tile and stuff data into image
for (tile_y = 0; tile_y < min((INT32) tile_length, state->ysize - y); tile_y++) {
for (tile_y = 0; tile_y < current_tile_length; tile_y++) {
TRACE(("Writing tile data at %dx%d using tile_width: %d; \n", tile_y + y, x, current_tile_width));
// UINT8 * bbb = state->buffer + tile_y * row_byte_size;
// TRACE(("chars: %x%x%x%x\n", ((UINT8 *)bbb)[0], ((UINT8 *)bbb)[1], ((UINT8 *)bbb)[2], ((UINT8 *)bbb)[3]));
/*
* For some reason the TIFFReadRGBATile() function
* chooses the lower left corner as the origin.
* Vertically mirror by shuffling the scanlines
* backwards
*/
if (isYCbCr) {
current_line = tile_length - tile_y - 1;
} else {
current_line = tile_y;
}
state->shuffle((UINT8*) im->image[tile_y + y] + x * im->pixelsize,
state->buffer + tile_y * row_byte_size,
state->buffer + current_line * row_byte_size,
current_tile_width
);
}
}
}
} else {
INT32 strip_row;
UINT8 *new_data;
UINT32 rows_per_strip, row_byte_size;
int ret;
ret = TIFFGetField(tiff, TIFFTAG_ROWSPERSTRIP, &rows_per_strip);
if (ret != 1) {
rows_per_strip = state->ysize;
if (!isYCbCr) {
_decodeStrip(im, state, tiff);
}
TRACE(("RowsPerStrip: %u \n", rows_per_strip));
// We could use TIFFStripSize, but for YCbCr data it returns subsampled data size
row_byte_size = (state->xsize * state->bits + 7) / 8;
/* overflow check for realloc */
if (INT_MAX / row_byte_size < rows_per_strip) {
state->errcode = IMAGING_CODEC_MEMORY;
TIFFClose(tiff);
return -1;
}
state->bytes = rows_per_strip * row_byte_size;
TRACE(("StripSize: %d \n", state->bytes));
if (TIFFStripSize(tiff) > state->bytes) {
// If the strip size as expected by LibTiff isn't what we're expecting, abort.
// man: TIFFStripSize returns the equivalent size for a strip of data as it would be returned in a
// call to TIFFReadEncodedStrip ...
state->errcode = IMAGING_CODEC_MEMORY;
TIFFClose(tiff);
return -1;
}
/* realloc to fit whole strip */
/* malloc check above */
new_data = realloc (state->buffer, state->bytes);
if (!new_data) {
state->errcode = IMAGING_CODEC_MEMORY;
TIFFClose(tiff);
return -1;
}
state->buffer = new_data;
for (; state->y < state->ysize; state->y += rows_per_strip) {
if (ReadStrip(tiff, state->y, (UINT32 *)state->buffer) == -1) {
TRACE(("Decode Error, strip %d\n", TIFFComputeStrip(tiff, state->y, 0)));
state->errcode = IMAGING_CODEC_BROKEN;
TIFFClose(tiff);
return -1;
}
TRACE(("Decoded strip for row %d \n", state->y));
// iterate over each row in the strip and stuff data into image
for (strip_row = 0; strip_row < min((INT32) rows_per_strip, state->ysize - state->y); strip_row++) {
TRACE(("Writing data into line %d ; \n", state->y + strip_row));
// UINT8 * bbb = state->buffer + strip_row * (state->bytes / rows_per_strip);
// TRACE(("chars: %x %x %x %x\n", ((UINT8 *)bbb)[0], ((UINT8 *)bbb)[1], ((UINT8 *)bbb)[2], ((UINT8 *)bbb)[3]));
state->shuffle((UINT8*) im->image[state->y + state->yoff + strip_row] +
state->xoff * im->pixelsize,
state->buffer + strip_row * row_byte_size,
state->xsize);
}
else {
_decodeStripYCbCr(im, state, tiff);
}
}
decode_err:
TIFFClose(tiff);
TRACE(("Done Decoding, Returning \n"));
// Returning -1 here to force ImageFile.load to break, rather than