ryan/mozjpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tjLoadImage(): Fix int overflow/segfault w/big BMP

Browse Source 
Fixes #304
This commit is contained in:
DRC
2019-01-01 18:57:36 -06:00
parent 23e8e0ff83
commit 3d9c64e9f8
2 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
ChangeLog.md
View File

@@ -10,6 +10,10 @@ executables for macOS and iOS. This caused a fatal error of the form
unless `DYLD_LIBRARY_PATH` was explicitly set to the location of the unless `DYLD_LIBRARY_PATH` was explicitly set to the location of the
libjpeg-turbo shared libraries. libjpeg-turbo shared libraries.
2. Fixed an integer overflow and subsequent segfault (CVE-2018-20330) that
occurred when attempting to load a BMP file with more than 1 billion pixels
using the `tjLoadImage()` function.
2.0.1 2.0.1
===== =====

9
turbojpeg.c
View File

@@ -1,5 +1,5 @@
/* /*
* Copyright (C)2009-2018 D. R. Commander. All Rights Reserved. * Copyright (C)2009-2019 D. R. Commander. All Rights Reserved.
* *
* Redistribution and use in source and binary forms, with or without * Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met: * modification, are permitted provided that the following conditions are met:
@@ -1960,7 +1960,8 @@ DLLEXPORT unsigned char *tjLoadImage(const char *filename, int *width,
int align, int *height, int *pixelFormat, int align, int *height, int *pixelFormat,
int flags) int flags)
{ {
int retval = 0, tempc, pitch; int retval = 0, tempc;
size_t pitch;
tjhandle handle = NULL; tjhandle handle = NULL;
tjinstance *this; tjinstance *this;
j_compress_ptr cinfo = NULL; j_compress_ptr cinfo = NULL;
@@ -2013,7 +2014,9 @@ DLLEXPORT unsigned char *tjLoadImage(const char *filename, int *width,
*pixelFormat = cs2pf[cinfo->in_color_space]; *pixelFormat = cs2pf[cinfo->in_color_space];
pitch = PAD((*width) * tjPixelSize[*pixelFormat], align); pitch = PAD((*width) * tjPixelSize[*pixelFormat], align);
if ((dstBuf = (unsigned char *)malloc(pitch * (*height))) == NULL) if ((unsigned long long)pitch * (unsigned long long)(*height) >
(unsigned long long)((size_t)-1) ||
(dstBuf = (unsigned char *)malloc(pitch * (*height))) == NULL)
_throwg("tjLoadImage(): Memory allocation failure"); _throwg("tjLoadImage(): Memory allocation failure");
if (setjmp(this->jerr.setjmp_buffer)) { if (setjmp(this->jerr.setjmp_buffer)) {