ryan/mozjpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix int overflow when decompr. corrupt prog. JPEG

Browse Source 
No discernible performance regression

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9447
Credit to OSS Fuzz
Closes #259
This commit is contained in:
Even Rouault
2018-07-20 18:04:15 +02:00
committed by DRC
parent 9c78a04df4
commit 9ab569e616
2 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
ChangeLog.md
View File

@@ -52,6 +52,12 @@ a specially-crafted malformed color-index (8-bit-per-sample) BMP file in which
some of the samples (color indices) exceeded the bounds of the BMP file's color some of the samples (color indices) exceeded the bounds of the BMP file's color
table. table.
9. Fixed a signed integer overflow in the progressive Huffman decoder, detected
by the Clang and GCC undefined behavior sanitizers, that could be triggered by
attempting to decompress a specially-crafted malformed JPEG image. This issue
did not pose a security threat, but removing the warning made it easier to
detect actual security issues, should they arise in the future.
1.5.90 (2.0 beta1) 1.5.90 (2.0 beta1)
================== ==================

5
jdphuff.c
View File

@@ -21,6 +21,7 @@
#include "jinclude.h" #include "jinclude.h"
#include "jpeglib.h" #include "jpeglib.h"
#include "jdhuff.h" /* Declarations shared with jdhuff.c */ #include "jdhuff.h" /* Declarations shared with jdhuff.c */
#include <limits.h>
#ifdef D_PROGRESSIVE_SUPPORTED #ifdef D_PROGRESSIVE_SUPPORTED
@@ -340,6 +341,10 @@ decode_mcu_DC_first(j_decompress_ptr cinfo, JBLOCKROW *MCU_data)
} }
/* Convert DC difference to actual value, update last_dc_val */ /* Convert DC difference to actual value, update last_dc_val */
if ((state.last_dc_val[ci] >= 0 &&
s > INT_MAX - state.last_dc_val[ci]) ||
(state.last_dc_val[ci] < 0 && s < INT_MIN - state.last_dc_val[ci]))
ERREXIT(cinfo, JERR_BAD_DCT_COEF);
s += state.last_dc_val[ci]; s += state.last_dc_val[ci];
state.last_dc_val[ci] = s; state.last_dc_val[ci] = s;
/* Scale and output the coefficient (assumes jpeg_natural_order[0]=0) */ /* Scale and output the coefficient (assumes jpeg_natural_order[0]=0) */