Various security fixes #15
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Added checks to ensure buffer reads do not exceed the allocated size.
- Verified minimum and maximum box sizes to prevent invalid data handling.
- Ensured presence of 'ftyp' and 'meta' headers before parsing.
- Improved error handling to prevent heap overflow.
- Added checks to ensure `ftyp_box_length` is within a valid range and does not cause integer overflow.
- Implemented a check to prevent `ftyp_box_length` from exceeding the maximum allowable size before adding any constants.
- Ensured that `ftyp_box_length + 12` does not exceed the file length, preventing potential buffer overflow or memory access errors.
- Added checks to ensure that the buffer size is sufficient before accessing data, preventing potential heap read overflows.
- Ensured that at least 24 bytes are available before accessing IHDR chunk information.
- Validated buffer size to be at least 40 bytes when handling the CgBI chunk followed by IHDR.
- These changes prevent accessing out-of-bounds memory, ensuring safe parsing of PNG files.
- Added checks to ensure that resolution strings contain only numeric characters before calling `std::stol`.
- Implemented `is_numeric` function to validate that resolution parts are numeric.
- Added `try-catch` block around `std::stol` to handle potential exceptions due to invalid input.
- Ensured that parsed resolution values are positive integers, preventing invalid dimensions.
- Improved boundary checks when extracting resolution strings from the header to avoid out-of-bounds errors.
These changes prevent heap read overflows and handle cases where resolution values contain illegal characters, ensuring safe and accurate parsing of HDR image files.
- Added a check using find before accessing size_map to ensure the key exists, preventing std::out_of_range exceptions.
- Updated logic to handle cases where the ICNS type is not found in size_map by returning false.
- Ensured that max_size and entry_sizes are only updated with valid data from size_map.
- These changes prevent potential crashes due to accessing non-existent keys in the size map and improve the robustness of the ICNS file parsing.
- Added check and adjustment to `size` to ensure `offset + size` does not exceed `length_`, preventing out-of-bounds access.
- Retained the assertion `assert(offset + size <= length_)` as a final check for data integrity.
- Ensured that the buffer reading operations respect the boundaries of the available data, avoiding potential crashes or data corruption.
- These changes address the assertion failure and improve the robustness of the `read_buffer` function.
- Added checks to ensure that the `offset` and `size` do not exceed the file length before reading data, preventing out-of-bounds access.
- Verified that the buffer size is sufficient before processing TIFF directory entries.
- Implemented additional checks to handle cases where the `offset` might lead to out-of-bounds reads, especially during the iteration through TIFF tags.
- These changes improve the stability and security of the TIFF parsing function by preventing potential crashes and data corruption due to incorrect offsets.
|
Thanks @chan233. |
Of course, if I find any bugs, I'll continue to submit PR. |
- Added checks to ensure `offset + 8` does not exceed the end of the buffer before reading `box_size`.
- Ensured that `offset + box_size` does not go beyond the buffer's end to prevent buffer overflows.
- These changes prevent reading outside the allocated memory, which could lead to security vulnerabilities.
|
Fixed. |
|
new_crashs.tar.gz |
|
@chan233 I've tried all the 25 crash samples, but I didn't repro it. Did you checkout this pr and rebuild imageinfo_cli? |
|
@xiaozhuai |
|
@xiaozhuai |
|
@chan233 Very odd, I can't repro it. |
|
@xiaozhuai |
Ok, thanks for the contribution. I will merge this pr soon. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.