Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix CVE 2023 5841 #1627

Merged
merged 4 commits into from Feb 4, 2024
Merged

Fix CVE 2023 5841 #1627

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
e892a23
enable deep file checks for core
kdt3rd Feb 3, 2024
46d864e
fix possible int overflow
kdt3rd Feb 3, 2024
49a024e
fix validation of deep sample counts
kdt3rd Feb 3, 2024
bd5e7bd
add clarifying comment
kdt3rd Feb 3, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
37 changes: 23 additions & 14 deletions src/lib/OpenEXRCore/decoding.c
View file
Open in desktop
Expand Up @@ -288,6 +288,9 @@ default_decompress_chunk (exr_decode_pipeline_t* decode)
uint64_t sampsize =
(((uint64_t) decode->chunk.width) *
((uint64_t) decode->chunk.height));

if ((decode->decode_flags & EXR_DECODE_SAMPLE_COUNTS_AS_INDIVIDUAL))
sampsize += 1;
sampsize *= sizeof (int32_t);

rv = decompress_data (
Expand Down Expand Up @@ -340,7 +343,7 @@ unpack_sample_table (
exr_result_t rv = EXR_ERR_SUCCESS;
int32_t w = decode->chunk.width;
int32_t h = decode->chunk.height;
int32_t totsamp = 0;
uint64_t totsamp = 0;
int32_t* samptable = decode->sample_count_table;
size_t combSampSize = 0;

Expand All @@ -351,38 +354,44 @@ unpack_sample_table (
{
for (int32_t y = 0; y < h; ++y)
{
int32_t *cursampline = samptable + y * w;
int32_t prevsamp = 0;
for (int32_t x = 0; x < w; ++x)
{
int32_t nsamps =
(int32_t) one_to_native32 ((uint32_t) samptable[y * w + x]);
if (nsamps < 0) return EXR_ERR_INVALID_SAMPLE_DATA;
samptable[y * w + x] = nsamps - prevsamp;
prevsamp = nsamps;
(int32_t) one_to_native32 ((uint32_t) cursampline[x]);
if (nsamps < prevsamp) return EXR_ERR_INVALID_SAMPLE_DATA;

cursampline[x] = nsamps - prevsamp;
prevsamp = nsamps;
}
totsamp += prevsamp;
totsamp += (uint64_t)prevsamp;
meshula marked this conversation as resolved.
Show resolved Hide resolved
}
samptable[w * h] = totsamp;
if (totsamp >= (uint64_t)INT32_MAX)
meshula marked this conversation as resolved.
Show resolved Hide resolved
return EXR_ERR_INVALID_SAMPLE_DATA;
samptable[w * h] = (int32_t)totsamp;
}
else
{
for (int32_t y = 0; y < h; ++y)
{
int32_t *cursampline = samptable + y * w;
int32_t prevsamp = 0;
for (int32_t x = 0; x < w; ++x)
{
int32_t nsamps =
(int32_t) one_to_native32 ((uint32_t) samptable[y * w + x]);
if (nsamps < 0) return EXR_ERR_INVALID_SAMPLE_DATA;
samptable[y * w + x] = nsamps;
prevsamp = nsamps;
(int32_t) one_to_native32 ((uint32_t) cursampline[x]);
meshula marked this conversation as resolved.
Show resolved Hide resolved
if (nsamps < prevsamp) return EXR_ERR_INVALID_SAMPLE_DATA;

cursampline[x] = nsamps;
prevsamp = nsamps;
}
totsamp += prevsamp;

totsamp += (uint64_t)prevsamp;
}
}

if (totsamp < 0 ||
(((uint64_t) totsamp) * combSampSize) > decode->chunk.unpacked_size)
if ((totsamp * combSampSize) > decode->chunk.unpacked_size)
{
rv = pctxt->report_error (
pctxt, EXR_ERR_INVALID_SAMPLE_DATA, "Corrupt sample count table");
Expand Down
9 changes: 6 additions & 3 deletions src/lib/OpenEXRCore/unpack.c
View file
Open in desktop
Expand Up @@ -1196,9 +1196,10 @@ generic_unpack_deep_pointers (exr_decode_pipeline_t* decode)
if (outpix)
{
uint8_t* cdata = outpix;

UNPACK_SAMPLES (samps)
}
srcbuffer += bpc * samps;
srcbuffer += ((size_t) bpc) * ((size_t) samps);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

size_t is a suspicious type (one of those bonkers "haha could be anything" types). ptrdiff_t is probably the right choice here?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah, i just used pre-existing type. size_t is definitely variable, ptrdiff_t would be fine

}
}
sampbuffer += w;
Expand Down Expand Up @@ -1242,12 +1243,14 @@ generic_unpack_deep (exr_decode_pipeline_t* decode)
}
else
prevsamps = sampbuffer[w - 1];

srcbuffer += ((size_t) bpc) * ((size_t) prevsamps);

if (incr_tot) totsamps += (size_t) prevsamps;

continue;
}

cdata += totsamps * ((size_t) ubpc);

for (int x = 0; x < w; ++x)
Expand All @@ -1263,7 +1266,7 @@ generic_unpack_deep (exr_decode_pipeline_t* decode)

UNPACK_SAMPLES (samps)

srcbuffer += bpc * samps;
srcbuffer += ((size_t) bpc) * ((size_t) samps);
if (incr_tot) totsamps += (size_t) samps;
}
}
Expand Down Expand Up @@ -1301,7 +1304,7 @@ internal_exr_match_decode (

if (isdeep)
{
if ((decode->decode_flags & EXR_DECODE_SAMPLE_COUNTS_AS_INDIVIDUAL))
if ((decode->decode_flags & EXR_DECODE_NON_IMAGE_DATA_AS_POINTERS))
return &generic_unpack_deep_pointers;
return &generic_unpack_deep;
}
Expand Down