Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Validate tileoffset table size #839

Conversation

peterhillman
Copy link
Contributor

Applies similar logic to #824's ScanLine handling to prevent excessive memory allocation when reading truncated Tiled and DeepTiled files.
If the dataWindow and tileDescription indicate there are over a million tiles in level 0 of the file, will scan forward to check the file is at least large enough to contain enough tiles for that level. This prevents small specially crafted OpenEXR files causing large memory allocations in the library.

Addresses https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25648

Signed-off-by: Peter Hillman <peterh@wetafx.co.nz>
Signed-off-by: Peter Hillman <peterh@wetafx.co.nz>
Signed-off-by: Peter Hillman <peterh@wetafx.co.nz>
@kdt3rd
Copy link
Contributor

kdt3rd commented Oct 8, 2020

This looks fine to me

@peterhillman peterhillman merged commit 6ac744d into AcademySoftwareFoundation:master Oct 23, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants