Skip to content

Commit 2bb97f4

Browse files
committed
gd2: handle corrupt images better (CVE-2016-3074)
Make sure we do some range checking on corrupted chunks. Thanks to Hans Jerry Illikainen <hji@dyntopia.com> for indepth report and reproducer information. Made for easy test case writing :).
1 parent fc14a8c commit 2bb97f4

File tree

5 files changed

+30
-1
lines changed

5 files changed

+30
-1
lines changed

Diff for: .gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,7 @@ Makefile.in
150150
/tests/gd2/gd2_im2im
151151
/tests/gd2/gd2_null
152152
/tests/gd2/gd2_read
153+
/tests/gd2/gd2_read_corrupt
153154
/tests/gdimagearc/bug00079
154155
/tests/gdimageline/gdimageline_aa
155156
/tests/gdimageline/bug00072

Diff for: src/gd_gd2.c

+2
Original file line numberDiff line numberDiff line change
@@ -165,6 +165,8 @@ _gd2GetHeader (gdIOCtxPtr in, int *sx, int *sy,
165165
if (gdGetInt (&cidx[i].size, in) != 1) {
166166
goto fail2;
167167
};
168+
if (cidx[i].offset < 0 || cidx[i].size < 0)
169+
goto fail2;
168170
};
169171
*chunkIdx = cidx;
170172
};

Diff for: tests/Makefile.am

+2-1
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,8 @@ endif
129129

130130
if HAVE_LIBZ
131131
check_PROGRAMS += \
132-
gd2/gd2_null
132+
gd2/gd2_null \
133+
gd2/gd2_read_corrupt
133134
endif
134135

135136
if HAVE_LIBPNG

Diff for: tests/gd2/gd2_read_corrupt.c

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
/* Just try to read the invalid gd2 image & not crash. */
2+
#include "gd.h"
3+
#include <stdio.h>
4+
#include <stdlib.h>
5+
#include "gdtest.h"
6+
7+
int main()
8+
{
9+
gdImagePtr im;
10+
FILE *fp;
11+
char path[1024];
12+
13+
/* Read the corrupt image. */
14+
sprintf(path, "%s/gd2/invalid_neg_size.gd2", GDTEST_TOP_DIR);
15+
fp = fopen(path, "rb");
16+
if (!fp) {
17+
printf("failed, cannot open file\n");
18+
return 1;
19+
}
20+
im = gdImageCreateFromGd2(fp);
21+
fclose(fp);
22+
23+
/* Should have failed & rejected it. */
24+
return im == NULL ? 0 : 1;
25+
}

Diff for: tests/gd2/invalid_neg_size.gd2

1.64 KB
Binary file not shown.

0 commit comments

Comments
 (0)