Skip to content

Commit 69d2fd2

Browse files
committed
Fix #354: Signed Integer Overflow gd_io.c
GD2 stores the number of horizontal and vertical chunks as words (i.e. 2 byte unsigned). These values are multiplied and assigned to an int when reading the image, what can cause integer overflows. We have to avoid that, and also make sure that either chunk count is actually greater than zero. If illegal chunk counts are detected, we bail out from reading the image.
1 parent 1846f48 commit 69d2fd2

File tree

7 files changed

+41
-0
lines changed

7 files changed

+41
-0
lines changed

Diff for: src/gd_gd2.c

+4
Original file line numberDiff line numberDiff line change
@@ -209,6 +209,10 @@ _gd2GetHeader (gdIOCtxPtr in, int *sx, int *sy,
209209
GD2_DBG (printf ("%d Chunks vertically\n", *ncy));
210210

211211
if (gd2_compressed (*fmt)) {
212+
if (*ncx <= 0 || *ncy <= 0 || *ncx > INT_MAX / *ncy) {
213+
GD2_DBG(printf ("Illegal chunk counts: %d * %d\n", *ncx, *ncy));
214+
goto fail1;
215+
}
212216
nc = (*ncx) * (*ncy);
213217

214218
GD2_DBG (printf ("Reading %d chunk index entries\n", nc));

Diff for: tests/gd2/.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
/bug_289
22
/bug00309
3+
/bug00354
34
/gd2_empty_file
45
/gd2_im2im
56
/gd2_null

Diff for: tests/gd2/CMakeLists.txt

+1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
LIST(APPEND TESTS_FILES
22
bug_289
33
bug00309
4+
bug00354
45
gd2_empty_file
56
gd2_im2im
67
gd2_null

Diff for: tests/gd2/Makemodule.am

+3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
libgd_test_programs += \
22
gd2/bug_289 \
33
gd2/bug00309 \
4+
gd2/bug00354 \
45
gd2/gd2_empty_file \
56
gd2/php_bug_72339 \
67
gd2/gd2_read_corrupt \
@@ -19,6 +20,8 @@ endif
1920

2021
EXTRA_DIST += \
2122
gd2/CMakeLists.txt \
23+
gd2/bug00354a.gd2 \
24+
gd2/bug00354b.gd2 \
2225
gd2/conv_gd2_exp.gd2 \
2326
gd2/conv_test.gd2 \
2427
gd2/conv_test_exp.png \

Diff for: tests/gd2/bug00354.c

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
/**
2+
* We're testing GD2 image files which report illegal chunk counts. These should
3+
* not cause integer overflows or other issues, but instead simply fail to be
4+
* loaded.
5+
*
6+
* See also <https://github.com/libgd/libgd/issues/354>.
7+
*/
8+
9+
10+
#include "gd.h"
11+
#include "gdtest.h"
12+
13+
14+
int main()
15+
{
16+
gdImagePtr im;
17+
FILE *fp;
18+
19+
fp = gdTestFileOpen2("gd2", "bug00354a.gd2");
20+
gdTestAssert(fp != NULL);
21+
im = gdImageCreateFromGd2(fp);
22+
gdTestAssert(im == NULL);
23+
fclose(fp);
24+
25+
fp = gdTestFileOpen2("gd2", "bug00354b.gd2");
26+
gdTestAssert(fp != NULL);
27+
im = gdImageCreateFromGd2(fp);
28+
gdTestAssert(im == NULL);
29+
fclose(fp);
30+
31+
return gdNumFailures();
32+
}

Diff for: tests/gd2/bug00354a.gd2

92 Bytes
Binary file not shown.

Diff for: tests/gd2/bug00354b.gd2

18 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)