Skip to content

Commit 9c78a04

Browse files
committed
cjpeg: Fix OOB read caused by malformed 8-bit BMP
... in which one or more of the color indices is out of range for the number of palette entries. Fix partly borrowed from jpeg-9c. This commit also adopts Guido's JERR_PPM_OUTOFRANGE enum value in lieu of our project-specific JERR_PPM_TOOLARGE enum value. Fixes #258
1 parent 0fa7850 commit 9c78a04

File tree

4 files changed

+26
-9
lines changed

4 files changed

+26
-9
lines changed

Diff for: ChangeLog.md

+5
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,11 @@ a 4:2:2 or 4:2:0 JPEG image using the merged (non-fancy) upsampling algorithms
4747
7. The new CMake-based build system will now disable the MIPS DSPr2 SIMD
4848
extensions if it detects that the compiler does not support DSPr2 instructions.
4949

50+
8. Fixed out-of-bounds read in cjpeg that occurred when attempting to compress
51+
a specially-crafted malformed color-index (8-bit-per-sample) BMP file in which
52+
some of the samples (color indices) exceeded the bounds of the BMP file's color
53+
table.
54+
5055

5156
1.5.90 (2.0 beta1)
5257
==================

Diff for: cderror.h

+3-2
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
* cderror.h
33
*
44
* Copyright (C) 1994-1997, Thomas G. Lane.
5-
* Modified 2009 by Guido Vollbeding.
5+
* Modified 2009-2017 by Guido Vollbeding.
66
* This file is part of the Independent JPEG Group's software.
77
* For conditions of distribution and use, see the accompanying README.ijg
88
* file.
@@ -49,6 +49,7 @@ JMESSAGE(JERR_BMP_COLORSPACE, "BMP output must be grayscale or RGB")
4949
JMESSAGE(JERR_BMP_COMPRESSED, "Sorry, compressed BMPs not yet supported")
5050
JMESSAGE(JERR_BMP_EMPTY, "Empty BMP image")
5151
JMESSAGE(JERR_BMP_NOT, "Not a BMP file - does not start with BM")
52+
JMESSAGE(JERR_BMP_OUTOFRANGE, "Numeric value out of range in BMP file")
5253
JMESSAGE(JTRC_BMP, "%ux%u 24-bit BMP image")
5354
JMESSAGE(JTRC_BMP_MAPPED, "%ux%u 8-bit colormapped BMP image")
5455
JMESSAGE(JTRC_BMP_OS2, "%ux%u 24-bit OS2 BMP image")
@@ -75,8 +76,8 @@ JMESSAGE(JWRN_GIF_NOMOREDATA, "Ran out of GIF bits")
7576
#ifdef PPM_SUPPORTED
7677
JMESSAGE(JERR_PPM_COLORSPACE, "PPM output must be grayscale or RGB")
7778
JMESSAGE(JERR_PPM_NONNUMERIC, "Nonnumeric data in PPM file")
78-
JMESSAGE(JERR_PPM_TOOLARGE, "Integer value too large in PPM file")
7979
JMESSAGE(JERR_PPM_NOT, "Not a PPM/PGM file")
80+
JMESSAGE(JERR_PPM_OUTOFRANGE, "Numeric value out of range in PPM file")
8081
JMESSAGE(JTRC_PGM, "%ux%u PGM image")
8182
JMESSAGE(JTRC_PGM_TEXT, "%ux%u text PGM image")
8283
JMESSAGE(JTRC_PPM, "%ux%u PPM image")

Diff for: rdbmp.c

+12-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
*
44
* This file was part of the Independent JPEG Group's software:
55
* Copyright (C) 1994-1996, Thomas G. Lane.
6-
* Modified 2009-2010 by Guido Vollbeding.
6+
* Modified 2009-2017 by Guido Vollbeding.
77
* libjpeg-turbo Modifications:
88
* Modified 2011 by Siarhei Siamashka.
99
* Copyright (C) 2015, 2017-2018, D. R. Commander.
@@ -72,6 +72,7 @@ typedef struct _bmp_source_struct {
7272
JDIMENSION row_width; /* Physical width of scanlines in file */
7373

7474
int bits_per_pixel; /* remembers 8- or 24-bit format */
75+
int cmap_length; /* colormap length */
7576

7677
boolean use_inversion_array; /* TRUE = preload the whole image, which is
7778
stored in bottom-up order, and feed it to
@@ -155,6 +156,7 @@ get_8bit_row(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
155156
{
156157
bmp_source_ptr source = (bmp_source_ptr)sinfo;
157158
register JSAMPARRAY colormap = source->colormap;
159+
int cmaplen = source->cmap_length;
158160
JSAMPARRAY image_ptr;
159161
register int t;
160162
register JSAMPROW inptr, outptr;
@@ -178,11 +180,15 @@ get_8bit_row(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
178180
if (cinfo->in_color_space == JCS_GRAYSCALE) {
179181
for (col = cinfo->image_width; col > 0; col--) {
180182
t = GETJSAMPLE(*inptr++);
183+
if (t >= cmaplen)
184+
ERREXIT(cinfo, JERR_BMP_OUTOFRANGE);
181185
*outptr++ = colormap[0][t];
182186
}
183187
} else if (cinfo->in_color_space == JCS_CMYK) {
184188
for (col = cinfo->image_width; col > 0; col--) {
185189
t = GETJSAMPLE(*inptr++);
190+
if (t >= cmaplen)
191+
ERREXIT(cinfo, JERR_BMP_OUTOFRANGE);
186192
rgb_to_cmyk(colormap[0][t], colormap[1][t], colormap[2][t], outptr,
187193
outptr + 1, outptr + 2, outptr + 3);
188194
outptr += 4;
@@ -197,6 +203,8 @@ get_8bit_row(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
197203
if (aindex >= 0) {
198204
for (col = cinfo->image_width; col > 0; col--) {
199205
t = GETJSAMPLE(*inptr++);
206+
if (t >= cmaplen)
207+
ERREXIT(cinfo, JERR_BMP_OUTOFRANGE);
200208
outptr[rindex] = colormap[0][t];
201209
outptr[gindex] = colormap[1][t];
202210
outptr[bindex] = colormap[2][t];
@@ -206,6 +214,8 @@ get_8bit_row(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
206214
} else {
207215
for (col = cinfo->image_width; col > 0; col--) {
208216
t = GETJSAMPLE(*inptr++);
217+
if (t >= cmaplen)
218+
ERREXIT(cinfo, JERR_BMP_OUTOFRANGE);
209219
outptr[rindex] = colormap[0][t];
210220
outptr[gindex] = colormap[1][t];
211221
outptr[bindex] = colormap[2][t];
@@ -539,6 +549,7 @@ start_input_bmp(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
539549
/* Allocate space to store the colormap */
540550
source->colormap = (*cinfo->mem->alloc_sarray)
541551
((j_common_ptr)cinfo, JPOOL_IMAGE, (JDIMENSION)biClrUsed, (JDIMENSION)3);
552+
source->cmap_length = (int)biClrUsed;
542553
/* and read it from the file */
543554
read_colormap(source, (int)biClrUsed, mapentrysize);
544555
/* account for size of colormap */

Diff for: rdppm.c

+6-6
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ typedef struct {
7575
JSAMPROW pixrow; /* compressor input buffer */
7676
size_t buffer_width; /* width of I/O buffer */
7777
JSAMPLE *rescale; /* => maxval-remapping array, or NULL */
78-
int maxval;
78+
unsigned int maxval;
7979
} ppm_source_struct;
8080

8181
typedef ppm_source_struct *ppm_source_ptr;
@@ -125,7 +125,7 @@ read_pbm_integer(j_compress_ptr cinfo, FILE *infile, unsigned int maxval)
125125
}
126126

127127
if (val > maxval)
128-
ERREXIT(cinfo, JERR_PPM_TOOLARGE);
128+
ERREXIT(cinfo, JERR_PPM_OUTOFRANGE);
129129

130130
return val;
131131
}
@@ -509,7 +509,7 @@ get_word_gray_row(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
509509
temp = UCH(*bufferptr++) << 8;
510510
temp |= UCH(*bufferptr++);
511511
if (temp > maxval)
512-
ERREXIT(cinfo, JERR_PPM_TOOLARGE);
512+
ERREXIT(cinfo, JERR_PPM_OUTOFRANGE);
513513
*ptr++ = rescale[temp];
514514
}
515515
return 1;
@@ -536,17 +536,17 @@ get_word_rgb_row(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
536536
temp = UCH(*bufferptr++) << 8;
537537
temp |= UCH(*bufferptr++);
538538
if (temp > maxval)
539-
ERREXIT(cinfo, JERR_PPM_TOOLARGE);
539+
ERREXIT(cinfo, JERR_PPM_OUTOFRANGE);
540540
*ptr++ = rescale[temp];
541541
temp = UCH(*bufferptr++) << 8;
542542
temp |= UCH(*bufferptr++);
543543
if (temp > maxval)
544-
ERREXIT(cinfo, JERR_PPM_TOOLARGE);
544+
ERREXIT(cinfo, JERR_PPM_OUTOFRANGE);
545545
*ptr++ = rescale[temp];
546546
temp = UCH(*bufferptr++) << 8;
547547
temp |= UCH(*bufferptr++);
548548
if (temp > maxval)
549-
ERREXIT(cinfo, JERR_PPM_TOOLARGE);
549+
ERREXIT(cinfo, JERR_PPM_OUTOFRANGE);
550550
*ptr++ = rescale[temp];
551551
}
552552
return 1;

0 commit comments

Comments
 (0)