Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

integer-overflow cause heap-buffer-overflow in tjLoadImage #304

Closed
Vector1iu opened this issue Nov 25, 2018 · 1 comment
Closed

integer-overflow cause heap-buffer-overflow in tjLoadImage #304

Vector1iu opened this issue Nov 25, 2018 · 1 comment

Comments

@Vector1iu
Copy link

Vector1iu commented Nov 25, 2018

➜ build git:(master) ✗ ./tjbench ~/Pictures/bmp/LAND3.BMP 90

[1] 17576 segmentation fault (core dumped) ./tjbench ~/Pictures/bmp/LAND3.BMP 90


the reason of "segmentation fault " is has no check on "pitch * (*height)" in tjLoadImage, it can be integer overflow, here is gdb print:

(gdb) p pitch * (*height)
$21 = 768
(gdb) p pitch
$22 = 50331651
(gdb) p (*height)
$23 = 256


DLLEXPORT unsigned char *tjLoadImage(const char *filename, int *width,
int align, int *height, int *pixelFormat,
int flags)
...
if ((dstBuf = (unsigned char *)malloc(pitch * (*height))) == NULL)
_throwg("tjLoadImage(): Memory allocation failure");
....


the crash happen in memcpy due to heap overflow


DLLEXPORT unsigned char *tjLoadImage(const char *filename, int *width,
int align, int *height, int *pixelFormat,
int flags)
...
memcpy(dstptr, src->buffer[i], (*width) * tjPixelSize[*pixelFormat]);
...


you need unzip LAND3.zip to get LAND3.BMP, because github doesn't support upload .bmp file

LAND3.zip

@Vector1iu Vector1iu changed the title integer overflow in tjBufSizeYUV2 integer overflow in tjLoadImage Nov 25, 2018
@Vector1iu Vector1iu changed the title integer overflow in tjLoadImage integer-overflow cause heap-buffer-overflow in tjLoadImage Nov 30, 2018
@carnil
Copy link

carnil commented Dec 22, 2018

This issue was assigned CVE-2018-20330.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants