Please sign in to comment.
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Fixed TALOS-2019-0844 - XPM image colorhash parsing Code Execution Vu…
…lnerability The table entry in the color_hash is created in the create_colorhash function based on the number of colors passed into the function. The size of the color_hash table is the first value in the powers of 2 larger than the passed in number of colors . The size of the allocation is this calculated value * 8 (sizeof(struct hash_entry **)) . This multiplication can cause an overflow, resulting in a very small allocation.
- Loading branch information