Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
2 changed files
with
79 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,78 @@ | ||
|
||
3.1.1 | ||
===== | ||
|
||
CVE-2016-0740 -- Buffer overflow in TiffDecode.c | ||
------------------------------------------------ | ||
|
||
Pillow 3.1.0 and earlier when linked against libtiff >= 4.0.0 on x64 | ||
may overflow a buffer when reading a specially crafted tiff file. | ||
|
||
Specifically, libtiff >= 4.0.0 changed the return type of | ||
``TIFFScanlineSize`` from ``int32`` to machine dependent | ||
``int32|64``. If the scanline is sized so that it overflows an | ||
``int32``, it may be interpreted as a negative number, which will then | ||
pass the size check in ``TiffDecode.c`` line 236. To do this, the | ||
logical scanline size has to be > 2gb, and for the test file, the | ||
allocated buffer size is 64k against a roughly 4gb scan line size. Any | ||
image data over 64k is written over the heap, causing a segfault. | ||
|
||
This issue was found by security researcher FourOne. | ||
|
||
|
||
CVE-2016-0775 -- Buffer overflow in FliDecode.c | ||
----------------------------------------------- | ||
|
||
In all versions of Pillow, dating back at least to the last PIL 1.1.7 | ||
release, FliDecode.c has a buffer overflow error. | ||
|
||
Around line 192:: | ||
|
||
case 16: | ||
/* COPY chunk */ | ||
for (y = 0; y < state->ysize; y++) { | ||
UINT8* buf = (UINT8*) im->image[y]; | ||
memcpy(buf+x, data, state->xsize); | ||
data += state->xsize; | ||
} | ||
break; | ||
|
||
|
||
The memcpy has error where ``x`` is added to the target buffer | ||
address. ``X`` is used in several internal temporary variable roles, | ||
but can take a value up to the width of the image. ``Im->image[y]`` | ||
is a set of row pointers to segments of memory that are the size of | ||
the row. At the max ``y``, this will write the contents of the line | ||
off the end of the memory buffer, causing a segfault. | ||
|
||
This issue was found by Alyssa Besseling at Atlassian | ||
|
||
CVE-2016-TBD -- Buffer overflow in PcdDecode.c | ||
---------------------------------------------- | ||
|
||
In all versions of Pillow, dating back at least to the last PIL 1.1.7 | ||
release, ``PcdDecode.c`` has a buffer overflow error. | ||
|
||
The ``state.buffer`` for ``PcdDecode.c`` is allocated based on a 3 | ||
bytes per pixel sizing, where ``PcdDecode.c`` wrote into the buffer | ||
assuming 4 bytes per pixel. This writes 768 bytes beyond the end of | ||
the buffer into other Python object storage. In some cases, this | ||
causes a segfault, in others an internal Python malloc error. | ||
|
||
Integer overflow in Resample.c | ||
------------------------------ | ||
|
||
If a large value was passed into the new size for an image, it is | ||
possible to overflow an int32 value passed into malloc. | ||
|
||
kk = malloc(xsize * kmax * sizeof(float)); | ||
... | ||
xbounds = malloc(xsize * 2 * sizeof(int)); | ||
|
||
``xsize`` is trusted user input. These multiplications can overflow, | ||
leading the malloc'd buffer to be undersized. These allocations are | ||
followed by a loop that writes out of bounds. This can lead to | ||
corruption on the heap of the Python process with attacker controlled | ||
float data. | ||
|
||
This issue was found by Ned Williamson. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -6,6 +6,7 @@ Release Notes | |
.. toctree:: | ||
:maxdepth: 2 | ||
|
||
3.1.1 | ||
3.1.0 | ||
3.0.0 | ||
2.8.0 | ||
|