Integer Overflow in ImagingResampleHorizontal

[nedwill]

ImagingResampleHorizontal mallocs two buffers:

kk = malloc(xsize * kmax * sizeof(float));
...
xbounds = malloc(xsize * 2 * sizeof(int));

xsize is trusted user input. These multiplications can overflow, leading the malloc'd buffer to be undersized. These allocations are followed by a loop that writes out of bounds. This can lead to corruption on the heap of the Python process with attacker controlled data (exploiting this would be really cool, as the loop contains some serious floaty arithmetic). It's possible someone has an image resizing service using Pillow. :)

See the following proof of concept:

from PIL import Image
im = Image.open("cat.jpg").convert("L")
xsize = 0x100000008 / 4
ysize = 0x1337 # unrelated
im.im.resize((xsize, ysize), Image.LINEAR) # any resampling filter will do here

where "cat.jpg" is your favorite valid cat picture.

[radarhere]

Sounds to me like you have a fairly good handle on the situation. Would you be interested in creating a PR to solve the problem?

[nedwill]

Sure, I'll take a look.

[nedwill]

Oh, I just noticed in #1708 there's a mention of a private repo for security updates and some CVEs. I hope you don't mind that I disclosed this bug here. If I find related bugs in the future, should I contact the maintainers through some other channel?

[radarhere]

The current conclusion of #1658 is to e-mail aclark@aclark.net and let him know.

[nedwill]

Ok, in the future I'll contact him there. I've contributed security fixes to some projects before but hadn't encountered a security procedure like this. (For example, the CPython project itself just accepts public disclosures in their normal bug tracker.)