Attachment 25663 Details for Bug 62666

gd-overflow.patch

gd-overflow.patch (text/x-diff), 6.44 KB, created by Vladimir Nadvornik on 2004-11-01 22:30:16 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Vladimir Nadvornik

Created: 2004-11-01 22:30:16 UTC

Size: 6.44 KB

patch

obsolete

>--- Makefile.am
>+++ Makefile.am
>@@ -17,7 +17,7 @@
> 
> lib_LTLIBRARIES = libgd.la
> 
>-libgd_la_SOURCES = gd.c gdfx.c gd_gd.c gd_gd2.c gd_io.c gd_io_dp.c gd_gif_in.c gd_gif_out.c gd_io_file.c gd_io_ss.c gd_jpeg.c gd_png.c gd_ss.c gd_topal.c gd_wbmp.c gdcache.c gdfontg.c gdfontl.c gdfontmb.c gdfonts.c gdfontt.c gdft.c gdhelpers.c gdhelpers.h gdkanji.c gdtables.c gdxpm.c jisx0208.h wbmp.c wbmp.h
>+libgd_la_SOURCES = gd.c gdfx.c gd_security.c gd_gd.c gd_gd2.c gd_io.c gd_io_dp.c gd_gif_in.c gd_gif_out.c gd_io_file.c gd_io_ss.c gd_jpeg.c gd_png.c gd_ss.c gd_topal.c gd_wbmp.c gdcache.c gdfontg.c gdfontl.c gdfontmb.c gdfonts.c gdfontt.c gdft.c gdhelpers.c gdhelpers.h gdkanji.c gdtables.c gdxpm.c jisx0208.h wbmp.c wbmp.h
> 
> libgd_la_LDFLAGS = -version-info 2:0:0
> 
>--- gd.c
>+++ gd.c
>@@ -2064,6 +2064,12 @@
>   /* We only need to use floating point to determine the correct
>      stretch vector for one line's worth. */
>   double accum;
>+  if (overflow2(sizeof (int), srcW)) {
>+    return;
>+  }
>+  if (overflow2(sizeof (int), srcH)) {
>+    return;
>+  }
>   stx = (int *) gdMalloc (sizeof (int) * srcW);
>   sty = (int *) gdMalloc (sizeof (int) * srcH);
>   accum = 0;
>@@ -2570,6 +2576,9 @@
> 
>   if (!im->polyAllocated)
>     {
>+      if (overflow2(sizeof (int), n)) {
>+        return;
>+      }
>       im->polyInts = (int *) gdMalloc (sizeof (int) * n);
>       im->polyAllocated = n;
>     }
>@@ -2724,6 +2733,9 @@
>     {
>       gdFree (im->style);
>     }
>+  if (overflow2(sizeof (int), noOfPixels)) {
>+    return;
>+  }   	
>   im->style = (int *) gdMalloc (sizeof (int) * noOfPixels);
>   memcpy (im->style, style, sizeof (int) * noOfPixels);
>   im->styleLength = noOfPixels;
>--- gd_io_dp.c
>+++ gd_io_dp.c
>@@ -199,6 +199,9 @@
> 	{
> 	  return FALSE;
> 	}
>+      if (overflow2(dp->realSize, 2)) {
>+        return FALSE;
>+      }
>       if (!gdReallocDynamic (dp, dp->realSize * 2))
> 	{
> 	  dp->dataGood = FALSE;
>@@ -375,6 +378,9 @@
> 	{
> 	  return FALSE;
> 	}
>+      if (overflow2(dp->realSize, 2)) {
>+        return FALSE;
>+      }
>       if (!gdReallocDynamic (dp, bytesNeeded * 2))
> 	{
> 	  dp->dataGood = FALSE;
>--- gd_png.c
>+++ gd_png.c
>@@ -312,12 +312,21 @@
> 
>   /* allocate space for the PNG image data */
>   rowbytes = png_get_rowbytes (png_ptr, info_ptr);
>+  if (overflow2(rowbytes, height)) {
>+    png_destroy_read_struct (&png_ptr, &info_ptr, NULL);
>+    return NULL;
>+  }  
>   if ((image_data = (png_bytep) gdMalloc (rowbytes * height)) == NULL)
>     {
>       fprintf (stderr, "gd-png error: cannot allocate image data\n");
>       png_destroy_read_struct (&png_ptr, &info_ptr, NULL);
>       return NULL;
>     }
>+  if (overflow2(height, sizeof (png_bytep))) {
>+    png_destroy_read_struct (&png_ptr, &info_ptr, NULL);
>+    gdFree (image_data);
>+    return NULL;
>+  }    
>   if ((row_pointers =
>        (png_bytepp) gdMalloc (height * sizeof (png_bytep))) == NULL)
>     {
>@@ -715,20 +724,27 @@
>       int thisPixel;
>       png_bytep *prow_pointers;
>       int saveAlphaFlag = im->saveAlphaFlag;
>+      if (overflow2(sizeof (png_bytep), height)) {
>+        return;
>+      } 
>       row_pointers = gdMalloc (sizeof (png_bytep) * height);
>       if (row_pointers == NULL)
> 	{
> 	  fprintf (stderr, "gd-png error: unable to allocate row_pointers\n");
>+          /* 2.0.29: return was missing */
>+          return;
> 	}
>       prow_pointers = row_pointers;
>       for (j = 0; j < height; ++j)
> 	{
>-	  if ((*prow_pointers =
>-	       (png_bytep) gdMalloc (width * channels)) == NULL)
>+          if (overflow2(width, channels) || ((*prow_pointers =
>+	       (png_bytep) gdMalloc (width * channels)) == NULL))
> 	    {
> 	      fprintf (stderr, "gd-png error: unable to allocate rows\n");
> 	      for (i = 0; i < j; ++i)
> 		gdFree (row_pointers[i]);
>+              /* 2.0.29: memory leak TBB */
>+              free(row_pointers);
> 	      return;
> 	    }
> 	  pOutputRow = *prow_pointers++;
>@@ -766,11 +782,16 @@
>       if (remap)
> 	{
> 	  png_bytep *row_pointers;
>+          if (overflow2(sizeof (png_bytep), height)) {
>+            return;
>+          }
> 	  row_pointers = gdMalloc (sizeof (png_bytep) * height);
> 	  if (row_pointers == NULL)
> 	    {
> 	      fprintf (stderr,
> 		       "gd-png error: unable to allocate row_pointers\n");
>+              /* TBB: return missing */
>+              return;
> 	    }
> 	  for (j = 0; j < height; ++j)
> 	    {
>@@ -779,6 +800,8 @@
> 		  fprintf (stderr, "gd-png error: unable to allocate rows\n");
> 		  for (i = 0; i < j; ++i)
> 		    gdFree (row_pointers[i]);
>+                  /* TBB: memory leak */
>+		  gdFree (row_pointers);
> 		  return;
> 		}
> 	      for (i = 0; i < width; ++i)
>--- gd_security.c
>+++ gd_security.c
>@@ -0,0 +1,33 @@
>+/*
>+   * gd_security.c
>+   *
>+   * Implements buffer overflow check routines.
>+   *
>+   * Written 2004, Phil Knirsch.
>+   * Based on netpbm fixes by Alan Cox.
>+   *
>+ */
>+
>+#ifdef HAVE_CONFIG_H
>+#include "config.h"
>+#endif
>+
>+#include <stdio.h>
>+#include <stdlib.h>
>+#include <limits.h>
>+#include "gd.h"
>+
>+int overflow2(int a, int b)
>+{
>+	if(a < 0 || b < 0) {
>+		fprintf(stderr, "gd warning: one parameter to a memory allocation multiplication is negative, failing operation gracefully\n");
>+		return 1;
>+	}
>+	if(b == 0)
>+		return 0;
>+	if(a > INT_MAX / b) {
>+		fprintf(stderr, "gd warning: product of memory allocation multiplication would exceed INT_MAX, failing operation gracefully\n");
>+		return 1;
>+	}
>+	return 0;
>+}
>--- gd_topal.c
>+++ gd_topal.c
>@@ -793,6 +793,11 @@
>   boxlist = (boxptr) (*cinfo->mem->alloc_small)
>     ((j_common_ptr) cinfo, JPOOL_IMAGE, desired_colors * SIZEOF (box));
> #else
>+  /* This can't happen because we clamp desired_colors at gdMaxColors, 
>+    but anyway */
>+  if (overflow2(desired_colors, sizeof (box))) {
>+    return;
>+   }
>   boxlist = (boxptr) gdMalloc (desired_colors * sizeof (box));
> #endif
>   /* Initialize one box containing whole space */
>--- wbmp.c
>+++ wbmp.c
>@@ -119,6 +119,14 @@
>   if ((wbmp = (Wbmp *) gdMalloc (sizeof (Wbmp))) == NULL)
>     return (NULL);
> 
>+  if (overflow2(sizeof (int), width)) {
>+    gdFree(wbmp);
>+    return NULL;
>+  }
>+  if (overflow2(sizeof (int) * width, height)) {
>+    gdFree(wbmp);
>+    return NULL;
>+  }
>   if ((wbmp->bitmap =
>        (int *) gdMalloc (sizeof (int) * width * height)) == NULL)
>     {
>@@ -180,6 +188,12 @@
>   printf ("W: %d, H: %d\n", wbmp->width, wbmp->height);
> #endif
> 
>+  if (overflow2(sizeof (int), wbmp->width) ||
>+    overflow2(sizeof (int) * wbmp->width, wbmp->height))
>+    {
>+      gdFree(wbmp);
>+      return (-1);
>+    }
>   if ((wbmp->bitmap =
>        (int *) gdMalloc (sizeof (int) * wbmp->width * wbmp->height)) == NULL)
>     {

Actions: View

Attachments on bug 62666: 25455 | 25456 | 25663 | 26013 | 26050