Attachment 25749 Details for Bug 62677

[patch] Proposed fix for multiplication overflow

xzgv-proposed-fix.diff (text/plain), 5.10 KB, created by Joerg Reuter on 2004-11-04 01:37:07 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Joerg Reuter

Created: 2004-11-04 01:37:07 UTC

Size: 5.10 KB

patch

obsolete

>diff -Nur ../xzgv-0.8/src/readgif.c ./src/readgif.c
>--- ../xzgv-0.8/src/readgif.c	2002-03-03 05:34:32.000000000 +0100
>+++ ./src/readgif.c	2004-11-03 17:44:32.000000000 +0100
>@@ -8,6 +8,7 @@
> #include <string.h>
> #include <unistd.h>
> #include <stdlib.h>
>+#include "sizetmax.h"
> #include "readgif.h"
> 
> 
>@@ -102,7 +103,15 @@
>     }
>   
>   if(local_colour_map) readcolmap(in);
>-  
>+
>+  if ((width <= 0) || (height <=0 ) || 
>+      (width > (SIZE_T_MAX/height)) ||
>+      ((width * height) > SIZE_T_MAX/3))
>+    {
>+    fclose(in);
>+    return(0);
>+    }
>+
>   if((image=malloc(width*height*3))==NULL)
>     {
>     fclose(in);
>diff -Nur ../xzgv-0.8/src/readjpeg.c ./src/readjpeg.c
>--- ../xzgv-0.8/src/readjpeg.c	2003-09-16 13:52:04.000000000 +0200
>+++ ./src/readjpeg.c	2004-11-03 17:48:45.000000000 +0100
>@@ -13,7 +13,7 @@
> #include <jpeglib.h>
> 
> #include "rcfile.h"
>-
>+#include "sizetmax.h"
> #include "readjpeg.h"
> 
> 
>@@ -265,12 +265,21 @@
> /* this one shouldn't hurt */
> cinfo.do_block_smoothing=FALSE;
> 
>+if ((width <= 0) || (height <=0 ) ||
>+      (width > (SIZE_T_MAX/height)) ||
>+      ((width * height) > SIZE_T_MAX/3))
>+  longjmp(jerr.setjmp_buffer,1);
>+
> if((*imagep=image=malloc(width*height*3))==NULL)
>   longjmp(jerr.setjmp_buffer,1);
> 
> jpeg_start_decompress(&cinfo);
> 
> /* read the image */
>+if ((height <= 0) ||
>+    (height > (SIZE_T_MAX/sizeof(unsigned char *))))
>+  longjmp(jerr.setjmp_buffer,1);
>+
> if((lineptrs=malloc(height*sizeof(unsigned char *)))==NULL)
>   longjmp(jerr.setjmp_buffer,1);
> 
>diff -Nur ../xzgv-0.8/src/readmrf.c ./src/readmrf.c
>--- ../xzgv-0.8/src/readmrf.c	2000-10-07 15:26:55.000000000 +0200
>+++ ./src/readmrf.c	2004-11-03 17:52:49.000000000 +0100
>@@ -8,7 +8,7 @@
> #include <string.h>
> #include <stdlib.h>
> #include "readmrf.h"
>-
>+#include "sizetmax.h"
> 
> static int bitbox,bitsleft;
> 
>@@ -91,6 +91,15 @@
> w64=(w+63)/64;
> h64=(h+63)/64;
> 
>+if ((w <= 0) || (h <=0 ) || 
>+    (w > (SIZE_T_MAX/h)) || ((w * h) > SIZE_T_MAX/3) ||
>+    (w64<=0) || (h64<=0) || (w64>(SIZE_T_MAX/h64)) ||
>+    (w64*h64) > SIZE_T_MAX/(64*64))
>+    {
>+    return(0);
>+    }
>+
>+
> if((*bmap=malloc(w*h*3))==NULL ||
>    (image=calloc(w64*h64*64*64,1))==NULL)
>   {
>diff -Nur ../xzgv-0.8/src/readpng.c ./src/readpng.c
>--- ../xzgv-0.8/src/readpng.c	2003-07-10 17:13:43.000000000 +0200
>+++ ./src/readpng.c	2004-11-03 18:12:21.465865773 +0100
>@@ -17,6 +17,7 @@
> #include <png.h>
> #include <setjmp.h>	/* after png.h to avoid horrible thing in pngconf.h */
> #include "readpng.h"
>+#include "sizetmax.h"
> 
> 
> /* must be global to allow aborting in mid-read */
>@@ -129,6 +130,14 @@
>   }
> 
> /* allocate image memory */
>+if((width <= 0) || (height <=0 ) ||
>+   (width > (SIZE_T_MAX/height)) ||
>+   ((width * height) > SIZE_T_MAX/3))
>+    {
>+    fclose(in);
>+    return(0);
>+    }
>+
> if((*theimageptr=theimage=malloc(width*height*3))==NULL)
>   {
>   png_read_end(png_ptr,info_ptr);
>diff -Nur ../xzgv-0.8/src/readprf.c ./src/readprf.c
>--- ../xzgv-0.8/src/readprf.c	2001-04-09 20:08:19.000000000 +0200
>+++ ./src/readprf.c	2004-11-03 17:57:10.000000000 +0100
>@@ -8,6 +8,7 @@
> #include <string.h>
> #include <stdlib.h>
> #include "readprf.h"
>+#include "sizetmax.h"
> 
> #define squaresize	64
> 
>@@ -163,6 +164,12 @@
> if(planes==1)
>   bytepp=1;
> 
>+if((width <= 0) || (width > (SIZE_T_MAX/squaresize)))
>+    {
>+    fclose(in);
>+    return(0);
>+    }
>+
> n=width*squaresize;
> if((planebuf[0]=calloc(n,planes))==NULL)
>   {
>@@ -173,6 +180,13 @@
> for(f=1;f<planes;f++)
>   planebuf[f]=planebuf[f-1]+n;
> 
>+if((height <= 0 ) ||
>+  (width > (SIZE_T_MAX/height)) || ((width * height) > SIZE_T_MAX/3))
>+    {
>+    fclose(in);
>+    return(0);
>+    }
>+
> if((*theimageptr=malloc(width*height*3))==NULL)
>   {
>   free(planebuf[0]);
>diff -Nur ../xzgv-0.8/src/readtiff.c ./src/readtiff.c
>--- ../xzgv-0.8/src/readtiff.c	2000-12-28 04:20:55.000000000 +0100
>+++ ./src/readtiff.c	2004-11-03 18:02:49.000000000 +0100
>@@ -11,7 +11,7 @@
> #include <setjmp.h>
> #include <sys/file.h>  /* for open et al */
> #include <tiffio.h>
>-
>+#include "sizetmax.h"
> #include "readtiff.h"
> 
> 
>@@ -32,10 +32,26 @@
> TIFFGetField(in,TIFFTAG_IMAGEWIDTH,&width);
> TIFFGetField(in,TIFFTAG_IMAGELENGTH,&height);
> 
>+if((width <= 0) || (height <=0 ) ||
>+   (width > (SIZE_T_MAX/height)) ||
>+   ((width * height) > SIZE_T_MAX/sizeof(uint32)))
>+    {
>+    TIFFClose(in);
>+    return(0);
>+    }
>+
>+
> /* the width*3 guarantees there'll be at least one line
>  * spare for the flip afterwards.
>  */
> numpix=width*height;
>+
>+if((width > (SIZE_T_MAX/3)) || (numpix*sizeof(uint32) > SIZE_T_MAX-width*3))
>+   {
>+   TIFFClose(in);
>+   return(0);
>+   }
>+
> if((image=malloc(numpix*sizeof(uint32)+width*3))==NULL)
>   {
>   TIFFClose(in);
>diff -Nur ../xzgv-0.8/src/sizetmax.h ./src/sizetmax.h
>--- ../xzgv-0.8/src/sizetmax.h	1970-01-01 01:00:00.000000000 +0100
>+++ ./src/sizetmax.h	2004-11-03 18:11:55.000000000 +0100
>@@ -0,0 +1,8 @@
>+/* unfortunately, there is no ANSI-C constant that holds the size of
>+ * size_t. The only thing we know is that it is "the largest unsigned
>+ * integer type on the platform" (usually unsigned long int, but not
>+ * always, cf. 31-bit mode S/390.) At least we can rely on it being
>+ * unsigned, hence the following should always work.
>+ */ 
>+
>+#define SIZE_T_MAX (~((size_t) 0))

Actions: View | Diff

Attachments on bug 62677: 25476 | 25619 | 25749