forked from old/legacy-imlib2
Fix integer overflow resulting in insufficient heap allocation
IMAGE_DIMENSIONS_OK ensures that image width and height are less then 46340, so that maximum number of pixels is ~2**31. Unfortunately, there are a lot of code that allocates image data with something like malloc(w * h * sizeof(DATA32)); Obviously, on 32-bit machines this results in integer overflow, insufficient heap allocation, with [massive] out-of-bounds heap overwrite. Either X_MAX should be reduced to 32767, or (w)*(h) should be checked to not exceed ULONG_MAX/sizeof(DATA32). Security implications: *) for 32-bit machines: insufficient heap allocation and heap overwrite in many image loaders, with escalation potential to remote code execution; *) for 64-bit machines: it seems, no impact.
This commit is contained in:
parent
c94d83ccab
commit
7eba2e4c8a
|
@ -188,7 +188,8 @@ void __imlib_SaveImage(ImlibImage * im, const char *file,
|
|||
|
||||
/* The maximum pixmap dimension is 65535. */
|
||||
/* However, for now, use 46340 (46340^2 < 2^31) to avoid buffer overflow issues. */
|
||||
#define X_MAX_DIM 46340
|
||||
/* Reduced further to 32767, so that (w * h * sizeof(DATA32)) won't exceed ULONG_MAX */
|
||||
#define X_MAX_DIM 32767
|
||||
|
||||
#define IMAGE_DIMENSIONS_OK(w, h) \
|
||||
( ((w) > 0) && ((h) > 0) && ((w) < X_MAX_DIM) && ((h) < X_MAX_DIM) )
|
||||
|
|
Loading…
Reference in New Issue