Fix integer overflow resulting in insufficient heap allocation

IMAGE_DIMENSIONS_OK ensures that image width and height are less then
46340, so that maximum number of pixels is ~2**31.

Unfortunately, there are a lot of code that allocates image data with
something like

   malloc(w * h * sizeof(DATA32));

Obviously, on 32-bit machines this results in integer overflow,
insufficient heap allocation, with [massive] out-of-bounds heap
overwrite.
Either X_MAX should be reduced to 32767, or (w)*(h) should be checked to
not exceed ULONG_MAX/sizeof(DATA32).

Security implications:
*) for 32-bit machines: insufficient heap allocation and heap overwrite
in many image loaders, with escalation potential to remote code
execution;
*) for 64-bit machines: it seems, no impact.
This commit is contained in:
Yuriy M. Kaminskiy 2016-04-06 03:34:01 +03:00 committed by Kim Woelders
parent c94d83ccab
commit 7eba2e4c8a
1 changed files with 2 additions and 1 deletions

View File

@ -188,7 +188,8 @@ void __imlib_SaveImage(ImlibImage * im, const char *file,
/* The maximum pixmap dimension is 65535. */
/* However, for now, use 46340 (46340^2 < 2^31) to avoid buffer overflow issues. */
#define X_MAX_DIM 46340
/* Reduced further to 32767, so that (w * h * sizeof(DATA32)) won't exceed ULONG_MAX */
#define X_MAX_DIM 32767
#define IMAGE_DIMENSIONS_OK(w, h) \
( ((w) > 0) && ((h) > 0) && ((w) < X_MAX_DIM) && ((h) < X_MAX_DIM) )