114 lines
3.7 KiB
Diff
114 lines
3.7 KiB
Diff
From 00c071dd11f723ca608608eef45cb1aa98da89cc Mon Sep 17 00:00:00 2001
|
|
From: Benjamin Gilbert <bgilbert@backtick.net>
|
|
Date: Tue, 30 Apr 2024 07:26:54 -0500
|
|
Subject: [PATCH 1/3] ANI: Reject files with multiple anih chunks
|
|
|
|
An anih chunk causes us to initialize a bunch of state, which we only
|
|
expect to do once per file.
|
|
|
|
Fixes: #202
|
|
Fixes: CVE-2022-48622
|
|
---
|
|
gdk-pixbuf/io-ani.c | 9 +++++++++
|
|
1 file changed, 9 insertions(+)
|
|
|
|
diff --git a/gdk-pixbuf/io-ani.c b/gdk-pixbuf/io-ani.c
|
|
index c6c4642cf4..a78ea7ace4 100644
|
|
--- a/gdk-pixbuf/io-ani.c
|
|
+++ b/gdk-pixbuf/io-ani.c
|
|
@@ -295,6 +295,15 @@ ani_load_chunk (AniLoaderContext *context, GError **error)
|
|
|
|
if (context->chunk_id == TAG_anih)
|
|
{
|
|
+ if (context->animation)
|
|
+ {
|
|
+ g_set_error_literal (error,
|
|
+ GDK_PIXBUF_ERROR,
|
|
+ GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
|
|
+ _("Invalid header in animation"));
|
|
+ return FALSE;
|
|
+ }
|
|
+
|
|
context->HeaderSize = read_int32 (context);
|
|
context->NumFrames = read_int32 (context);
|
|
context->NumSteps = read_int32 (context);
|
|
--
|
|
GitLab
|
|
|
|
|
|
From d52134373594ff76614fb415125b0d1c723ddd56 Mon Sep 17 00:00:00 2001
|
|
From: Benjamin Gilbert <bgilbert@backtick.net>
|
|
Date: Tue, 30 Apr 2024 07:13:37 -0500
|
|
Subject: [PATCH 2/3] ANI: Reject files with multiple INAM or IART chunks
|
|
|
|
There should be at most one chunk each. These would cause memory leaks
|
|
otherwise.
|
|
---
|
|
gdk-pixbuf/io-ani.c | 4 ++--
|
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/gdk-pixbuf/io-ani.c b/gdk-pixbuf/io-ani.c
|
|
index a78ea7ace4..8e8414117c 100644
|
|
--- a/gdk-pixbuf/io-ani.c
|
|
+++ b/gdk-pixbuf/io-ani.c
|
|
@@ -445,7 +445,7 @@ ani_load_chunk (AniLoaderContext *context, GError **error)
|
|
}
|
|
else if (context->chunk_id == TAG_INAM)
|
|
{
|
|
- if (!context->animation)
|
|
+ if (!context->animation || context->title)
|
|
{
|
|
g_set_error_literal (error,
|
|
GDK_PIXBUF_ERROR,
|
|
@@ -472,7 +472,7 @@ ani_load_chunk (AniLoaderContext *context, GError **error)
|
|
}
|
|
else if (context->chunk_id == TAG_IART)
|
|
{
|
|
- if (!context->animation)
|
|
+ if (!context->animation || context->author)
|
|
{
|
|
g_set_error_literal (error,
|
|
GDK_PIXBUF_ERROR,
|
|
--
|
|
GitLab
|
|
|
|
|
|
From 91b8aa5cd8a0eea28acb51f0e121827ca2e7eb78 Mon Sep 17 00:00:00 2001
|
|
From: Benjamin Gilbert <bgilbert@backtick.net>
|
|
Date: Tue, 30 Apr 2024 08:17:25 -0500
|
|
Subject: [PATCH 3/3] ANI: Validate anih chunk size
|
|
|
|
Before reading a chunk, we verify that enough bytes are available to match
|
|
the chunk size declared by the file. However, uniquely, the anih chunk
|
|
loader doesn't verify that this size matches the number of bytes it
|
|
actually intends to read. Thus, if the chunk size is too small and the
|
|
file ends in the middle of the chunk, we populate some context fields with
|
|
stack garbage. (But we'd still fail later on because the file doesn't
|
|
contain any images.) Fix this.
|
|
---
|
|
gdk-pixbuf/io-ani.c | 8 ++++++++
|
|
1 file changed, 8 insertions(+)
|
|
|
|
diff --git a/gdk-pixbuf/io-ani.c b/gdk-pixbuf/io-ani.c
|
|
index 8e8414117c..cfafd7b196 100644
|
|
--- a/gdk-pixbuf/io-ani.c
|
|
+++ b/gdk-pixbuf/io-ani.c
|
|
@@ -295,6 +295,14 @@ ani_load_chunk (AniLoaderContext *context, GError **error)
|
|
|
|
if (context->chunk_id == TAG_anih)
|
|
{
|
|
+ if (context->chunk_size < 36)
|
|
+ {
|
|
+ g_set_error_literal (error,
|
|
+ GDK_PIXBUF_ERROR,
|
|
+ GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
|
|
+ _("Malformed chunk in animation"));
|
|
+ return FALSE;
|
|
+ }
|
|
if (context->animation)
|
|
{
|
|
g_set_error_literal (error,
|
|
--
|
|
GitLab
|
|
|