After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 604002 - SGI: RLE encoded input data may write beyond allocated buffers
SGI: RLE encoded input data may write beyond allocated buffers
Status: RESOLVED FIXED
Product: GIMP
Classification: Other
Component: Plugins
git master
Other Linux
: Normal major
: ---
Assigned To: GIMP Bugs
GIMP Bugs
Depends on:
Blocks:
 
 
Reported: 2009-12-07 17:07 UTC by Nils Philippsen
Modified: 2009-12-09 16:23 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
Proposed fix: ensure that RLE decoding doesn't access memory beyond allocated buffers (1.48 KB, patch)
2009-12-07 17:07 UTC, Nils Philippsen 		none Details | Review
Proposed fix: ensure that RLE decoding doesn't access memory beyond allocated buffers (amended) (910 bytes, patch)
2009-12-09 15:58 UTC, Nils Philippsen 		committed Details | Review
SGI image file exhibiting the RLE decoding error (84.07 KB, application/octet-stream)
2009-12-09 15:58 UTC, Nils Philippsen 		  Details

Description Nils Philippsen 2009-12-07 17:07:43 UTC 
Created attachment 149274 [details] [review]
Proposed fix: ensure that RLE decoding doesn't access memory beyond allocated buffers

The SGI file format allows data to be run-length encoded. When decoding such data and writing it to memory, the plugin doesn't ensure that it won't write beyond the end of allocated buffers.
Comment 1 Simon Budig 2009-12-09 15:02:30 UTC 
Review of attachment 149274 [details] [review]:

The fix looks good, although I absolutely dislike the additional
visual clutter in the already crowded for-loop.

What about using "count = MIN (ch & 127, xsize);" a few lines earlier
and avoiding the new condition in the loop?
Comment 2 Nils Philippsen 2009-12-09 15:58:07 UTC 
Created attachment 149441 [details] [review]
Proposed fix: ensure that RLE decoding doesn't access memory beyond allocated buffers (amended)

Rework the fix above as proposed by Simon.
Comment 3 Nils Philippsen 2009-12-09 15:58:44 UTC 
Created attachment 149442 [details]
SGI image file exhibiting the RLE decoding error
Comment 4 Nils Philippsen 2009-12-09 16:21:45 UTC 
Review of attachment 149441 [details] [review]:

committed:
4d9724f SGI: fix out of bounds writes