GNOME Bugzilla – Bug 604008
GBR, PAT: sanitize input data
Last modified: 2009-12-09 16:06:17 UTC
Created attachment 149278 [details] [review] Proposed fix: sanitize input data and use correct types in the GBR plugin Information contained in GBR and PAT files are used in their respective plugins without being sanitized frist, potentially allowing overflows. While g_malloc()/G_free() are immune against the value 0, calculating the amount of memory to allocate may again overflow the target type. Additionally, the plugins use the wrong types for such calculations (gssize instead of gsize in GBR, automatic type selection in PAT).
Created attachment 149279 [details] [review] Proposed fix: sanitize input data and use correct types in the PAT plugin
Created attachment 149281 [details] [review] Proposed fix: sanitize input data and use correct types in the PAT plugin Revised the above patch.
If adding sanitization to a plugin please do it the full way, i.e. - check for >0 *and* for <= GIMP_MAX_IMAGE_SIZE. - Do it for width *and* height, regardless of possibly misfiring calculations - then do the calculation checks. And then I don't get the reasoning in your revised patch. What is the reasoning behind the casts?
Created attachment 149342 [details] [review] Proposed fix: sanitize input data and use correct types in the GBR plugin (amended) Add checks for GIMP_MAX_IMAGE_SIZE as well as valid values of bh.bytes.
Created attachment 149352 [details] [review] Proposed fix: sanitize input data and use correct types in the PAT plugin (amended) Checks both width and height and against GIMP_MAX_IMAGE_SIZE. Doesn't unnecessarily cast allocation calculations (because GIMP_MAX_IMAGE_SIZE << GIMP_MAXUINT32), but adds explanatory comments.
Review of attachment 149352 [details] [review]: Looks good, please commit.
Review of attachment 149342 [details] [review]: looks good, please commit.
Review of attachment 149342 [details] [review]: committed: 869dcd7 GBR: sanitize input data b053021 GBR: more input data sanitation
Review of attachment 149352 [details] [review]: committed: 5aa82f3 PAT: sanitize input data