GNOME Bugzilla – Bug 779020
Infinite loop in io-tiff.c with large size
Last modified: 2017-12-05 12:24:54 UTC
The bug is in the function make_available_at_least (line 499). See the following lines: if (need_alloc > context->allocated) { guint new_size = 1; while (new_size < need_alloc) new_size *= 2; ... new_size starts with 1 and multiplies until it is larger or equal to need_alloc. If need_alloc is larger than 2^31, new_size will become 2^31 and multiply itself in 2, and become 0. This would lead to an infinite loop.
Created attachment 350204 [details] [review] fix for the infinite loop issue Hi Ariel, I have created the fix patch to resolve the infinite loop issue in io-tiff. Please kindly review and suggest your comments. Thanks, Thiruvadi rajaraman
Created attachment 365013 [details] [review] tiff: Avoid overflowing buffer size computation Use g_uint_checked_mul() to avoid overflowing the guint used for buffer size calculation.
Attachment 365013 [details] pushed as 1e513ab - tiff: Avoid overflowing buffer size computation
Hi Bastien, Following is the vulnerable hunk causes the infinite loop issue, from io-tiff.c file, while (new_size < need_alloc) new_size *= 2; Test application: ( similar like above condition in io-tiff.c) ----------------- #include <stdio.h> #include <limits.h> int main() { unsigned int x, y; y=UINT_MAX; x=( (UINT_MAX/2) +1); printf("\n x= %ld", x); printf("\n y= %ld", y); /* Resolve infinite loop issue .... */ /* --- while(x && (x<y) ) { ----*/ while( x<y) { x*=2; printf(" x = %ld", x); }; return 0; } logs: ===== x = 0 x = 0 x = 0 x = 0 x = 0 This condition causes the infinite tight loop. From the attached fix in comment#1, while (new_size && (new_size < need_alloc)) resolves this infinite loop issue. Please correct me if my understanding above the issue is wrong and the fix which i attached in comment#1 is not resolving the infinite loop problem. Please kindly review and suggest comments. Thanks, Thiruvadi Rajaraman
(In reply to Thiruvadi Rajaraman from comment #4) > Hi Bastien, > > Following is the vulnerable hunk causes the infinite loop issue, > > from io-tiff.c file, > > while (new_size < need_alloc) > new_size *= 2; <snip> > Please correct me if my understanding above the issue is wrong and the fix > which i attached in comment#1 is not resolving the infinite loop problem. Which is why we didn't use it. The one in comment 2 is what we used.