[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[GNUnet-SVN] [libextractor] 01/06: fix integer overflow in PNG plugin as
From: |
gnunet |
Subject: |
[GNUnet-SVN] [libextractor] 01/06: fix integer overflow in PNG plugin as reported by Leon Zhao on the mailinglist |
Date: |
Fri, 13 Oct 2017 12:37:41 +0200 |
This is an automated email from the git hooks/post-receive script.
grothoff pushed a commit to branch master
in repository libextractor.
commit f813535dad4ad860b989952a46266a1469801091
Author: Christian Grothoff <address@hidden>
AuthorDate: Fri Oct 13 12:16:46 2017 +0200
fix integer overflow in PNG plugin as reported by Leon Zhao on the
mailinglist
---
ChangeLog | 3 +++
src/include/extractor.h | 2 +-
src/plugins/png_extractor.c | 30 +++++++++++++++++-------------
3 files changed, 21 insertions(+), 14 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index fa69e6c4..ec2ebb21 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,6 @@
+Fri Oct 13 12:15:35 CEST 2017
+ Protect against integer overflows in PNG plugin found by Leon Zhao. -CG
+
Wed Oct 11 20:14:12 CEST 2017
Releasing GNU libextractor 1.5. -CG
diff --git a/src/include/extractor.h b/src/include/extractor.h
index 4bb1217f..fe0d1ce8 100644
--- a/src/include/extractor.h
+++ b/src/include/extractor.h
@@ -35,7 +35,7 @@ extern "C" {
* 0.2.6-1 => 0x00020601
* 4.5.2-0 => 0x04050200
*/
-#define EXTRACTOR_VERSION 0x01050000
+#define EXTRACTOR_VERSION 0x01050001
#include <stdio.h>
diff --git a/src/plugins/png_extractor.c b/src/plugins/png_extractor.c
index 6195d0ae..add1fde3 100644
--- a/src/plugins/png_extractor.c
+++ b/src/plugins/png_extractor.c
@@ -42,11 +42,13 @@
* @return n-bytes from str followed by 0-termination, NULL on error
*/
static char *
-stndup (const char *str,
+stndup (const char *str,
size_t n)
{
char *tmp;
+ if (n + 1 < n)
+ return NULL;
if (NULL == (tmp = malloc (n + 1)))
return NULL;
tmp[n] = '\0';
@@ -64,7 +66,7 @@ stndup (const char *str,
* @return first position of 0-terminator in str, or maxlen
*/
static size_t
-stnlen (const char *str,
+stnlen (const char *str,
size_t maxlen)
{
size_t ret;
@@ -171,7 +173,7 @@ processtEXt (struct EXTRACTOR_ExtractContext *ec,
if (off >= length)
return 0; /* failed to find '\0' */
if (NULL == (keyword = EXTRACTOR_common_convert_to_utf8 ((char*) &data[off],
- length - off,
+ length - off,
"ISO-8859-1")))
return 0;
ret = 0;
@@ -221,6 +223,8 @@ processiTXt (struct EXTRACTOR_ExtractContext *ec,
compressed = data[pos++];
if (compressed && (0 != data[pos++]))
return 0; /* bad compression method */
+ if (pos > length)
+ return 0;
language = (char *) &data[pos];
ret = 0;
if ( (stnlen (language, length - pos) > 0) &&
@@ -255,7 +259,7 @@ processiTXt (struct EXTRACTOR_ExtractContext *ec,
/* printf("out of memory"); */
return 0; /* out of memory */
}
- if (Z_OK ==
+ if (Z_OK ==
(zret = uncompress ((Bytef *) buf,
&bufLen,
(const Bytef *) &data[pos], length - pos)))
@@ -367,10 +371,10 @@ processzTXt (struct EXTRACTOR_ExtractContext *ec,
/* printf("out of memory"); */
return 0; /* out of memory */
}
- if (Z_OK ==
+ if (Z_OK ==
(zret = uncompress ((Bytef *) buf,
&bufLen,
- (const Bytef *) &data[off],
+ (const Bytef *) &data[off],
length - off)))
{
/* printf("zlib ok"); */
@@ -380,8 +384,8 @@ processzTXt (struct EXTRACTOR_ExtractContext *ec,
if (Z_BUF_ERROR != zret)
return 0; /* unknown error, abort */
}
- keyword = EXTRACTOR_common_convert_to_utf8 (buf,
- bufLen,
+ keyword = EXTRACTOR_common_convert_to_utf8 (buf,
+ bufLen,
"ISO-8859-1");
free (buf);
for (i = 0; NULL != tagmap[i].name; i++)
@@ -432,9 +436,9 @@ processtIME (struct EXTRACTOR_ExtractContext *ec,
h = (unsigned char) data[8];
m = (unsigned char) data[9];
s = (unsigned char) data[10];
- snprintf (val,
+ snprintf (val,
sizeof (val),
- "%04u-%02u-%02u %02d:%02d:%02d",
+ "%04u-%02u-%02u %02d:%02d:%02d",
year, mo, day, h, m, s);
ADD (EXTRACTOR_METATYPE_MODIFICATION_DATE, val);
FINISH:
@@ -443,7 +447,7 @@ FINISH:
/**
- * Main entry method for the 'image/png' extraction plugin.
+ * Main entry method for the 'image/png' extraction plugin.
*
* @param ec extraction context provided to the plugin
*/
@@ -465,8 +469,8 @@ EXTRACTOR_png_extract_method (struct
EXTRACTOR_ExtractContext *ec)
ret = 0;
while (0 == ret)
{
- if (sizeof (uint32_t) + 4 != ec->read (ec->cls,
- &data,
+ if (sizeof (uint32_t) + 4 != ec->read (ec->cls,
+ &data,
sizeof (uint32_t) + 4))
break;
length = get_int_at (data);
--
To stop receiving notification emails like this one, please contact
address@hidden
- [GNUnet-SVN] [libextractor] branch master updated (25da5822 -> 38e89335), gnunet, 2017/10/13
- [GNUnet-SVN] [libextractor] 01/06: fix integer overflow in PNG plugin as reported by Leon Zhao on the mailinglist,
gnunet <=
- [GNUnet-SVN] [libextractor] 04/06: modify gitignore, gnunet, 2017/10/13
- [GNUnet-SVN] [libextractor] 03/06: eliminate compiler warning, gnunet, 2017/10/13
- [GNUnet-SVN] [libextractor] 06/06: fix for NSF plugin's NPE reported by Leon Zhao, gnunet, 2017/10/13
- [GNUnet-SVN] [libextractor] 02/06: eliminate compiler warning, gnunet, 2017/10/13
- [GNUnet-SVN] [libextractor] 05/06: fix looping in nsfe extractor for problematic chunksize in input file, gnunet, 2017/10/13