|
|
e5ac0ac |
diff -rupN --no-dereference Pillow-7.2.0/src/libImaging/SgiRleDecode.c Pillow-7.2.0-new/src/libImaging/SgiRleDecode.c
|
|
|
0647175 |
--- Pillow-7.2.0/src/libImaging/SgiRleDecode.c 2021-07-24 22:47:22.782180847 +0200
|
|
|
0647175 |
+++ Pillow-7.2.0-new/src/libImaging/SgiRleDecode.c 2021-07-24 22:47:23.606245817 +0200
|
|
|
e5ac0ac |
@@ -25,13 +25,58 @@ static void read4B(UINT32* dest, UINT8*
|
|
|
e5ac0ac |
*dest = (UINT32)((buf[0] << 24) | (buf[1] << 16) | (buf[2] << 8) | buf[3]);
|
|
|
e5ac0ac |
}
|
|
|
e5ac0ac |
|
|
|
e5ac0ac |
-static int expandrow(UINT8* dest, UINT8* src, int n, int z, int xsize)
|
|
|
e5ac0ac |
+/*
|
|
|
e5ac0ac |
+ SgiRleDecoding is done in a single channel row oriented set of RLE chunks.
|
|
|
e5ac0ac |
+
|
|
|
e5ac0ac |
+ * The file is arranged as
|
|
|
e5ac0ac |
+ - SGI Header
|
|
|
e5ac0ac |
+ - Rle Offset Table
|
|
|
e5ac0ac |
+ - Rle Length Table
|
|
|
e5ac0ac |
+ - Scanline Data
|
|
|
e5ac0ac |
+
|
|
|
e5ac0ac |
+ * Each RLE atom is c->bpc bytes wide (1 or 2)
|
|
|
e5ac0ac |
+
|
|
|
e5ac0ac |
+ * Each RLE Chunk is [specifier atom] [ 1 or n data atoms ]
|
|
|
e5ac0ac |
+
|
|
|
e5ac0ac |
+ * Copy Atoms are a byte with the high bit set, and the low 7 are
|
|
|
e5ac0ac |
+ the number of bytes to copy from the source to the
|
|
|
e5ac0ac |
+ destination. e.g.
|
|
|
e5ac0ac |
+
|
|
|
e5ac0ac |
+ CBBBBBBBB or 0CHLHLHLHLHLHL (B=byte, H/L = Hi low bytes)
|
|
|
e5ac0ac |
+
|
|
|
e5ac0ac |
+ * Run atoms do not have the high bit set, and the low 7 bits are
|
|
|
e5ac0ac |
+ the number of copies of the next atom to copy to the
|
|
|
e5ac0ac |
+ destination. e.g.:
|
|
|
e5ac0ac |
+
|
|
|
e5ac0ac |
+ RB -> BBBBB or RHL -> HLHLHLHLHL
|
|
|
e5ac0ac |
+
|
|
|
e5ac0ac |
+ The upshot of this is, there is no way to determine the required
|
|
|
e5ac0ac |
+ length of the input buffer from reloffset and rlelength without
|
|
|
e5ac0ac |
+ going through the data at that scan line.
|
|
|
e5ac0ac |
+
|
|
|
e5ac0ac |
+ Furthermore, there's no requirement that individual scan lines
|
|
|
e5ac0ac |
+ pointed to from the rleoffset table are in any sort of order or
|
|
|
e5ac0ac |
+ used only once, or even disjoint. There's also no requirement that
|
|
|
e5ac0ac |
+ all of the data in the scan line area of the image file be used
|
|
|
e5ac0ac |
+
|
|
|
e5ac0ac |
+*/
|
|
|
e5ac0ac |
+static int expandrow(UINT8* dest, UINT8* src, int n, int z, int xsize, UINT8 *end_of_buffer)
|
|
|
e5ac0ac |
{
|
|
|
e5ac0ac |
+ /*
|
|
|
e5ac0ac |
+ * n here is the number of rlechunks
|
|
|
e5ac0ac |
+ * z is the number of channels, for calculating the interleave
|
|
|
e5ac0ac |
+ * offset to go to RGBA style pixels
|
|
|
e5ac0ac |
+ * xsize is the row width
|
|
|
e5ac0ac |
+ * end_of_buffer is the address of the end of the input buffer
|
|
|
e5ac0ac |
+ */
|
|
|
e5ac0ac |
UINT8 pixel, count;
|
|
|
e5ac0ac |
int x = 0;
|
|
|
e5ac0ac |
|
|
|
e5ac0ac |
for (;n > 0; n--)
|
|
|
e5ac0ac |
{
|
|
|
e5ac0ac |
+ if (src > end_of_buffer) {
|
|
|
e5ac0ac |
+ return -1;
|
|
|
e5ac0ac |
+ }
|
|
|
e5ac0ac |
pixel = *src++;
|
|
|
e5ac0ac |
if (n == 1 && pixel != 0) {
|
|
|
e5ac0ac |
return n;
|
|
|
e5ac0ac |
@@ -45,6 +90,9 @@ static int expandrow(UINT8* dest, UINT8*
|
|
|
e5ac0ac |
}
|
|
|
e5ac0ac |
x += count;
|
|
|
e5ac0ac |
if (pixel & RLE_COPY_FLAG) {
|
|
|
e5ac0ac |
+ if (src + count > end_of_buffer) {
|
|
|
e5ac0ac |
+ return -1;
|
|
|
e5ac0ac |
+ }
|
|
|
e5ac0ac |
while(count--) {
|
|
|
e5ac0ac |
*dest = *src++;
|
|
|
e5ac0ac |
dest += z;
|
|
|
e5ac0ac |
@@ -52,6 +100,9 @@ static int expandrow(UINT8* dest, UINT8*
|
|
|
e5ac0ac |
|
|
|
e5ac0ac |
}
|
|
|
e5ac0ac |
else {
|
|
|
e5ac0ac |
+ if (src > end_of_buffer) {
|
|
|
e5ac0ac |
+ return -1;
|
|
|
e5ac0ac |
+ }
|
|
|
e5ac0ac |
pixel = *src++;
|
|
|
e5ac0ac |
while (count--) {
|
|
|
e5ac0ac |
*dest = pixel;
|
|
|
e5ac0ac |
@@ -63,7 +114,7 @@ static int expandrow(UINT8* dest, UINT8*
|
|
|
e5ac0ac |
return 0;
|
|
|
e5ac0ac |
}
|
|
|
e5ac0ac |
|
|
|
e5ac0ac |
-static int expandrow2(UINT8* dest, const UINT8* src, int n, int z, int xsize)
|
|
|
e5ac0ac |
+static int expandrow2(UINT8* dest, const UINT8* src, int n, int z, int xsize, UINT8 *end_of_buffer)
|
|
|
e5ac0ac |
{
|
|
|
e5ac0ac |
UINT8 pixel, count;
|
|
|
e5ac0ac |
|
|
|
e5ac0ac |
@@ -71,6 +122,9 @@ static int expandrow2(UINT8* dest, const
|
|
|
e5ac0ac |
|
|
|
e5ac0ac |
for (;n > 0; n--)
|
|
|
e5ac0ac |
{
|
|
|
e5ac0ac |
+ if (src + 1 > end_of_buffer) {
|
|
|
e5ac0ac |
+ return -1;
|
|
|
e5ac0ac |
+ }
|
|
|
e5ac0ac |
pixel = src[1];
|
|
|
e5ac0ac |
src+=2;
|
|
|
e5ac0ac |
if (n == 1 && pixel != 0) {
|
|
|
e5ac0ac |
@@ -85,6 +139,9 @@ static int expandrow2(UINT8* dest, const
|
|
|
e5ac0ac |
}
|
|
|
e5ac0ac |
x += count;
|
|
|
e5ac0ac |
if (pixel & RLE_COPY_FLAG) {
|
|
|
e5ac0ac |
+ if (src + 2 * count > end_of_buffer) {
|
|
|
e5ac0ac |
+ return -1;
|
|
|
e5ac0ac |
+ }
|
|
|
e5ac0ac |
while(count--) {
|
|
|
e5ac0ac |
memcpy(dest, src, 2);
|
|
|
e5ac0ac |
src += 2;
|
|
|
e5ac0ac |
@@ -92,6 +149,9 @@ static int expandrow2(UINT8* dest, const
|
|
|
e5ac0ac |
}
|
|
|
e5ac0ac |
}
|
|
|
e5ac0ac |
else {
|
|
|
e5ac0ac |
+ if (src + 2 > end_of_buffer) {
|
|
|
e5ac0ac |
+ return -1;
|
|
|
e5ac0ac |
+ }
|
|
|
e5ac0ac |
while (count--) {
|
|
|
e5ac0ac |
memcpy(dest, src, 2);
|
|
|
e5ac0ac |
dest += z * 2;
|
|
|
e5ac0ac |
@@ -141,7 +201,10 @@ ImagingSgiRleDecode(Imaging im, ImagingC
|
|
|
e5ac0ac |
return -1;
|
|
|
e5ac0ac |
}
|
|
|
e5ac0ac |
_imaging_seek_pyFd(state->fd, SGI_HEADER_SIZE, SEEK_SET);
|
|
|
e5ac0ac |
- _imaging_read_pyFd(state->fd, (char*)ptr, c->bufsize);
|
|
|
e5ac0ac |
+ if (_imaging_read_pyFd(state->fd, (char *)ptr, c->bufsize) != c->bufsize) {
|
|
|
e5ac0ac |
+ state->errcode = IMAGING_CODEC_UNKNOWN;
|
|
|
e5ac0ac |
+ return -1;
|
|
|
e5ac0ac |
+ }
|
|
|
e5ac0ac |
|
|
|
e5ac0ac |
|
|
|
e5ac0ac |
/* decoder initialization */
|
|
|
e5ac0ac |
@@ -175,8 +238,6 @@ ImagingSgiRleDecode(Imaging im, ImagingC
|
|
|
e5ac0ac |
read4B(&c->lengthtab[c->tabindex], &ptr[c->bufindex]);
|
|
|
e5ac0ac |
}
|
|
|
e5ac0ac |
|
|
|
e5ac0ac |
- state->count += c->tablen * sizeof(UINT32) * 2;
|
|
|
e5ac0ac |
-
|
|
|
e5ac0ac |
/* read compressed rows */
|
|
|
e5ac0ac |
for (c->rowno = 0; c->rowno < im->ysize; c->rowno++, state->y += state->ystep)
|
|
|
e5ac0ac |
{
|
|
|
e5ac0ac |
@@ -184,19 +245,21 @@ ImagingSgiRleDecode(Imaging im, ImagingC
|
|
|
e5ac0ac |
{
|
|
|
e5ac0ac |
c->rleoffset = c->starttab[c->rowno + c->channo * im->ysize];
|
|
|
e5ac0ac |
c->rlelength = c->lengthtab[c->rowno + c->channo * im->ysize];
|
|
|
e5ac0ac |
- c->rleoffset -= SGI_HEADER_SIZE;
|
|
|
e5ac0ac |
|
|
|
e5ac0ac |
- if (c->rleoffset + c->rlelength > c->bufsize) {
|
|
|
e5ac0ac |
+ // Check for underflow of rleoffset-SGI_HEADER_SIZE
|
|
|
e5ac0ac |
+ if (c->rleoffset < SGI_HEADER_SIZE) {
|
|
|
e5ac0ac |
state->errcode = IMAGING_CODEC_OVERRUN;
|
|
|
e5ac0ac |
goto sgi_finish_decode;
|
|
|
e5ac0ac |
}
|
|
|
e5ac0ac |
|
|
|
e5ac0ac |
+ c->rleoffset -= SGI_HEADER_SIZE;
|
|
|
e5ac0ac |
+
|
|
|
e5ac0ac |
/* row decompression */
|
|
|
e5ac0ac |
if (c->bpc ==1) {
|
|
|
e5ac0ac |
- status = expandrow(&state->buffer[c->channo], &ptr[c->rleoffset], c->rlelength, im->bands, im->xsize);
|
|
|
e5ac0ac |
+ status = expandrow(&state->buffer[c->channo], &ptr[c->rleoffset], c->rlelength, im->bands, im->xsize, &ptr[c->bufsize-1]);
|
|
|
e5ac0ac |
}
|
|
|
e5ac0ac |
else {
|
|
|
e5ac0ac |
- status = expandrow2(&state->buffer[c->channo * 2], &ptr[c->rleoffset], c->rlelength, im->bands, im->xsize);
|
|
|
e5ac0ac |
+ status = expandrow2(&state->buffer[c->channo * 2], &ptr[c->rleoffset], c->rlelength, im->bands, im->xsize, &ptr[c->bufsize-1]);
|
|
|
e5ac0ac |
}
|
|
|
e5ac0ac |
if (status == -1) {
|
|
|
e5ac0ac |
state->errcode = IMAGING_CODEC_OVERRUN;
|
|
|
e5ac0ac |
@@ -205,7 +268,6 @@ ImagingSgiRleDecode(Imaging im, ImagingC
|
|
|
e5ac0ac |
goto sgi_finish_decode;
|
|
|
e5ac0ac |
}
|
|
|
e5ac0ac |
|
|
|
e5ac0ac |
- state->count += c->rlelength;
|
|
|
e5ac0ac |
}
|
|
|
e5ac0ac |
|
|
|
e5ac0ac |
/* store decompressed data in image */
|
|
|
e5ac0ac |
@@ -213,7 +275,6 @@ ImagingSgiRleDecode(Imaging im, ImagingC
|
|
|
e5ac0ac |
|
|
|
e5ac0ac |
}
|
|
|
e5ac0ac |
|
|
|
e5ac0ac |
- c->bufsize++;
|
|
|
e5ac0ac |
|
|
|
e5ac0ac |
sgi_finish_decode: ;
|
|
|
e5ac0ac |
|
|
|
e5ac0ac |
@@ -224,5 +285,5 @@ sgi_finish_decode: ;
|
|
|
e5ac0ac |
state->errcode=err;
|
|
|
e5ac0ac |
return -1;
|
|
|
e5ac0ac |
}
|
|
|
e5ac0ac |
- return state->count - c->bufsize;
|
|
|
e5ac0ac |
+ return 0;
|
|
|
e5ac0ac |
}
|
|
|
e5ac0ac |
diff -rupN --no-dereference Pillow-7.2.0/Tests/test_sgi_crash.py Pillow-7.2.0-new/Tests/test_sgi_crash.py
|
|
|
0647175 |
--- Pillow-7.2.0/Tests/test_sgi_crash.py 2021-07-24 22:47:22.783180926 +0200
|
|
|
0647175 |
+++ Pillow-7.2.0-new/Tests/test_sgi_crash.py 2021-07-24 22:47:23.606245817 +0200
|
|
|
e5ac0ac |
@@ -10,6 +10,13 @@ from PIL import Image
|
|
|
e5ac0ac |
"Tests/images/sgi_crash.bin",
|
|
|
e5ac0ac |
"Tests/images/crash-6b7f2244da6d0ae297ee0754a424213444e92778.sgi",
|
|
|
e5ac0ac |
"Tests/images/ossfuzz-5730089102868480.sgi",
|
|
|
e5ac0ac |
+ "Tests/images/crash-754d9c7ec485ffb76a90eeaab191ef69a2a3a3cd.sgi",
|
|
|
e5ac0ac |
+ "Tests/images/crash-465703f71a0f0094873a3e0e82c9f798161171b8.sgi",
|
|
|
e5ac0ac |
+ "Tests/images/crash-64834657ee604b8797bf99eac6a194c124a9a8ba.sgi",
|
|
|
e5ac0ac |
+ "Tests/images/crash-abcf1c97b8fe42a6c68f1fb0b978530c98d57ced.sgi",
|
|
|
e5ac0ac |
+ "Tests/images/crash-b82e64d4f3f76d7465b6af535283029eda211259.sgi",
|
|
|
e5ac0ac |
+ "Tests/images/crash-c1b2595b8b0b92cc5f38b6635e98e3a119ade807.sgi",
|
|
|
e5ac0ac |
+ "Tests/images/crash-db8bfa78b19721225425530c5946217720d7df4e.sgi",
|
|
|
e5ac0ac |
],
|
|
|
e5ac0ac |
)
|
|
|
e5ac0ac |
def test_crashes(test_file):
|