Bruce Leidl
3db0a6b032
poky: Upgrade to Yocto 4.1 Langdale meta-citadel/recipes-kernel: citadel-kernel 5.19.9 -> 6.0.8 meta-citadel/recipes-sway: sway 1.5.1 -> 1.7 (meta-wayland) wlroots 0.12.0 -> 0.15.1 (meta-wayland) meta-gnome/recipes-connectivity: iwd 1.27 -> 1.30 (meta-oe) modemmanager 1.18.2 -> 1.18.6 (meta-oe) networkmanager 1.36.2 -> 1.40.0 (meta-oe) meta-gnome/recipes-freedesktop: libgusb 0.3.7 -> 0.3.10 (meta-oe) meta-gnome/recipes-gnome: adwaita-icon-theme 42 -> 43 (oe-core) geocode-glib 3.26.2 -> 3.26.4 (meta-oe) gjs 1.72.0 -> 1.73.2 (meta-oe) gnome-bluetooth 42.0 -> 42.4 (meta-oe) gnome-control-center 42.1 -> 43.0 gnome-desktop 42.1 -> 43.rc gnome-settings-daemon 42.1 -> 43.0 gnome-shell 42.1 -> 43.0 gsettings-desktop-schema 41.0 -> 43.0 gtk4 4.6.4 -> 4.6.7 (meta-oe) gvfs 1.50.0 -> 1.50.2 (meta-oe) libadwaita 1.1.1 -> 1.2.0 (meta-oe) libgee 0.20.4 -> 0.20.6 (meta-oe) mutter 42.1 -> 43.0 rest 0.8.1 -> 0.9.0 (meta-oe) meta-gnome/recipes-support: ell 0.50 -> 0.53 (poky) exiv2 0.26 -> 0.27.3 (meta-oe) graphene 1.10.2 -> 1.10.8 (meta-oe) gsound 1.0.2 -> 1.0.3 (meta-oe) icu_71.1 (removed from meta-gnome because this version is in poky) jansson 2.12 -> 2.14 (meta-oe) lcms 2.9 -> 2.14 (meta-oe) libdvdread 6.1.1 -> 6.1.3 (meta-oe) libndp 1.6 -> 1.8 (meta-oe) mozjs 91.8.0 -> 102.3.0 power-profiles-daemon 0.12 (new-recipe)
121 lines
5.3 KiB
Diff
121 lines
5.3 KiB
Diff
From 783b3a6ff15ed6f82a8f8e6c8a6f3b84a9b04d4b Mon Sep 17 00:00:00 2001
|
|
From: Kevin Backhouse <kevinbackhouse@github.com>
|
|
Date: Mon, 19 Apr 2021 18:06:00 +0100
|
|
Subject: [PATCH] Improve bound checking in WebPImage::doWriteMetadata()
|
|
|
|
---
|
|
src/webpimage.cpp | 41 ++++++++++++++++++++++++++++++-----------
|
|
1 file changed, 30 insertions(+), 11 deletions(-)
|
|
|
|
diff --git a/src/webpimage.cpp b/src/webpimage.cpp
|
|
index 4ddec544c..fee110bca 100644
|
|
--- a/src/webpimage.cpp
|
|
+++ b/src/webpimage.cpp
|
|
@@ -145,7 +145,7 @@ namespace Exiv2 {
|
|
DataBuf chunkId(WEBP_TAG_SIZE+1);
|
|
chunkId.pData_ [WEBP_TAG_SIZE] = '\0';
|
|
|
|
- io_->read(data, WEBP_TAG_SIZE * 3);
|
|
+ readOrThrow(*io_, data, WEBP_TAG_SIZE * 3, Exiv2::kerCorruptedMetadata);
|
|
uint64_t filesize = Exiv2::getULong(data + WEBP_TAG_SIZE, littleEndian);
|
|
|
|
/* Set up header */
|
|
@@ -185,13 +185,20 @@ namespace Exiv2 {
|
|
case we have any exif or xmp data, also check
|
|
for any chunks with alpha frame/layer set */
|
|
while ( !io_->eof() && (uint64_t) io_->tell() < filesize) {
|
|
- io_->read(chunkId.pData_, WEBP_TAG_SIZE);
|
|
- io_->read(size_buff, WEBP_TAG_SIZE);
|
|
- long size = Exiv2::getULong(size_buff, littleEndian);
|
|
+ readOrThrow(*io_, chunkId.pData_, WEBP_TAG_SIZE, Exiv2::kerCorruptedMetadata);
|
|
+ readOrThrow(*io_, size_buff, WEBP_TAG_SIZE, Exiv2::kerCorruptedMetadata);
|
|
+ const uint32_t size_u32 = Exiv2::getULong(size_buff, littleEndian);
|
|
+
|
|
+ // Check that `size_u32` is safe to cast to `long`.
|
|
+ enforce(size_u32 <= static_cast<size_t>(std::numeric_limits<unsigned int>::max()),
|
|
+ Exiv2::kerCorruptedMetadata);
|
|
+ const long size = static_cast<long>(size_u32);
|
|
DataBuf payload(size);
|
|
- io_->read(payload.pData_, payload.size_);
|
|
- byte c;
|
|
- if ( payload.size_ % 2 ) io_->read(&c,1);
|
|
+ readOrThrow(*io_, payload.pData_, payload.size_, Exiv2::kerCorruptedMetadata);
|
|
+ if ( payload.size_ % 2 ) {
|
|
+ byte c;
|
|
+ readOrThrow(*io_, &c, 1, Exiv2::kerCorruptedMetadata);
|
|
+ }
|
|
|
|
/* Chunk with information about features
|
|
used in the file. */
|
|
@@ -199,6 +206,7 @@ namespace Exiv2 {
|
|
has_vp8x = true;
|
|
}
|
|
if (equalsWebPTag(chunkId, WEBP_CHUNK_HEADER_VP8X) && !has_size) {
|
|
+ enforce(size >= 10, Exiv2::kerCorruptedMetadata);
|
|
has_size = true;
|
|
byte size_buf[WEBP_TAG_SIZE];
|
|
|
|
@@ -227,6 +235,7 @@ namespace Exiv2 {
|
|
}
|
|
#endif
|
|
if (equalsWebPTag(chunkId, WEBP_CHUNK_HEADER_VP8) && !has_size) {
|
|
+ enforce(size >= 10, Exiv2::kerCorruptedMetadata);
|
|
has_size = true;
|
|
byte size_buf[2];
|
|
|
|
@@ -244,11 +253,13 @@ namespace Exiv2 {
|
|
|
|
/* Chunk with with lossless image data. */
|
|
if (equalsWebPTag(chunkId, WEBP_CHUNK_HEADER_VP8L) && !has_alpha) {
|
|
+ enforce(size >= 5, Exiv2::kerCorruptedMetadata);
|
|
if ((payload.pData_[4] & WEBP_VP8X_ALPHA_BIT) == WEBP_VP8X_ALPHA_BIT) {
|
|
has_alpha = true;
|
|
}
|
|
}
|
|
if (equalsWebPTag(chunkId, WEBP_CHUNK_HEADER_VP8L) && !has_size) {
|
|
+ enforce(size >= 5, Exiv2::kerCorruptedMetadata);
|
|
has_size = true;
|
|
byte size_buf_w[2];
|
|
byte size_buf_h[3];
|
|
@@ -276,11 +287,13 @@ namespace Exiv2 {
|
|
|
|
/* Chunk with animation frame. */
|
|
if (equalsWebPTag(chunkId, WEBP_CHUNK_HEADER_ANMF) && !has_alpha) {
|
|
+ enforce(size >= 6, Exiv2::kerCorruptedMetadata);
|
|
if ((payload.pData_[5] & 0x2) == 0x2) {
|
|
has_alpha = true;
|
|
}
|
|
}
|
|
if (equalsWebPTag(chunkId, WEBP_CHUNK_HEADER_ANMF) && !has_size) {
|
|
+ enforce(size >= 12, Exiv2::kerCorruptedMetadata);
|
|
has_size = true;
|
|
byte size_buf[WEBP_TAG_SIZE];
|
|
|
|
@@ -309,16 +322,22 @@ namespace Exiv2 {
|
|
|
|
io_->seek(12, BasicIo::beg);
|
|
while ( !io_->eof() && (uint64_t) io_->tell() < filesize) {
|
|
- io_->read(chunkId.pData_, 4);
|
|
- io_->read(size_buff, 4);
|
|
+ readOrThrow(*io_, chunkId.pData_, 4, Exiv2::kerCorruptedMetadata);
|
|
+ readOrThrow(*io_, size_buff, 4, Exiv2::kerCorruptedMetadata);
|
|
+
|
|
+ const uint32_t size_u32 = Exiv2::getULong(size_buff, littleEndian);
|
|
|
|
- long size = Exiv2::getULong(size_buff, littleEndian);
|
|
+ // Check that `size_u32` is safe to cast to `long`.
|
|
+ enforce(size_u32 <= static_cast<size_t>(std::numeric_limits<unsigned int>::max()),
|
|
+ Exiv2::kerCorruptedMetadata);
|
|
+ const long size = static_cast<long>(size_u32);
|
|
|
|
DataBuf payload(size);
|
|
- io_->read(payload.pData_, size);
|
|
+ readOrThrow(*io_, payload.pData_, size, Exiv2::kerCorruptedMetadata);
|
|
if ( io_->tell() % 2 ) io_->seek(+1,BasicIo::cur); // skip pad
|
|
|
|
if (equalsWebPTag(chunkId, WEBP_CHUNK_HEADER_VP8X)) {
|
|
+ enforce(size >= 1, Exiv2::kerCorruptedMetadata);
|
|
if (has_icc){
|
|
payload.pData_[0] |= WEBP_VP8X_ICC_BIT;
|
|
} else {
|