Fixes for heap overflow#1077
Conversation
grlee77
left a comment
grlee77
left a comment
There was a problem hiding this comment.
I commented on an issue with hard-coded size limits that may be too restrictive in practice.
I also had a local agent review and it pointed out one remaining related issue:
High: J2K validation still does not validate component dimensions used by the SYCC converters.
cpp/plugins/cucim.kit.cuslide/src/cuslide/jpeg2k/libopenjpeg.cpp:231 validates output bytes from component 0 only. But cpp/plugins/
cucim.kit.cuslide/src/cuslide/jpeg2k/color_conversion.cpp:36 and cpp/plugins/cucim.kit.cuslide/src/cuslide/jpeg2k/color_conversion.cpp:122
read Cb/Cr based on component 0 geometry and subsampling assumptions. A malformed codestream with non-null but undersized chroma components
can still drive out-of-bounds reads. Add per-component dimension checks for RGB, 4:4:4, 4:2:2, and 4:2:0 before conversion.
cdinea
force-pushed
the
cd/code-audit-address
branch
from
6de1dda to
0892f3c
Compare
thank you for the feedback @grlee77 - addressed the agent review in the latest commit . Added per-component dimension validation in libopenjpeg.cpp that computes the minimum expected chroma size as ceil(luma_dim / subsampling_factor) using each component's dx/dy values, and rejects the image if any chroma plane is undersized |
|
/ok to test ccd27e8 |
|
/ok to test fd0aea1 |
|
/ok to test d4a8128 |
- Add checked_math.h utility with overflow-checked multiplication for buffer sizes - Fix tile_raster_size_nbytes() overflow in cuslide and cuslide2 - Fix IFD::read() raster size overflow and RGBA fallback path - Fix libjpeg_turbo.cpp tjAlloc buffer size overflow - Add dest_nbytes validation to JPEG2000 color conversion functions - Add bounds check on tile index access in read_region_tiles/read_region_tiles_boundary - Fix raw.cpp: validate source size before memcpy - Fix deflate.cpp: check libdeflate_zlib_decompress return value - Fix tiff.cpp: overflow-checked raster_size in read_associated_image
- Validate decoded J2K dimensions against dest buffer immediately after opj_decode - Add NULL check on all component data pointers before color conversion - Defense-in-depth: catches malformed codestreams before entering color conversion
…YTES, CUCIM_MAX_RASTER_BYTES)
…lidate pread return values
cdinea
force-pushed
the
cd/code-audit-address
branch
from
d4a8128 to
5441fdc
Compare
cdinea
changed the title
|
/ok to test 5441fdc |
jakirkham
left a comment
jakirkham
left a comment
There was a problem hiding this comment.
Thanks Cristiana for working on this! Also thanks Gigon and Greg for reviewing 🙏
|
/ok to test 5441fdc |
|
/merge |
4 participants
No description provided.