diff options
author | Campbell Barton <ideasman42@gmail.com> | 2020-11-11 08:14:09 +0300 |
---|---|---|
committer | Campbell Barton <ideasman42@gmail.com> | 2020-11-11 08:14:09 +0300 |
commit | 15ffda3bcd697e6f3a0cc13e141da865f36f3b53 (patch) | |
tree | f98d9fc831f18a9194818f5428466884654e802b /source/blender/imbuf/intern/png.c | |
parent | 2d60845786aeab099c61ffa42b7f72cccc68bff1 (diff) |
Fix T82602: checking image header reads past buffer bounds
Use the size argument to ensure checking the header doesn't read
past the buffer bounds when reading corrupt/truncated headers
from image files.
Diffstat (limited to 'source/blender/imbuf/intern/png.c')
-rw-r--r-- | source/blender/imbuf/intern/png.c | 15 |
1 files changed, 9 insertions, 6 deletions
diff --git a/source/blender/imbuf/intern/png.c b/source/blender/imbuf/intern/png.c index a4ad839c513..25fc6a1cddf 100644 --- a/source/blender/imbuf/intern/png.c +++ b/source/blender/imbuf/intern/png.c @@ -59,18 +59,21 @@ BLI_INLINE unsigned short UPSAMPLE_8_TO_16(const unsigned char _val) return (_val << 8) + _val; } -bool imb_is_a_png(const unsigned char *mem, size_t UNUSED(size)) +bool imb_is_a_png(const unsigned char *mem, size_t size) { - bool ret_val = 0; + const int num_to_check = 8; + if (size < num_to_check) { + return false; + } + bool ok = false; #if (PNG_LIBPNG_VER_MAJOR == 1) && (PNG_LIBPNG_VER_MINOR == 2) /* Older version of libpng doesn't use const pointer to memory. */ - ret_val = !png_sig_cmp((png_bytep)mem, 0, 8); + ok = !png_sig_cmp((png_bytep)mem, 0, num_to_check); #else - ret_val = !png_sig_cmp(mem, 0, 8); + ok = !png_sig_cmp(mem, 0, num_to_check); #endif - - return ret_val; + return ok; } static void Flush(png_structp png_ptr) |