yyc12345/stb
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add range checks to fix a few crash issues in stb_image issues 1289 and 1291

Browse Source
This commit is contained in:
Neil Bickford 2022-02-23 00:53:34 -08:00
parent 84b94010a7
commit 96fe76c213
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
stb_image.h
View File

@ -1985,9 +1985,12 @@ static int stbi__build_huffman(stbi__huffman *h, int *count)
int i,j,k=0; int i,j,k=0;
unsigned int code; unsigned int code;
// build size list for each symbol (from JPEG spec) // build size list for each symbol (from JPEG spec)
for (i=0; i < 16; ++i) for (i=0; i < 16; ++i) {
for (j=0; j < count[i]; ++j) for (j=0; j < count[i]; ++j) {
h->size[k++] = (stbi_uc) (i+1); h->size[k++] = (stbi_uc) (i+1);
if(k >= 257) return stbi__err("bad size list","Corrupt JPEG");
}
}
h->size[k] = 0; h->size[k] = 0;
// compute actual symbols (from jpeg spec) // compute actual symbols (from jpeg spec)
@ -2112,6 +2115,8 @@ stbi_inline static int stbi__jpeg_huff_decode(stbi__jpeg *j, stbi__huffman *h)
// convert the huffman code to the symbol id // convert the huffman code to the symbol id
c = ((j->code_buffer >> (32 - k)) & stbi__bmask[k]) + h->delta[k]; c = ((j->code_buffer >> (32 - k)) & stbi__bmask[k]) + h->delta[k];
if(c < 0 || c >= 256) // symbol id out of bounds!
return -1;
STBI_ASSERT((((j->code_buffer) >> (32 - h->size[c])) & stbi__bmask[h->size[c]]) == h->code[c]); STBI_ASSERT((((j->code_buffer) >> (32 - h->size[c])) & stbi__bmask[h->size[c]]) == h->code[c]);
// convert the id to a symbol // convert the id to a symbol
@ -3103,6 +3108,7 @@ static int stbi__process_marker(stbi__jpeg *z, int m)
sizes[i] = stbi__get8(z->s); sizes[i] = stbi__get8(z->s);
n += sizes[i]; n += sizes[i];
} }
if(n > 256) return stbi__err("bad DHT header","Corrupt JPEG"); // Loop over i < n would write past end of values!
L -= 17; L -= 17;
if (tc == 0) { if (tc == 0) {
if (!stbi__build_huffman(z->huff_dc+th, sizes)) return 0; if (!stbi__build_huffman(z->huff_dc+th, sizes)) return 0;