Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bufRead needs to be adjusted after seek() #1790

Merged
merged 7 commits into from
Jul 26, 2021
Merged

bufRead needs to be adjusted after seek() #1790

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
ed90f64
Regression test for https://github.com/Exiv2/exiv2/security/advisorie…
kevinbackhouse Jul 21, 2021
6eec038
bufRead needs to be adjusted after seek()
kevinbackhouse Jul 18, 2021
b3c63da
Improved handling of jpg segments to avoid out-of-bound reads.
kevinbackhouse Jul 21, 2021
52ecb13
Fix compiler warning.
kevinbackhouse Jul 21, 2021
147e6d3
Update src/jpgimage.cpp
kevinbackhouse Jul 25, 2021
2637af0
poc from GHSA-9jh3-fcc3-g6hv can now be parsed without error.
kevinbackhouse Jul 25, 2021
b5cbb47
Add comment to explain bounds-check.
kevinbackhouse Jul 25, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
576 changes: 281 additions & 295 deletions src/jpgimage.cpp
View file
Open in desktop

Large diffs are not rendered by default.

36 changes: 18 additions & 18 deletions test/data/icc-test.out
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ STRUCTURE OF JPEG FILE: Reagan.jpg
5722 | 0xffed APP13 | 3038 | Photoshop 3.0.8BIM..........Z...
8762 | 0xffe1 APP1 | 5329 | http://ns.adobe.com/xap/1.0/.<?x
14093 | 0xffe2 APP2 | 576 | ICC_PROFILE......0ADBE....mntrRG chunk 1/1
14671 | 0xffee APP14 | 14 | Adobe.d@......
14671 | 0xffee APP14 | 14 | Adobe.d@....
14687 | 0xffdb DQT | 132
14821 | 0xffc0 SOF0 | 17
14840 | 0xffdd DRI | 4
Expand All @@ -18,7 +18,7 @@ STRUCTURE OF JPEG FILE: Reagan.jpg
5708 | 0xffe1 APP1 | 5287 | http://ns.adobe.com/xap/1.0/.<?x
10997 | 0xffe2 APP2 | 576 | ICC_PROFILE......0ADBE....mntrRG chunk 1/1
11575 | 0xffed APP13 | 3030 | Photoshop 3.0.8BIM..........Z...
14607 | 0xffee APP14 | 14 | Adobe.d@......
14607 | 0xffee APP14 | 14 | Adobe.d@....
14623 | 0xffdb DQT | 132
14757 | 0xfffe COM | 10 | abcdefg
14769 | 0xffc0 SOF0 | 17
Expand All @@ -33,7 +33,7 @@ STRUCTURE OF JPEG FILE: Reagan.jpg
5708 | 0xffe1 APP1 | 5287 | http://ns.adobe.com/xap/1.0/.<?x
10997 | 0xffe2 APP2 | 576 | ICC_PROFILE......0ADBE....mntrRG chunk 1/1
11575 | 0xffed APP13 | 3030 | Photoshop 3.0.8BIM..........Z...
14607 | 0xffee APP14 | 14 | Adobe.d@......
14607 | 0xffee APP14 | 14 | Adobe.d@....
14623 | 0xffdb DQT | 132
14757 | 0xffc0 SOF0 | 17
14776 | 0xffdd DRI | 4
Expand Down Expand Up @@ -70,7 +70,7 @@ STRUCTURE OF JPEG FILE: Reagan.jpg
1517819 | 0xffe2 APP2 | 65512 | ICC_PROFILE....0.670.0.653.0.634 chunk 24/25
1583333 | 0xffe2 APP2 | 41712 | ICC_PROFILE...09.0.584.0.555.0.5 chunk 25/25
1625047 | 0xffed APP13 | 3030 | Photoshop 3.0.8BIM..........Z...
1628079 | 0xffee APP14 | 14 | Adobe.d@......
1628079 | 0xffee APP14 | 14 | Adobe.d@....
1628095 | 0xffdb DQT | 132
1628229 | 0xffc0 SOF0 | 17
1628248 | 0xffdd DRI | 4
Expand Down Expand Up @@ -107,7 +107,7 @@ STRUCTURE OF JPEG FILE: Reagan.jpg
1517819 | 0xffe2 APP2 | 65512 | ICC_PROFILE....0.670.0.653.0.634 chunk 24/25
1583333 | 0xffe2 APP2 | 41712 | ICC_PROFILE...09.0.584.0.555.0.5 chunk 25/25
1625047 | 0xffed APP13 | 3030 | Photoshop 3.0.8BIM..........Z...
1628079 | 0xffee APP14 | 14 | Adobe.d@......
1628079 | 0xffee APP14 | 14 | Adobe.d@....
1628095 | 0xffdb DQT | 132
1628229 | 0xfffe COM | 10 | abcdefg
1628241 | 0xffc0 SOF0 | 17
Expand Down Expand Up @@ -146,7 +146,7 @@ STRUCTURE OF JPEG FILE: Reagan.jpg
1517819 | 0xffe2 APP2 | 65512 | ICC_PROFILE....0.670.0.653.0.634 chunk 24/25
1583333 | 0xffe2 APP2 | 41712 | ICC_PROFILE...09.0.584.0.555.0.5 chunk 25/25
1625047 | 0xffed APP13 | 3030 | Photoshop 3.0.8BIM..........Z...
1628079 | 0xffee APP14 | 14 | Adobe.d@......
1628079 | 0xffee APP14 | 14 | Adobe.d@....
1628095 | 0xffdb DQT | 132
1628229 | 0xffc0 SOF0 | 17
1628248 | 0xffdd DRI | 4
Expand All @@ -159,7 +159,7 @@ STRUCTURE OF JPEG FILE: Reagan.jpg
5708 | 0xffe1 APP1 | 5287 | http://ns.adobe.com/xap/1.0/.<?x
10997 | 0xffe2 APP2 | 576 | ICC_PROFILE......0ADBE....mntrRG chunk 1/1
11575 | 0xffed APP13 | 3030 | Photoshop 3.0.8BIM..........Z...
14607 | 0xffee APP14 | 14 | Adobe.d@......
14607 | 0xffee APP14 | 14 | Adobe.d@....
14623 | 0xffdb DQT | 132
14757 | 0xffc0 SOF0 | 17
14776 | 0xffdd DRI | 4
Expand All @@ -172,7 +172,7 @@ STRUCTURE OF JPEG FILE: Reagan.jpg
5708 | 0xffe1 APP1 | 5287 | http://ns.adobe.com/xap/1.0/.<?x
10997 | 0xffe2 APP2 | 576 | ICC_PROFILE......0ADBE....mntrRG chunk 1/1
11575 | 0xffed APP13 | 3030 | Photoshop 3.0.8BIM..........Z...
14607 | 0xffee APP14 | 14 | Adobe.d@......
14607 | 0xffee APP14 | 14 | Adobe.d@....
14623 | 0xffdb DQT | 132
14757 | 0xfffe COM | 10 | abcdefg
14769 | 0xffc0 SOF0 | 17
Expand All @@ -187,7 +187,7 @@ STRUCTURE OF JPEG FILE: Reagan.jpg
5708 | 0xffe1 APP1 | 5287 | http://ns.adobe.com/xap/1.0/.<?x
10997 | 0xffe2 APP2 | 576 | ICC_PROFILE......0ADBE....mntrRG chunk 1/1
11575 | 0xffed APP13 | 3030 | Photoshop 3.0.8BIM..........Z...
14607 | 0xffee APP14 | 14 | Adobe.d@......
14607 | 0xffee APP14 | 14 | Adobe.d@....
14623 | 0xffdb DQT | 132
14757 | 0xffc0 SOF0 | 17
14776 | 0xffdd DRI | 4
Expand Down Expand Up @@ -463,7 +463,7 @@ STRUCTURE OF PNG FILE: ReaganLargePng.png
STRUCTURE OF JPEG FILE: ReaganLargeJpg.jpg
address | marker | length | data
0 | 0xffd8 SOI
2 | 0xffe0 APP0 | 16 | JFIF.....,.,....
2 | 0xffe0 APP0 | 16 | JFIF.....,.,.
20 | 0xffe1 APP1 | 4073 | Exif..MM.*......................
4095 | 0xffe1 APP1 | 6191 | http://ns.adobe.com/xap/1.0/.<?x
10288 | 0xffe2 APP2 | 65535 | ICC_PROFILE...... APPL....prtrRG chunk 1/25
Expand Down Expand Up @@ -504,7 +504,7 @@ Warning: Failed to decode XMP metadata.
STRUCTURE OF JPEG FILE: ReaganLargeJpg.jpg
address | marker | length | data
0 | 0xffd8 SOI
2 | 0xffe0 APP0 | 16 | JFIF.....,.,....
2 | 0xffe0 APP0 | 16 | JFIF.....,.,.
20 | 0xffe1 APP1 | 4073 | Exif..MM.*......................
4095 | 0xffe2 APP2 | 65512 | ICC_PROFILE...... APPL....prtrRG chunk 1/25
69609 | 0xffe2 APP2 | 65512 | ICC_PROFILE...X..Ih.V...j.U..4mV chunk 2/25
Expand Down Expand Up @@ -542,7 +542,7 @@ abcdefg
STRUCTURE OF JPEG FILE: ReaganLargeJpg.jpg
address | marker | length | data
0 | 0xffd8 SOI
2 | 0xffe0 APP0 | 16 | JFIF.....,.,....
2 | 0xffe0 APP0 | 16 | JFIF.....,.,.
20 | 0xffe1 APP1 | 4073 | Exif..MM.*......................
4095 | 0xffe2 APP2 | 65512 | ICC_PROFILE...... APPL....prtrRG chunk 1/25
69609 | 0xffe2 APP2 | 65512 | ICC_PROFILE...X..Ih.V...j.U..4mV chunk 2/25
Expand Down Expand Up @@ -578,7 +578,7 @@ STRUCTURE OF JPEG FILE: ReaganLargeJpg.jpg
STRUCTURE OF JPEG FILE: ReaganLargeJpg.jpg
address | marker | length | data
0 | 0xffd8 SOI
2 | 0xffe0 APP0 | 16 | JFIF.....,.,....
2 | 0xffe0 APP0 | 16 | JFIF.....,.,.
20 | 0xffe1 APP1 | 4073 | Exif..MM.*......................
4095 | 0xffe2 APP2 | 65512 | ICC_PROFILE...... APPL....prtrRG chunk 1/25
69609 | 0xffe2 APP2 | 65512 | ICC_PROFILE...X..Ih.V...j.U..4mV chunk 2/25
Expand Down Expand Up @@ -614,7 +614,7 @@ STRUCTURE OF JPEG FILE: ReaganLargeJpg.jpg
STRUCTURE OF JPEG FILE: ReaganLargeJpg.jpg
address | marker | length | data
0 | 0xffd8 SOI
2 | 0xffe0 APP0 | 16 | JFIF.....,.,....
2 | 0xffe0 APP0 | 16 | JFIF.....,.,.
20 | 0xffe1 APP1 | 4073 | Exif..MM.*......................
4095 | 0xffe2 APP2 | 65512 | ICC_PROFILE...... APPL....prtrRG chunk 1/25
69609 | 0xffe2 APP2 | 65512 | ICC_PROFILE...X..Ih.V...j.U..4mV chunk 2/25
Expand Down Expand Up @@ -652,7 +652,7 @@ abcdefg
STRUCTURE OF JPEG FILE: ReaganLargeJpg.jpg
address | marker | length | data
0 | 0xffd8 SOI
2 | 0xffe0 APP0 | 16 | JFIF.....,.,....
2 | 0xffe0 APP0 | 16 | JFIF.....,.,.
20 | 0xffe1 APP1 | 4073 | Exif..MM.*......................
4095 | 0xffe2 APP2 | 65512 | ICC_PROFILE...... APPL....prtrRG chunk 1/25
69609 | 0xffe2 APP2 | 65512 | ICC_PROFILE...X..Ih.V...j.U..4mV chunk 2/25
Expand Down Expand Up @@ -688,7 +688,7 @@ STRUCTURE OF JPEG FILE: ReaganLargeJpg.jpg
STRUCTURE OF JPEG FILE: ReaganLargeJpg.jpg
address | marker | length | data
0 | 0xffd8 SOI
2 | 0xffe0 APP0 | 16 | JFIF.....,.,....
2 | 0xffe0 APP0 | 16 | JFIF.....,.,.
20 | 0xffe1 APP1 | 4073 | Exif..MM.*......................
4095 | 0xffe2 APP2 | 576 | ICC_PROFILE......0ADBE....mntrRG chunk 1/1
4673 | 0xffdb DQT | 67
Expand All @@ -700,7 +700,7 @@ STRUCTURE OF JPEG FILE: ReaganLargeJpg.jpg
STRUCTURE OF JPEG FILE: ReaganLargeJpg.jpg
address | marker | length | data
0 | 0xffd8 SOI
2 | 0xffe0 APP0 | 16 | JFIF.....,.,....
2 | 0xffe0 APP0 | 16 | JFIF.....,.,.
20 | 0xffe1 APP1 | 4073 | Exif..MM.*......................
4095 | 0xffe2 APP2 | 576 | ICC_PROFILE......0ADBE....mntrRG chunk 1/1
4673 | 0xffdb DQT | 67
Expand All @@ -714,7 +714,7 @@ abcdefg
STRUCTURE OF JPEG FILE: ReaganLargeJpg.jpg
address | marker | length | data
0 | 0xffd8 SOI
2 | 0xffe0 APP0 | 16 | JFIF.....,.,....
2 | 0xffe0 APP0 | 16 | JFIF.....,.,.
20 | 0xffe1 APP1 | 4073 | Exif..MM.*......................
4095 | 0xffe2 APP2 | 576 | ICC_PROFILE......0ADBE....mntrRG chunk 1/1
4673 | 0xffdb DQT | 67
Expand Down
Binary file added test/data/issue_ghsa_mvc4_g5pv_4qqq_poc.jpg
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
8 changes: 2 additions & 6 deletions tests/bugfixes/github/test_issue_ghsa_9jh3_fcc3_g6hv.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,9 +13,5 @@ class JpegBasePrintStructureInfiniteLoop(metaclass=CaseMeta):
filename = path("$tmp_path/issue_ghsa_9jh3_fcc3_g6hv_poc.jpg")
commands = ["$exiv2 -d I rm $filename"]
stdout = [""]
stderr = [
"""Warning: JPEG format error, rc = 2
Exiv2 exception in erase action for file $filename:
$kerFailedToReadImageData
"""]
retval = [1]
stderr = [""]
retval = [0]
20 changes: 20 additions & 0 deletions tests/bugfixes/github/test_issue_ghsa_mvc4_g5pv_4qqq.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
# -*- coding: utf-8 -*-

from system_tests import CaseMeta, CopyTmpFiles, path
@CopyTmpFiles("$data_path/issue_ghsa_mvc4_g5pv_4qqq_poc.jpg")

class JpegBasePrintStructureInfiniteLoop(metaclass=CaseMeta):
"""
Regression test for the bug described in:
https://github.com/Exiv2/exiv2/security/advisories/GHSA-mvc4-g5pv-4qqq
"""
url = "https://github.com/Exiv2/exiv2/security/advisories/GHSA-mvc4-g5pv-4qqq"

filename = path("$tmp_path/issue_ghsa_mvc4_g5pv_4qqq_poc.jpg")
commands = ["$exiv2 -d I rm $filename"]
stdout = [""]
stderr = [
"""Exiv2 exception in erase action for file $filename:
$kerFailedToReadImageData
"""]
retval = [1]
2 changes: 1 addition & 1 deletion tests/bugfixes/redmine/test_issue_1247.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ class NotValidIccProfile(metaclass=system_tests.CaseMeta):
stdout = [""]

stderr = [ """Exiv2 exception in print action for file $filename:
Not a valid ICC Profile
$kerFailedToReadImageData
"""
]

Expand Down