mirrors/stb
1
0
Fork 0
mirror of https://github.com/nothings/stb synced 2024-12-15 04:22:35 +03:00
Code Issues Packages Projects Releases Wiki Activity

stb_image: More input validation in deflate decoder

Browse Source 
Fixes issue #312.
This commit is contained in:
Fabian Giesen 2016-08-12 13:44:11 -07:00
parent 2f4166e91d
commit 8c8d735eb7
1 changed files with 17 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
stb_image.h
View File

@ -3721,6 +3721,7 @@ static int stbi__compute_huffman_codes(stbi__zbuf *a)
int hlit = stbi__zreceive(a,5) + 257; int hlit = stbi__zreceive(a,5) + 257;
int hdist = stbi__zreceive(a,5) + 1; int hdist = stbi__zreceive(a,5) + 1;
int hclen = stbi__zreceive(a,4) + 4; int hclen = stbi__zreceive(a,4) + 4;
int ntot = hlit + hdist;
memset(codelength_sizes, 0, sizeof(codelength_sizes)); memset(codelength_sizes, 0, sizeof(codelength_sizes));
for (i=0; i < hclen; ++i) { for (i=0; i < hclen; ++i) {
@ -3730,27 +3731,29 @@ static int stbi__compute_huffman_codes(stbi__zbuf *a)
if (!stbi__zbuild_huffman(&z_codelength, codelength_sizes, 19)) return 0; if (!stbi__zbuild_huffman(&z_codelength, codelength_sizes, 19)) return 0;
n = 0; n = 0;
while (n < hlit + hdist) { while (n < ntot) {
int c = stbi__zhuffman_decode(a, &z_codelength); int c = stbi__zhuffman_decode(a, &z_codelength);
if (c < 0 || c >= 19) return stbi__err("bad codelengths", "Corrupt PNG"); if (c < 0 || c >= 19) return stbi__err("bad codelengths", "Corrupt PNG");
if (c < 16) if (c < 16)
lencodes[n++] = (stbi_uc) c; lencodes[n++] = (stbi_uc) c;
else if (c == 16) { else {
c = stbi__zreceive(a,2)+3; stbi_uc fill = 0;
memset(lencodes+n, lencodes[n-1], c); if (c == 16) {
n += c; c = stbi__zreceive(a,2)+3;
} else if (c == 17) { if (n == 0) return stbi__err("bad codelengths", "Corrupt PNG");
c = stbi__zreceive(a,3)+3; fill = lencodes[n-1];
memset(lencodes+n, 0, c); } else if (c == 17)
n += c; c = stbi__zreceive(a,3)+3;
} else { else {
STBI_ASSERT(c == 18); STBI_ASSERT(c == 18);
c = stbi__zreceive(a,7)+11; c = stbi__zreceive(a,7)+11;
memset(lencodes+n, 0, c); }
if (ntot - n < c) return stbi__err("bad codelengths", "Corrupt PNG");
memset(lencodes+n, fill, c);
n += c; n += c;
} }
} }
if (n != hlit+hdist) return stbi__err("bad codelengths","Corrupt PNG"); if (n != ntot) return stbi__err("bad codelengths","Corrupt PNG");
if (!stbi__zbuild_huffman(&a->z_length, lencodes, hlit)) return 0; if (!stbi__zbuild_huffman(&a->z_length, lencodes, hlit)) return 0;
if (!stbi__zbuild_huffman(&a->z_distance, lencodes+hlit, hdist)) return 0; if (!stbi__zbuild_huffman(&a->z_distance, lencodes+hlit, hdist)) return 0;
return 1; return 1;