Fix for #378 #379
Merged
Fix for #378 #379
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
piponazo
approved these changes
Jul 9, 2018
| @@ -517,6 +517,8 @@ namespace Exiv2 { | |||
| DataBuf payload(size); | |||
|
|
|||
| if (equalsWebPTag(chunkId, WEBP_CHUNK_HEADER_VP8X) && !has_canvas_data) { | |||
| enforce(size >= 10, Exiv2::kerCorruptedMetadata); | |||
There was a problem hiding this comment.
[question] From where all these hard-coded values (10, 5, 12) come? Could we infer those values from some existing enum types, structures, etc? Otherwise, some comments might be needed to understand the meaning of those values.
There was a problem hiding this comment.
I took a look at the following code and checked how large size must be at lest so that the memcpy calls don't read out of bounds. Unfortunately the values are simply inserted there as numbers. I can take a look whether we can give them meaningful names.
The size parameter is only checked for upper bounds, but not for lower. If it is too small, then created dataBuf will be too small and overflow in one of the subsequent memcpy() calls. This fixes Exiv2#378 / CVE-2018-14046
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The size parameter is only checked for upper bounds, but not for the lower bounds.
If it is too small, then created
dataBufwill be too small and overflow in one of the subsequentmemcpy()calls. Enforcing the size should fix this.