Bug #889

CRW: crashes when passed invalid data

Added by Alyssa Milburn over 4 years ago. Updated about 1 year ago.

Status:ClosedStart date:11 Mar 2013
Priority:NormalDue date:
Assignee:Robin Mills% Done:

100%

Category:image formatEstimated time:1.00 hour
Target version:0.26

Description

crwimage.cpp is missing some sanity checks, leading to crashes when trying to load malformed CRW files.

The offset sanity check in readDirectory on line 460 can be overflowed, leading to a crash on the next line on 64-bit machines.

The size and offset read in doRead on lines 423 and 424 aren't sanity-checked, leading to a crash in later code when passed invalid size/offset values.

Two testcases attached.

size-offset.crw (30 Bytes) Alyssa Milburn, 11 Mar 2013 07:38

bad-directory-offset.crw (18 Bytes) Alyssa Milburn, 11 Mar 2013 07:38

Associated revisions

Revision 4329
Added by Robin Mills about 1 year ago

#889. Fix submitted. Thanks to Alyssa for reporting this. Apologies for taking so long to investigate.

History

#1 Updated by Robin Mills over 4 years ago

  • Category set to exif
  • Status changed from New to Assigned
  • Assignee set to Robin Mills
  • Target version set to 0.24

Thanks, Alyssa. I'll take a look at this.

#2 Updated by Robin Mills almost 4 years ago

  • Target version changed from 0.24 to 0.25

Deferred to 0.25.

#3 Updated by Robin Mills about 2 years ago

  • Target version changed from 0.25 to 0.26

Deferred to v0.26. Insufficient time to deal with this for v0.25.

#4 Updated by Robin Mills about 2 years ago

  • Assignee deleted (Robin Mills)

#5 Updated by Robin Mills about 1 year ago

  • Category changed from exif to image format
  • Status changed from Assigned to Closed
  • Assignee set to Robin Mills
  • % Done changed from 0 to 100
  • Estimated time set to 1.00

Fix submitted: r4329. Thank You, Alyssa for reporting this. Apologies that it has taken so long to investigate this.

562 rmills@rmillsmbp:~/gnu/exiv2/trunk $ ls -alt ~/Downloads/*.crw
-rw-r--r--@ 1 rmills  staff  18 14 Jun 21:37 /Users/rmills/Downloads/bad-directory-offset.crw
-rw-r--r--@ 1 rmills  staff  30 14 Jun 21:17 /Users/rmills/Downloads/size-offset.crw
563 rmills@rmillsmbp:~/gnu/exiv2/trunk $ exiv2 ~/Downloads/*.crw
Exiv2 exception in print action for file /Users/rmills/Downloads/bad-directory-offset.crw:
This does not look like a CRW image
Exiv2 exception in print action for file /Users/rmills/Downloads/size-offset.crw:
Offset out of range
564 rmills@rmillsmbp:~/gnu/exiv2/trunk $ 

Also available in: Atom PDF

Redmine Appliance - Powered by TurnKey Linux