Gitweb links: ...log http://git.netsurf-browser.org/libnsbmp.git/shortlog/041df43bbe273b082913... ...commit http://git.netsurf-browser.org/libnsbmp.git/commit/041df43bbe273b0829132b... ...tree http://git.netsurf-browser.org/libnsbmp.git/tree/041df43bbe273b0829132b0b... The branch, master has been updated via 041df43bbe273b0829132b0b17d89a69da2927d4 (commit) via 49427b52ba41a1813e3822301612e2e170107efd (commit) via 52940fdee6ca54c556cc064974949ba18c30472f (commit) from efe7e0fa3c13e51ae987765e43ff882f49fc8a3e (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commitdiff http://git.netsurf-browser.org/libnsbmp.git/commit/?id=041df43bbe273b0829... commit 041df43bbe273b0829132b0b17d89a69da2927d4 Author: John-Mark Bell <jmb(a)netsurf-browser.org&gt; Commit: John-Mark Bell <jmb(a)netsurf-browser.org&gt; Range check colour table accesses. Issue-reported-by: Hans Jerry Illikainen diff --git a/src/libnsbmp.c b/src/libnsbmp.c index 64aed18..123ed9e 100644 --- a/src/libnsbmp.c +++ b/src/libnsbmp.c @@ -865,8 +865,12 @@ static bmp_result bmp_decode_rgb(bmp_image *bmp, uint8_t **start, int bytes) { bmp->decoded = true; /* Determine transparent index */ - if (bmp->limited_trans) - bmp->transparent_index = bmp->colour_table[(*data >> bit_shifts[0]) & bit_mask]; + if (bmp->limited_trans) { + uint32_t idx = (*data >> bit_shifts[0]) & bit_mask; + if (idx >= bmp->colours) + return BMP_DATA_ERROR; + bmp->transparent_index = bmp->colour_table[idx]; + } for (y = 0; y < bmp->height; y++) { while (addr != (((intptr_t)data) & 3)) @@ -879,11 +883,15 @@ static bmp_result bmp_decode_rgb(bmp_image *bmp, uint8_t **start, int bytes) { else scanline = (void *)(bottom - (y * swidth)); for (x = 0; x < bmp->width; x++) { + uint32_t idx; if (bit >= ppb) { bit = 0; cur_byte = *data++; } - scanline[x] = bmp->colour_table[(cur_byte >> bit_shifts[bit++]) & bit_mask]; + idx = (cur_byte >> bit_shifts[bit++]) & bit_mask; + if (idx >= bmp->colours) + return BMP_DATA_ERROR; + scanline[x] = bmp->colour_table[idx]; if ((bmp->limited_trans) && (scanline[x] == bmp->transparent_index)) scanline[x] = bmp->trans_colour; } @@ -1014,13 +1022,16 @@ static bmp_result bmp_decode_rle(bmp_image *bmp, uint8_t *data, int bytes, int s * routines if so */ if (size == 8) { for (i = 0; i < length; i++) { + uint32_t idx = (uint32_t) *data++; if (x >= bmp->width) { x = 0; if (++y > bmp->height) return BMP_DATA_ERROR; scanline -= bmp->width; } - scanline[x++] = bmp->colour_table[(int)*data++]; + if (idx >= bmp->colours) + return BMP_DATA_ERROR; + scanline[x++] = bmp->colour_table[idx]; } } else { for (i = 0; i < length; i++) { @@ -1032,9 +1043,13 @@ static bmp_result bmp_decode_rle(bmp_image *bmp, uint8_t *data, int bytes, int s } if ((i & 1) == 0) { pixel = *data++; + if ((pixel >> 4) >= bmp->colours) + return BMP_DATA_ERROR; scanline[x++] = bmp->colour_table [pixel >> 4]; } else { + if ((pixel & 0xf) >= bmp->colours) + return BMP_DATA_ERROR; scanline[x++] = bmp->colour_table [pixel & 0xf]; } @@ -1065,7 +1080,10 @@ static bmp_result bmp_decode_rle(bmp_image *bmp, uint8_t *data, int bytes, int s * checking the bounds on entry and using some simply copying * routines if so */ if (size == 8) { - pixel = bmp->colour_table[(int)*data++]; + uint32_t idx = (uint32_t) *data++; + if (idx >= bmp->colours) + return BMP_DATA_ERROR; + pixel = bmp->colour_table[idx]; for (i = 0; i < length; i++) { if (x >= bmp->width) { x = 0; @@ -1077,6 +1095,9 @@ static bmp_result bmp_decode_rle(bmp_image *bmp, uint8_t *data, int bytes, int s } } else { pixel2 = *data++; + if ((pixel2 >> 4) >= bmp->colours || + (pixel2 & 0xf) >= bmp->colours) + return BMP_DATA_ERROR; pixel = bmp->colour_table[pixel2 >> 4]; pixel2 = bmp->colour_table[pixel2 & 0xf]; for (i = 0; i < length; i++) { diff --git a/test/bmpsuite/coloob.bmp b/test/bmpsuite/coloob.bmp new file mode 100644 index 0000000..49214f7 Binary files /dev/null and b/test/bmpsuite/coloob.bmp differ commitdiff http://git.netsurf-browser.org/libnsbmp.git/commit/?id=49427b52ba41a1813e... commit 49427b52ba41a1813e3822301612e2e170107efd Author: John-Mark Bell <jmb(a)netsurf-browser.org&gt; Commit: John-Mark Bell <jmb(a)netsurf-browser.org&gt; Fix pixels_left calculation in RLE decoding. Additionally, improve input data range check for RLE4 absolute mode. Issue-reported-by: Hans Jerry Illikainen diff --git a/src/libnsbmp.c b/src/libnsbmp.c index d432aeb..64aed18 100644 --- a/src/libnsbmp.c +++ b/src/libnsbmp.c @@ -997,15 +997,16 @@ static bmp_result bmp_decode_rle(bmp_image *bmp, uint8_t *data, int bytes, int s } else { /* 00 - NN means escape NN pixels */ if (bmp->reversed) { - pixels_left = (y + 1) * bmp->width - x; + pixels_left = (bmp->height - y) * bmp->width - x; scanline = (void *)(top + (y * swidth)); } else { - pixels_left = (bmp->height - y + 1) * bmp->width - x; + pixels_left = (y + 1) * bmp->width - x; scanline = (void *)(bottom - (y * swidth)); } if (length > pixels_left) length = pixels_left; - if (data + length > end) + if ((size == 4 && data + ((length + 1) / 2) > end) || + (size == 8 && data + length > end)) return BMP_INSUFFICIENT_DATA; /* the following code could be easily optimised by simply @@ -1047,10 +1048,10 @@ static bmp_result bmp_decode_rle(bmp_image *bmp, uint8_t *data, int bytes, int s } else { /* NN means perform RLE for NN pixels */ if (bmp->reversed) { - pixels_left = (y + 1) * bmp->width - x; + pixels_left = (bmp->height - y) * bmp->width - x; scanline = (void *)(top + (y * swidth)); } else { - pixels_left = (bmp->height - y + 1) * bmp->width - x; + pixels_left = (y + 1) * bmp->width - x; scanline = (void *)(bottom - (y * swidth)); } if (length > pixels_left) diff --git a/test/bmpsuite/rleof.bmp b/test/bmpsuite/rleof.bmp new file mode 100644 index 0000000..05807f3 Binary files /dev/null and b/test/bmpsuite/rleof.bmp differ commitdiff http://git.netsurf-browser.org/libnsbmp.git/commit/?id=52940fdee6ca54c556... commit 52940fdee6ca54c556cc064974949ba18c30472f Author: John-Mark Bell <jmb(a)netsurf-browser.org&gt; Commit: John-Mark Bell <jmb(a)netsurf-browser.org&gt; Trivial spelling fix diff --git a/src/libnsbmp.c b/src/libnsbmp.c index 5d20d7c..d432aeb 100644 --- a/src/libnsbmp.c +++ b/src/libnsbmp.c @@ -470,7 +470,7 @@ static bmp_result bmp_analyse_header(bmp_image *bmp, uint8_t *data) { break; } /* Bitfield encoding means we have red, green, blue, and alpha masks. - * Here we aquire the masks and determine the required bit shift to + * Here we acquire the masks and determine the required bit shift to * align them in our 24-bit color 8-bit alpha format. */ if (bmp->encoding == BMP_ENCODING_BITFIELDS) { ----------------------------------------------------------------------- Summary of changes: src/libnsbmp.c | 44 +++++++++++++++++++++++++++++++++----------- test/bmpsuite/coloob.bmp | Bin 0 -> 126 bytes test/bmpsuite/rleof.bmp | Bin 0 -> 157 bytes 3 files changed, 33 insertions(+), 11 deletions(-) create mode 100644 test/bmpsuite/coloob.bmp create mode 100644 test/bmpsuite/rleof.bmp diff --git a/src/libnsbmp.c b/src/libnsbmp.c index 5d20d7c..123ed9e 100644 --- a/src/libnsbmp.c +++ b/src/libnsbmp.c @@ -470,7 +470,7 @@ static bmp_result bmp_analyse_header(bmp_image *bmp, uint8_t *data) { break; } /* Bitfield encoding means we have red, green, blue, and alpha masks. - * Here we aquire the masks and determine the required bit shift to + * Here we acquire the masks and determine the required bit shift to * align them in our 24-bit color 8-bit alpha format. */ if (bmp->encoding == BMP_ENCODING_BITFIELDS) { @@ -865,8 +865,12 @@ static bmp_result bmp_decode_rgb(bmp_image *bmp, uint8_t **start, int bytes) { bmp->decoded = true; /* Determine transparent index */ - if (bmp->limited_trans) - bmp->transparent_index = bmp->colour_table[(*data >> bit_shifts[0]) & bit_mask]; + if (bmp->limited_trans) { + uint32_t idx = (*data >> bit_shifts[0]) & bit_mask; + if (idx >= bmp->colours) + return BMP_DATA_ERROR; + bmp->transparent_index = bmp->colour_table[idx]; + } for (y = 0; y < bmp->height; y++) { while (addr != (((intptr_t)data) & 3)) @@ -879,11 +883,15 @@ static bmp_result bmp_decode_rgb(bmp_image *bmp, uint8_t **start, int bytes) { else scanline = (void *)(bottom - (y * swidth)); for (x = 0; x < bmp->width; x++) { + uint32_t idx; if (bit >= ppb) { bit = 0; cur_byte = *data++; } - scanline[x] = bmp->colour_table[(cur_byte >> bit_shifts[bit++]) & bit_mask]; + idx = (cur_byte >> bit_shifts[bit++]) & bit_mask; + if (idx >= bmp->colours) + return BMP_DATA_ERROR; + scanline[x] = bmp->colour_table[idx]; if ((bmp->limited_trans) && (scanline[x] == bmp->transparent_index)) scanline[x] = bmp->trans_colour; } @@ -997,15 +1005,16 @@ static bmp_result bmp_decode_rle(bmp_image *bmp, uint8_t *data, int bytes, int s } else { /* 00 - NN means escape NN pixels */ if (bmp->reversed) { - pixels_left = (y + 1) * bmp->width - x; + pixels_left = (bmp->height - y) * bmp->width - x; scanline = (void *)(top + (y * swidth)); } else { - pixels_left = (bmp->height - y + 1) * bmp->width - x; + pixels_left = (y + 1) * bmp->width - x; scanline = (void *)(bottom - (y * swidth)); } if (length > pixels_left) length = pixels_left; - if (data + length > end) + if ((size == 4 && data + ((length + 1) / 2) > end) || + (size == 8 && data + length > end)) return BMP_INSUFFICIENT_DATA; /* the following code could be easily optimised by simply @@ -1013,13 +1022,16 @@ static bmp_result bmp_decode_rle(bmp_image *bmp, uint8_t *data, int bytes, int s * routines if so */ if (size == 8) { for (i = 0; i < length; i++) { + uint32_t idx = (uint32_t) *data++; if (x >= bmp->width) { x = 0; if (++y > bmp->height) return BMP_DATA_ERROR; scanline -= bmp->width; } - scanline[x++] = bmp->colour_table[(int)*data++]; + if (idx >= bmp->colours) + return BMP_DATA_ERROR; + scanline[x++] = bmp->colour_table[idx]; } } else { for (i = 0; i < length; i++) { @@ -1031,9 +1043,13 @@ static bmp_result bmp_decode_rle(bmp_image *bmp, uint8_t *data, int bytes, int s } if ((i & 1) == 0) { pixel = *data++; + if ((pixel >> 4) >= bmp->colours) + return BMP_DATA_ERROR; scanline[x++] = bmp->colour_table [pixel >> 4]; } else { + if ((pixel & 0xf) >= bmp->colours) + return BMP_DATA_ERROR; scanline[x++] = bmp->colour_table [pixel & 0xf]; } @@ -1047,10 +1063,10 @@ static bmp_result bmp_decode_rle(bmp_image *bmp, uint8_t *data, int bytes, int s } else { /* NN means perform RLE for NN pixels */ if (bmp->reversed) { - pixels_left = (y + 1) * bmp->width - x; + pixels_left = (bmp->height - y) * bmp->width - x; scanline = (void *)(top + (y * swidth)); } else { - pixels_left = (bmp->height - y + 1) * bmp->width - x; + pixels_left = (y + 1) * bmp->width - x; scanline = (void *)(bottom - (y * swidth)); } if (length > pixels_left) @@ -1064,7 +1080,10 @@ static bmp_result bmp_decode_rle(bmp_image *bmp, uint8_t *data, int bytes, int s * checking the bounds on entry and using some simply copying * routines if so */ if (size == 8) { - pixel = bmp->colour_table[(int)*data++]; + uint32_t idx = (uint32_t) *data++; + if (idx >= bmp->colours) + return BMP_DATA_ERROR; + pixel = bmp->colour_table[idx]; for (i = 0; i < length; i++) { if (x >= bmp->width) { x = 0; @@ -1076,6 +1095,9 @@ static bmp_result bmp_decode_rle(bmp_image *bmp, uint8_t *data, int bytes, int s } } else { pixel2 = *data++; + if ((pixel2 >> 4) >= bmp->colours || + (pixel2 & 0xf) >= bmp->colours) + return BMP_DATA_ERROR; pixel = bmp->colour_table[pixel2 >> 4]; pixel2 = bmp->colour_table[pixel2 & 0xf]; for (i = 0; i < length; i++) { diff --git a/test/bmpsuite/coloob.bmp b/test/bmpsuite/coloob.bmp new file mode 100644 index 0000000..49214f7 Binary files /dev/null and b/test/bmpsuite/coloob.bmp differ diff --git a/test/bmpsuite/rleof.bmp b/test/bmpsuite/rleof.bmp new file mode 100644 index 0000000..05807f3 Binary files /dev/null and b/test/bmpsuite/rleof.bmp differ -- NetSurf BMP Decoder