[cups.bugs] [MOD] STR #2974: potential int overflow in cupsImageReadPNG()

ilja ilja at netric.org
Fri Oct 17 10:10:36 PDT 2008


hm, yea, that would probably work.

--------- Oorspronkelijk bericht --------
Van: Michael R Sweet <msweet at apple.com>
Naar: ilja <ilja at netric.org>, Mirror of cups.bugs Newsgroup
<cups-bugs at easysw.com>
Onderwerp: Re: [cups.bugs] [MOD] STR #2974: potential int overflow
in	_cupsImageReadPNG()
Datum: 17/10/08 21:01

> 
> ilja wrote:
> &gt; I don't think that's correct.
> &gt; 
> &gt;   if (width == 0 || width &gt; CUPS_IMAGE_MAX_WIDTH || &lt;-- this
one can be
> &gt; 2^27-1
> &gt;       height == 0 || height &gt; CUPS_IMAGE_MAX_HEIGHT)  &lt;-- this
one can be
> &gt; 2^31-1
> &gt;   {
> &gt;     fprintf(stderr, &quot;DEBUG: PNG image has invalid dimensions
%ux%u!n&quot;,
> &gt;             (unsigned)width, (unsigned)height);
> &gt;     fclose(fp);
> &gt;     return (1);
> &gt;   }
> &gt; ...
> &gt;   img-&gt;ysize = height;
> &gt; ...
> 
> OK, you're right.  Re-opening the bug...
> 
> The simple fix appears to be:
> 
>        if ((bufsize / (img-&gt;xsize * 3)) != img-&gt;ysize)
> 
> 
> &gt; --------- Oorspronkelijk bericht --------
> &gt; Van: cups-bugs at easysw.com
> &gt; Naar: ilja &lt;ilja at netric.org&gt;
> &gt; Cc: ilja &lt;ilja at netric.org&gt;, cups-bugs at easysw.com
> &gt; Onderwerp: Re: [MOD] STR #2974: potential int overflow in
> &gt; _cupsImageReadPNG()
> &gt; Datum: 17/10/08 08:55
> &gt; 
> &gt;&gt;
> &gt;&gt; [STR Closed w/o Resolution]
> &gt;&gt;
> &gt;&gt; The maximum dimensions of an image are 2^27-1, so it is
impossible for
> &gt;&gt; &amp;quot;img-&amp;gt;ysize * 3&amp;quot; to overflow a 32-bit
integer.  See the range
> &gt; checks prior
> &gt;&gt; to the buffer size check...
> &gt;&gt;
> &gt;&gt; Link: http://www.cups.org/str.php?L2974
> &gt;&gt; Version: 1.3.9
> &gt;&gt; Fix Version: None
> &gt;&gt;
> &gt;&gt;
> &gt; 
> &gt; 
> &gt; _______________________________________________
> &gt; cups-bugs mailing list
> &gt; cups-bugs at easysw.com
> &gt; http://lists.easysw.com/mailman/listinfo/cups-bugs
> 
> 
> -- 
> ______________________________________________________________________
> Michael R Sweet                        Senior Printing System Engineer
> 






More information about the cups-devel mailing list