Two patch fix out of bounds.

Brought to you by: drolon, noescom

#161 Two patch fix out of bounds.

Status: open

Owner: nobody

Labels: None

Priority: 5

Updated: 2023-10-13

Created: 2023-10-13

Private: No

Here are two patches might help fix memory access out of bounds.

The mChunk buffer size is not checked before reading the mng image, add boundary check, avoid accessing illegal addresses.
Reproduce the error by FreeImage_Load(FIF_MNG, "./crash.mng");
Fix ReadColorTable() may access out-of-bounds. The maximum length of input pPal is 256, limit the number of colors allowed.
Reproduce the error by FreeImage_Load(FIF_PICT, "./crash.pict");

4 Attachments

1.mng-load-bounds-check.patch

crash.mng

crash.pict

Anonymous