Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Buffer overflow extracting the thumbnail of certain RAW photos - Fixes #3 #4

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

diegocr
Copy link
Contributor

@diegocr diegocr commented Apr 25, 2020

Ideally the DNG parser should be fixed, but meanwhile and as a safety measure we shall ensure such buffer overflow does not happens in general...

…ImageMagick#3

Ideally the DNG parser should be fixed, but meanwhile and as a safety measure we shall ensure such buffer overflow does not happens in general...
Base automatically changed from master to main January 22, 2021 06:57
@dlemstra
Copy link
Member

dlemstra commented Apr 7, 2023

Found this PR way to late but can you explain after almost 3 years why this fixes an overflow?

@diegocr
Copy link
Contributor Author

diegocr commented Apr 7, 2023

Better later than never, but this will be a good memory exercise indeed.

I think you mean besides what was described in #3 ? there you can find the details, although i am failing to remember how this was fixing the overflow exactly.

@dlemstra
Copy link
Member

dlemstra commented Apr 8, 2023

It looks like this check } else if ((status = !((int)thumb_length > 0x7f)) { (maybe better written as } else if ((status = ((int)thumb_length < 128)) {) is making sure we have at least 127 bytes ? But I don't understand why the number 127 was picked and why we even need this?

@diegocr
Copy link
Contributor Author

diegocr commented Apr 8, 2023

It will be a matter of re-testing the pointed DNG file, perhaps the embedded thumbnail was truncated and a size offset resulting on allocating more memory than the file itself, or something of the like (?)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

2 participants