bugOpenEXR - Bugs: bug #30422, Buffer overflow when reading...

 
 

bug #30422: Buffer overflow when reading corrupted files

Submitted by:  None
Submitted on:  Mon 12 Jul 2010 05:14:28 PM UTC  
 
Category: IlmImfSeverity: 3 - Normal
Item Group: NoneStatus: None
Privacy: PublicAssigned to: None
Open/Closed: Open

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 12 Jul 2010 05:14:28 PM UTC, original submission:

Hi,

When running the IlmImf fuzz test it crashes when reading files with corrupted headers. I think there are two related bugs:

  • There is a buffer overflow when reading attributes' names which aren't null terminated.
  • ImfStdIO returns false instead of throwing an exception when reading less bytes than requested because of early file termination. ImfIO.h specifies: "If the stream contains less than n bytes, or if an I/O error occurs, read(c,n) throws an exception."

This could be related to this crash reported in the Openexr-user mail list.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #20946:  Attribute_overflow.diff added by None (3kB - text/x-diff - Proposed bug fixes.)
file #20947:  ImfStdIO_InputExc.diff added by None (846B - text/x-diff - Proposed bug fixes.)

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 2 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Mon 12 Jul 2010 05:14:28 PM UTCNoneAttached File-=>Added Attribute_overflow.diff, #20946
  Attached File-=>Added ImfStdIO_InputExc.diff, #20947

Back to the top


Powered by Savane 3.1-cleanup