bugOpenEXR - Bugs: bug #30422, Buffer overflow when reading...


bug #30422: Buffer overflow when reading corrupted files

Submitted by:  None
Submitted on:  Mon 12 Jul 2010 05:14:28 PM UTC  
Category:  IlmImf Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open

Add a New Comment (Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Mon 12 Jul 2010 05:14:28 PM UTC, original submission:  


When running the IlmImf fuzz test it crashes when reading files with corrupted headers. I think there are two related bugs:

  • There is a buffer overflow when reading attributes' names which aren't null terminated.
  • ImfStdIO returns false instead of throwing an exception when reading less bytes than requested because of early file termination. ImfIO.h specifies: "If the stream contains less than n bytes, or if an I/O error occurs, read(c,n) throws an exception."

This could be related to this crash reported in the Openexr-user mail list.



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

Attached Files
file #20946:  Attribute_overflow.diff added by None (3KiB - text/x-diff - Proposed bug fixes.)
file #20947:  ImfStdIO_InputExc.diff added by None (846B - text/x-diff - Proposed bug fixes.)


Depends on the following items: None found

Items that depend on this one: None found


CC list is empty


Do you think this task is very important?
If so, you can add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.




Follow 2 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2010-07-12 None Attached File- => Added Attribute_overflow.diff, #20946
    Attached File- => Added ImfStdIO_InputExc.diff, #20947

Back to the top

Powered by Savane 3.7