bugOpenEXR - Bugs: bug #30422, Buffer overflow when reading...


bug #30422: Buffer overflow when reading corrupted files

Submitter:  None
Submitted:  Mon 12 Jul 2010 05:14:28 PM UTC
Category:  IlmImf Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup

Mon 12 Jul 2010 05:14:28 PM UTC, original submission:  


When running the IlmImf fuzz test it crashes when reading files with corrupted headers. I think there are two related bugs:

  • There is a buffer overflow when reading attributes' names which aren't null terminated.
  • ImfStdIO returns false instead of throwing an exception when reading less bytes than requested because of early file termination. ImfIO.h specifies: "If the stream contains less than n bytes, or if an I/O error occurs, read(c,n) throws an exception."

This could be related to this crash reported in the Openexr-user mail list.



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

Attached Files
file #20946:  Attribute_overflow.diff added by None (3KiB - text/x-diff - Proposed bug fixes.)
file #20947:  ImfStdIO_InputExc.diff added by None (846B - text/x-diff - Proposed bug fixes.)


Depends on the following items: None found

Items that depend on this one: None found


CC list is empty


There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

Only logged-in users can vote.


Follow 2 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2010-07-12 None Attached File- Added Attribute_overflow.diff, #20946
    Attached File- Added ImfStdIO_InputExc.diff, #20947

Back to the top

Powered by Savane 3.13-4b48.
Corresponding source code