The FreeType Project - Bugs: bug #34139, LZW decompression unbound...
You are not allowed to post comments on this tracker with your current authentication level.
bug #34139: LZW decompression unbound character stack size
Submitter: | Tomas Hoger <thoger> | ||
Submitted: | Fri 26 Aug 2011 07:28:02 AM UTC | ||
Severity: | 3 - Normal | Item Group: | None |
Status: | Fixed | Privacy: | Public |
Assigned to: | wl | Open/Closed: | Closed |
Planned Release: | 2.4.7 |
Mon 12 Sep 2011 01:41:58 PM UTC, comment #5: |
Werner LEMBERG <wl> |
Mon 12 Sep 2011 10:11:03 AM UTC, comment #4: There is still somewhat surprising behaviour that prefix[] and suffix[] tables are overwritten at clear code position. As noted in comment #2, those values are never used though, and hence that behaviour seems completely harmless.
|
Tomas Hoger <thoger> |
Sun 11 Sep 2011 07:30:10 AM UTC, comment #3: I've applied all your patches, thanks!
|
Werner LEMBERG <wl> |
Fri 26 Aug 2011 07:53:52 AM UTC, comment #2: One additional minor change I did while looking at this issue... Attached patch sightly changes clear code handling to properly handle subsequent clear codes (they probably never appear in non-corrupted/malicious LZW streams).
|
Tomas Hoger <thoger> |
Fri 26 Aug 2011 07:33:08 AM UTC, comment #1: Optional additional patch adds explicit stack size limit to ft_lzwstate_stack_grow. Stack larger than 1<<LZW_MAX_BITS is never needed. Doing an explicit check in ft_lzwstate_stack_grow seems fairly cheap, and can help limit memory usage if some other way is found to create prefix loop. |
Tomas Hoger <thoger> |
Fri 26 Aug 2011 07:28:02 AM UTC, original submission:
While FreeType LZW decompressor is the re-write of the original BSD compress code, it has some of the problems of the original version. It does not sufficiently validate codes read from the LZW stream, which can lead to breaking expected invariant: code < prefix[code], which allows creating loops in the prefix table.
|
Tomas Hoger <thoger> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 10 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2011-09-12 | thoger | Attached File | - | Added test3.Z, #23970 | |
2011-09-11 | wl | Status | None | Fixed | |
Assigned to | None | wl | |||
Open/Closed | Open | Closed | |||
Planned Release | None | 2.4.7 | |||
2011-08-26 | thoger | Attached File | - | Added ft-lzw-clear-code-handling.diff, #23882 | |
2011-08-26 | thoger | Attached File | - | Added ft-lzw-stack-size-limit.diff, #23881 | |
2011-08-26 | thoger | Attached File | - | Added ft-lzw-code-checks.diff, #23878 | |
Attached File | - | Added test1.Z, #23879 | |||
Attached File | - | Added test2.Z, #23880 |
Powered by Savane 3.13-4448.
Corresponding source code
Thanks for the additional samples. I concur that I don't have to something, which is good :-)