From 19074854d9d8bc32dff3ed252eed17ed6cc2ecfc Mon Sep 17 00:00:00 2001 From: DRC Date: Tue, 12 Jun 2018 16:08:26 -0500 Subject: [PATCH] Fix CVE-2018-11813 Refer to change log for details. Fixes #242 --- ChangeLog.md | 14 ++++++++++++++ rdtarga.c | 6 ++---- 2 files changed, 16 insertions(+), 4 deletions(-) diff --git a/ChangeLog.md b/ChangeLog.md index bf63eb2dc..3aa41d173 100644 --- a/ChangeLog.md +++ b/ChangeLog.md @@ -24,6 +24,20 @@ an image was passed to `tjDecompressHeader3()`, `tjTransform()`, `tjDecompressToYUVPlanes()`, `tjDecompressToYUV2()`, or the equivalent Java methods. +5. Fixed an issue (CVE-2018-11813) whereby a specially-crafted malformed input +file (specifically, a file with a valid Targa header but incomplete pixel data) +would cause cjpeg to generate a JPEG file that was potentially thousands of +times larger than the input file. The Targa reader in cjpeg was not properly +detecting that the end of the input file had been reached prematurely, so after +all valid pixels had been read from the input, the reader injected dummy pixels +with values of 255 into the JPEG compressor until the number of pixels +specified in the Targa header had been compressed. The Targa reader in cjpeg +now behaves like the PPM reader and aborts compression if the end of the input +file is reached prematurely. Because this issue only affected cjpeg and not +the underlying library, and because it did not involve any out-of-bounds reads +or other exploitable behaviors, it was not believed to represent a security +threat. + 1.5.3 ===== diff --git a/rdtarga.c b/rdtarga.c index b9bbd07cb..f874ece67 100644 --- a/rdtarga.c +++ b/rdtarga.c @@ -125,11 +125,10 @@ METHODDEF(void) read_non_rle_pixel (tga_source_ptr sinfo) /* Read one Targa pixel from the input file; no RLE expansion */ { - register FILE *infile = sinfo->pub.input_file; register int i; for (i = 0; i < sinfo->pixel_size; i++) { - sinfo->tga_pixel[i] = (U_CHAR) getc(infile); + sinfo->tga_pixel[i] = (U_CHAR) read_byte(sinfo); } } @@ -138,7 +137,6 @@ METHODDEF(void) read_rle_pixel (tga_source_ptr sinfo) /* Read one Targa pixel from the input file, expanding RLE data as needed */ { - register FILE *infile = sinfo->pub.input_file; register int i; /* Duplicate previously read pixel? */ @@ -160,7 +158,7 @@ read_rle_pixel (tga_source_ptr sinfo) /* Read next pixel */ for (i = 0; i < sinfo->pixel_size; i++) { - sinfo->tga_pixel[i] = (U_CHAR) getc(infile); + sinfo->tga_pixel[i] = (U_CHAR) read_byte(sinfo); } }