all messages for Emacs-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
* bug#72245: [PATCH] Fix integer overflow when reading XPM
@ 2024-07-22 14:35 Stefan Kangas
  2024-07-22 15:01 ` Eli Zaretskii
  2024-07-23  2:06 ` Po Lu via Bug reports for GNU Emacs, the Swiss army knife of text editors
  0 siblings, 2 replies; 17+ messages in thread
From: Stefan Kangas @ 2024-07-22 14:35 UTC (permalink / raw)
  To: 72245

[-- Attachment #1: Type: text/plain, Size: 172 bytes --]

Severity: minor

Since XPM files are untrusted input, I think we'd better handle integer
overflow when parsing it, in case the file is malformed.

Proposed patch attached.

[-- Attachment #2: 0001-Fix-integer-overflow-when-reading-XPM.patch --]
[-- Type: text/x-patch, Size: 2111 bytes --]

From 2aa0e1ac9705201939b30a8ca39b3354cbd62a8e Mon Sep 17 00:00:00 2001
From: Stefan Kangas <stefankangas@gmail.com>
Date: Mon, 22 Jul 2024 16:00:30 +0200
Subject: [PATCH] Fix integer overflow when reading XPM

* src/image.c (xpm_str_to_int): New function.
(xpm_load_image): Avoid integer overflow when reading XPM by replacing
sscanf with strtol, to correctly handle integer overflow when reading a
malformed XPM file.
---
 src/image.c | 34 ++++++++++++++++++++++++++++++----
 1 file changed, 30 insertions(+), 4 deletions(-)

diff --git a/src/image.c b/src/image.c
index 90e6312e128..d8a8dc57ea9 100644
--- a/src/image.c
+++ b/src/image.c
@@ -19,6 +19,7 @@ Copyright (C) 1989-2024 Free Software Foundation, Inc.
 
 #include <config.h>
 
+#include <errno.h>
 #include <fcntl.h>
 #include <math.h>
 #include <unistd.h>
@@ -6254,6 +6255,27 @@ xpm_str_to_color_key (const char *s)
   return -1;
 }
 
+static int
+xpm_str_to_int (char **buf)
+{
+  char *p;
+
+  errno = 0;
+  long result = strtol (*buf, &p, 10);
+  if (p == *buf || errno == ERANGE || errno == EINVAL
+      || result < INT_MIN || result > INT_MAX)
+    return -1;
+
+  /* Error out if we see something like "12x3xyz".  */
+  if (!c_isspace (*p) && *p != '\0')
+    return -1;
+
+  /* Update position to read next integer.  */
+  *buf = p;
+
+  return (int)result;
+}
+
 static bool
 xpm_load_image (struct frame *f,
                 struct image *img,
@@ -6311,10 +6333,14 @@ #define expect_ident(IDENT)					\
     goto failure;
   memcpy (buffer, beg, len);
   buffer[len] = '\0';
-  if (sscanf (buffer, "%d %d %d %d", &width, &height,
-	      &num_colors, &chars_per_pixel) != 4
-      || width <= 0 || height <= 0
-      || num_colors <= 0 || chars_per_pixel <= 0)
+  char *next_int = buffer;
+  if ((width = xpm_str_to_int (&next_int)) <= 0)
+    goto failure;
+  if ((height = xpm_str_to_int (&next_int)) <= 0)
+    goto failure;
+  if ((num_colors = xpm_str_to_int (&next_int)) <= 0)
+    goto failure;
+  if ((chars_per_pixel = xpm_str_to_int (&next_int)) <= 0)
     goto failure;
 
   if (!check_image_size (f, width, height))
-- 
2.45.2


^ permalink raw reply related	[flat|nested] 17+ messages in thread

end of thread, other threads:[~2024-09-01 11:20 UTC | newest]

Thread overview: 17+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-07-22 14:35 bug#72245: [PATCH] Fix integer overflow when reading XPM Stefan Kangas
2024-07-22 15:01 ` Eli Zaretskii
2024-07-22 15:39   ` Paul Eggert
2024-07-22 15:48     ` Stefan Kangas
2024-07-23  2:06 ` Po Lu via Bug reports for GNU Emacs, the Swiss army knife of text editors
2024-07-23  3:04   ` Stefan Kangas
2024-07-23  3:41     ` Po Lu via Bug reports for GNU Emacs, the Swiss army knife of text editors
2024-07-23  4:12       ` Stefan Kangas
2024-07-23  4:45         ` Po Lu via Bug reports for GNU Emacs, the Swiss army knife of text editors
2024-07-23 14:51           ` Stefan Kangas
2024-07-23 15:15             ` Po Lu via Bug reports for GNU Emacs, the Swiss army knife of text editors
2024-07-23 15:39               ` Eli Zaretskii
2024-07-23 15:33             ` Eli Zaretskii
2024-07-23 17:39               ` Andreas Schwab
2024-07-23 17:54                 ` Eli Zaretskii
2024-07-23 21:39               ` Stefan Kangas
2024-09-01 11:20             ` Stefan Kangas

Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/emacs.git
	https://git.savannah.gnu.org/cgit/emacs/org-mode.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.