Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CVE-2024-28219: Use strncpy to avoid buffer overflow #7928

Merged
merged 3 commits into from Apr 1, 2024
Merged

CVE-2024-28219: Use strncpy to avoid buffer overflow #7928

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2a93aba
Use strncpy to avoid buffer overflow
radarhere Feb 22, 2024
facf3af
Added release notes
radarhere Mar 25, 2024
aeb51cb
Merge branch 'main' into lcms
radarhere Apr 1, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
Binary file added Tests/icc/sGrey-v2-nano.icc
View file
Open in desktop
Binary file not shown.
5 changes: 5 additions & 0 deletions Tests/test_imagecms.py
View file
Open in desktop
Expand Up @@ -661,6 +661,11 @@ def test_auxiliary_channels_isolated() -> None:
assert_image_equal(test_image.convert(dst_format[2]), reference_image)


def test_long_modes() -> None:
p = ImageCms.getOpenProfile("Tests/icc/sGrey-v2-nano.icc")
ImageCms.buildTransform(p, p, "ABCDEFGHI", "ABCDEFGHI")


@pytest.mark.parametrize("mode", ("RGB", "RGBA", "RGBX"))
def test_rgb_lab(mode: str) -> None:
im = Image.new(mode, (1, 1))
Expand Down
13 changes: 4 additions & 9 deletions docs/releasenotes/10.3.0.rst
View file
Open in desktop
Expand Up @@ -14,16 +14,11 @@ ImageMath eval()
not recommended to process expressions without considering this.
:py:meth:`~PIL.ImageMath.lambda_eval` is a more secure alternative.

:cve:`YYYY-XXXXX`: TODO
^^^^^^^^^^^^^^^^^^^^^^^
:cve:`2024-28219`: Fix buffer overflow in ``_imagingcms.c``
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

TODO

Backwards Incompatible Changes
==============================

TODO
^^^^
In ``_imagingcms.c``, two ``strcpy`` calls were able to copy too much data into fixed
length strings. This has been fixed by using ``strncpy`` instead.

Deprecations
============
Expand Down
9 changes: 4 additions & 5 deletions src/_imagingcms.c
View file
Open in desktop
Expand Up @@ -201,8 +201,8 @@ cms_transform_new(cmsHTRANSFORM transform, char *mode_in, char *mode_out) {

self->transform = transform;

strcpy(self->mode_in, mode_in);
strcpy(self->mode_out, mode_out);
strncpy(self->mode_in, mode_in, 8);
strncpy(self->mode_out, mode_out, 8);
Comment on lines +204 to +205
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

strncpy doesn’t null-terminate oversized entries.

Suggested change
strncpy(self->mode_in, mode_in, 8);
strncpy(self->mode_out, mode_out, 8);
strncpy(self->mode_in, mode_in, 8);
self->mode_in[7] = '\0';
strncpy(self->mode_out, mode_out, 8);
self->mode_out[7] = '\0';

But are these even used? The Python ImageCmsTransform wrapper has inputMode and outputMode attributes already, and they work normally. Is there a need to preserve a slightly different .transform.inputMode?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Probably not, see #7931 for a suggestion to remove them.


return (PyObject *)self;
}
Expand Down Expand Up @@ -242,10 +242,9 @@ findLCMStype(char *PILmode) {
// LabX equivalent like ALab, but not reversed -- no #define in lcms2
return (COLORSPACE_SH(PT_LabV2) | CHANNELS_SH(3) | BYTES_SH(1) | EXTRA_SH(1));
}

else {
/* take a wild guess... but you probably should fail instead. */
return TYPE_GRAY_8; /* so there's no buffer overrun... */
/* take a wild guess... */
return TYPE_GRAY_8;
}
}

Expand Down