63 lines
2.2 KiB
Diff
63 lines
2.2 KiB
Diff
From 98cb1371fd4e22cca75017ea3252dc32fc218712 Mon Sep 17 00:00:00 2001
|
|
From: Jacob Boerema <jgboerema@gmail.com>
|
|
Date: Sat, 7 Mar 2026 15:55:04 -0500
|
|
Subject: [PATCH] plug-ins: fix #15970 buffer overflow in file-psp
|
|
|
|
Reported as ZDI-CAN-28874.
|
|
|
|
For psp images with bit depth 1 or 4 bits and small widths, it was
|
|
possible to overflow the buffer because these bit depths are stored
|
|
in multiples of 4 bytes per line.
|
|
Because these formats are converted to regular RGB, this means that for
|
|
small widths, more bytes are needed than expected when we are upscaling
|
|
to 8-bit.
|
|
|
|
To fix this, we compute the line size when depth < 8, and adjust
|
|
line width if that value is larger.
|
|
---
|
|
plug-ins/common/file-psp.c | 20 ++++++++++++++++++--
|
|
1 file changed, 18 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/plug-ins/common/file-psp.c b/plug-ins/common/file-psp.c
|
|
index 286cbed2bb7..763dd994fcd 100644
|
|
--- a/plug-ins/common/file-psp.c
|
|
+++ b/plug-ins/common/file-psp.c
|
|
@@ -2127,7 +2127,23 @@ read_layer_block (FILE *f,
|
|
|
|
if (can_handle_layer)
|
|
{
|
|
- pixel = g_malloc0 (height * width * bytespp);
|
|
+ gint line_width = width * bytespp;
|
|
+
|
|
+ if (ia->depth < 8)
|
|
+ {
|
|
+ gint min_line_width = (((width * ia->depth + 7) / 8) + (ia->depth - 1)) / 4 * 4;
|
|
+
|
|
+ /* For small widths, when depth is 1, or 4, the number of bytes
|
|
+ * used can be larger than the width * bytespp. Adjust for that. */
|
|
+ if (min_line_width > line_width)
|
|
+ {
|
|
+ IFDBG(3) g_message ("Adjusting line width from %d to %d\n",
|
|
+ line_width, min_line_width);
|
|
+ line_width = min_line_width;
|
|
+ }
|
|
+ }
|
|
+
|
|
+ pixel = g_malloc0 (height * line_width);
|
|
if (null_layer)
|
|
{
|
|
pixels = NULL;
|
|
@@ -2136,7 +2152,7 @@ read_layer_block (FILE *f,
|
|
{
|
|
pixels = g_new (guchar *, height);
|
|
for (i = 0; i < height; i++)
|
|
- pixels[i] = pixel + width * bytespp * i;
|
|
+ pixels[i] = pixel + line_width * i;
|
|
}
|
|
|
|
buffer = gimp_drawable_get_buffer (GIMP_DRAWABLE (layer));
|
|
--
|
|
GitLab
|
|
|
|
|