47 lines
1.8 KiB
Diff
47 lines
1.8 KiB
Diff
From 0fd8931dcccbd055caefe242d9cf8f86073d2835 Mon Sep 17 00:00:00 2001
|
|
From: Alx Sa <cmyk.student@gmail.com>
|
|
Date: Sat, 11 Apr 2026 17:41:50 +0000
|
|
Subject: [PATCH] plug-ins: Guard against too large PSD channel sizes
|
|
|
|
Resolves #16216
|
|
If a PSD channel row size is intentionally set very high, multiplying
|
|
it by 4 in our code can cause an overflow and wraparound to a lower
|
|
value for memory allocation.
|
|
This patch adds checks to prevent this if the total size exceeds
|
|
G_MAXUINT32.
|
|
---
|
|
plug-ins/file-psd/psd-load.c | 13 ++++++++++++-
|
|
1 file changed, 12 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/plug-ins/file-psd/psd-load.c b/plug-ins/file-psd/psd-load.c
|
|
index 676f3da9b4..64e9a5d9a2 100644
|
|
--- a/plug-ins/file-psd/psd-load.c
|
|
+++ b/plug-ins/file-psd/psd-load.c
|
|
@@ -1790,6 +1790,7 @@ read_RLE_channel (PSDimage *img_a,
|
|
{
|
|
gint rle_count_size = (img_a->version == 1 ? 2 : 4);
|
|
gint rle_row_size = lyr_chn->rows * rle_count_size;
|
|
+ gsize row_allocation;
|
|
guint32 *rle_pack_len;
|
|
gint rowi;
|
|
|
|
@@ -1799,7 +1800,17 @@ read_RLE_channel (PSDimage *img_a,
|
|
channel_data_len - 2,
|
|
rle_row_size,
|
|
(channel_data_len - 2 - rle_row_size));
|
|
- rle_pack_len = g_malloc (lyr_chn->rows * 4); /* Always 4 since this is the data size in memory. */
|
|
+
|
|
+ /* Always 4 since this is the data size in memory. */
|
|
+ if (! g_size_checked_mul (&row_allocation, lyr_chn->rows, 4) ||
|
|
+ row_allocation >= G_MAXUINT32)
|
|
+ {
|
|
+ g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
|
|
+ _("Unsupported or invalid channel size"));
|
|
+ return FALSE;
|
|
+ }
|
|
+
|
|
+ rle_pack_len = g_malloc ((guint32) row_allocation);
|
|
for (rowi = 0; rowi < lyr_chn->rows; ++rowi)
|
|
{
|
|
if (psd_read (input, &rle_pack_len[rowi], rle_count_size,
|