130 lines
5.2 KiB
Diff
130 lines
5.2 KiB
Diff
From 9061982fec1fc8732253fce8463150acd4a312cc Mon Sep 17 00:00:00 2001
|
|
From: Alx Sa <cmyk.student@gmail.com>
|
|
Date: Sun, 28 Jun 2026 12:58:47 +0000
|
|
Subject: [PATCH 1/2] plug-ins: Mitigate overflow in FITS import
|
|
|
|
When allocating memory for importing FITS, it was
|
|
possible for the operation to overflow the largest
|
|
datatype size, guint32. This patch adds a cast to
|
|
gsize for this operation, to reduce the risk of exceeding
|
|
the space limit before attempting to allocate.
|
|
---
|
|
plug-ins/file-fits/fits.c | 14 ++++++++++++--
|
|
1 file changed, 12 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/plug-ins/file-fits/fits.c b/plug-ins/file-fits/fits.c
|
|
index b4a8dbb433..2cd40f1c3f 100644
|
|
--- a/plug-ins/file-fits/fits.c
|
|
+++ b/plug-ins/file-fits/fits.c
|
|
@@ -477,9 +477,19 @@ load_image (GFile *file,
|
|
/* If RGB FITS image, we need to read in the whole image so we can convert
|
|
* the planes format to RGB */
|
|
if (hdu.naxis == 2)
|
|
- pixels = (gdouble *) malloc (width * sizeof (gdouble) * channels);
|
|
+ pixels = (gdouble *) g_try_malloc ((gsize) width * sizeof (gdouble) *
|
|
+ channels);
|
|
else
|
|
- pixels = (gdouble *) malloc (width * height * sizeof (gdouble) * channels);
|
|
+ pixels = (gdouble *) g_try_malloc ((gsize) width * height *
|
|
+ sizeof (gdouble) * channels);
|
|
+
|
|
+ if (pixels == NULL)
|
|
+ {
|
|
+ g_set_error (error, G_FILE_ERROR, 0,
|
|
+ "Memory could not be allocated.");
|
|
+ fits_close_file (ifp, &status);
|
|
+ return NULL;
|
|
+ }
|
|
|
|
if (! image)
|
|
{
|
|
|
|
From a432acf939384e85c23de67509c9b3f4d4fe43ca Mon Sep 17 00:00:00 2001
|
|
From: Alx Sa <cmyk.student@gmail.com>
|
|
Date: Wed, 8 Jul 2026 19:29:17 +0000
|
|
Subject: [PATCH 2/2] plug-ins: Add more memory checks for FITS imports
|
|
|
|
As suggested by Michael Catanzaro and Tristan Madani,
|
|
this patch adds calls to g_size_checked_mul () to determine
|
|
if the requested size for FITS import memory allocation would
|
|
overflow in the two places we allocate.
|
|
---
|
|
plug-ins/file-fits/fits.c | 40 ++++++++++++++++++++++++---------------
|
|
1 file changed, 25 insertions(+), 15 deletions(-)
|
|
|
|
diff --git a/plug-ins/file-fits/fits.c b/plug-ins/file-fits/fits.c
|
|
index 2cd40f1c3f..273156c5f8 100644
|
|
--- a/plug-ins/file-fits/fits.c
|
|
+++ b/plug-ins/file-fits/fits.c
|
|
@@ -351,6 +351,7 @@ load_image (GFile *file,
|
|
const Babl *type = NULL;
|
|
const Babl *format = NULL;
|
|
gdouble *pixels;
|
|
+ gsize allocate;
|
|
gdouble datamin = 1.0E30f;
|
|
gdouble datamax = -1.0E30f;
|
|
gint channels = 1;
|
|
@@ -474,21 +475,18 @@ load_image (GFile *file,
|
|
NULL);
|
|
}
|
|
|
|
- /* If RGB FITS image, we need to read in the whole image so we can convert
|
|
- * the planes format to RGB */
|
|
- if (hdu.naxis == 2)
|
|
- pixels = (gdouble *) g_try_malloc ((gsize) width * sizeof (gdouble) *
|
|
- channels);
|
|
- else
|
|
- pixels = (gdouble *) g_try_malloc ((gsize) width * height *
|
|
- sizeof (gdouble) * channels);
|
|
-
|
|
- if (pixels == NULL)
|
|
+ /* If RGB FITS image, we need to read in the whole image so we can
|
|
+ * convert the planes format to RGB */
|
|
+ if (! g_size_checked_mul (&allocate, width, sizeof (gdouble)) ||
|
|
+ ! g_size_checked_mul (&allocate, allocate, channels) ||
|
|
+ (hdu.naxis > 2 && ! g_size_checked_mul (&allocate, allocate, height)) ||
|
|
+ ! (pixels = (gdouble *) g_try_malloc (allocate)))
|
|
{
|
|
- g_set_error (error, G_FILE_ERROR, 0,
|
|
- "Memory could not be allocated.");
|
|
+ g_set_error (error, GIMP_PLUG_IN_ERROR, 0,
|
|
+ _("There was not enough memory to complete the "
|
|
+ "operation."));
|
|
fits_close_file (ifp, &status);
|
|
- return NULL;
|
|
+ return image;
|
|
}
|
|
|
|
if (! image)
|
|
@@ -559,8 +557,20 @@ load_image (GFile *file,
|
|
if (! status)
|
|
{
|
|
gdouble *temp;
|
|
+ gsize allocate;
|
|
|
|
- temp = (gdouble *) malloc (width * height * sizeof (gdouble) * channels);
|
|
+ if (! g_size_checked_mul (&allocate, width, sizeof (gdouble)) ||
|
|
+ ! g_size_checked_mul (&allocate, allocate, channels) ||
|
|
+ ! g_size_checked_mul (&allocate, allocate, height) ||
|
|
+ ! (temp = (gdouble *) g_try_malloc (allocate)))
|
|
+ {
|
|
+ g_set_error (error, GIMP_PLUG_IN_ERROR, 0,
|
|
+ _("There was not enough memory to complete the "
|
|
+ "operation."));
|
|
+ fits_close_file (ifp, &status);
|
|
+ g_object_unref (buffer);
|
|
+ return image;
|
|
+ }
|
|
|
|
if (datamin < datamax)
|
|
{
|
|
@@ -936,7 +946,7 @@ export_fits (GFile *file,
|
|
}
|
|
|
|
src_offset += width * channelnum;
|
|
- offset += width;
|
|
+ offset += width;
|
|
}
|
|
|
|
if (export_type == TFLOAT)
|