wim/image-tiff
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix possibly overflowing multiplications

Browse Source
This commit is contained in:
Birk Tjelmeland committed 2019-03-12 11:07:57 +01:00
1 parent 1871f985c0
commit 5e86931dff
2 files changed
+10 -13
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/decoder/ifd.rs
+4 -7
View File
@@ -170,8 +170,7 @@ impl Entry {
])) ]))
}, },
(Type::SHORT, n) => { (Type::SHORT, n) => {
// each value is ~8 bytes if n as usize > limits.decoding_buffer_size / std::mem::size_of::<Value>() {
if u64::from(n)*8 > limits.decoding_buffer_size {
return Err(TiffError::LimitsExceeded) return Err(TiffError::LimitsExceeded)
} }
let mut v = Vec::with_capacity(n as usize); let mut v = Vec::with_capacity(n as usize);
@@ -183,8 +182,7 @@ impl Entry {
}, },
(Type::LONG, 1) => Ok(Unsigned(try!(self.r(bo).read_u32()))), (Type::LONG, 1) => Ok(Unsigned(try!(self.r(bo).read_u32()))),
(Type::LONG, n) => { (Type::LONG, n) => {
// each value is ~8 bytes if n as usize > limits.decoding_buffer_size / std::mem::size_of::<Value>() {
if u64::from(n)*8 > limits.decoding_buffer_size {
return Err(TiffError::LimitsExceeded) return Err(TiffError::LimitsExceeded)
} }
let mut v = Vec::with_capacity(n as usize); let mut v = Vec::with_capacity(n as usize);
@@ -201,8 +199,7 @@ impl Entry {
Ok(Rational(numerator, denominator)) Ok(Rational(numerator, denominator))
}, },
(Type::RATIONAL, n) => { (Type::RATIONAL, n) => {
// each value is ~8 bytes if n as usize > limits.decoding_buffer_size / std::mem::size_of::<Value>() {
if u64::from(n)*8 > limits.decoding_buffer_size {
return Err(TiffError::LimitsExceeded) return Err(TiffError::LimitsExceeded)
} }
let mut v = Vec::with_capacity(n as usize); let mut v = Vec::with_capacity(n as usize);
@@ -215,7 +212,7 @@ impl Entry {
Ok(List(v)) Ok(List(v))
}, },
(Type::ASCII, n) => { (Type::ASCII, n) => {
if u64::from(n) > limits.decoding_buffer_size { if n as usize > limits.decoding_buffer_size {
return Err(TiffError::LimitsExceeded) return Err(TiffError::LimitsExceeded)
} }
try!(decoder.goto_offset(try!(self.r(bo).read_u32()))); try!(decoder.goto_offset(try!(self.r(bo).read_u32())));
src/decoder/mod.rs
+6 -6
View File
@@ -28,7 +28,7 @@ pub enum DecodingResult {
impl DecodingResult { impl DecodingResult {
fn new_u8(size: usize, limits: &Limits) -> TiffResult<DecodingResult> { fn new_u8(size: usize, limits: &Limits) -> TiffResult<DecodingResult> {
if size as u64 > limits.decoding_buffer_size { if size > limits.decoding_buffer_size {
Err(TiffError::LimitsExceeded) Err(TiffError::LimitsExceeded)
} }
else { else {
@@ -37,7 +37,7 @@ impl DecodingResult {
} }
fn new_u16(size: usize, limits: &Limits) -> TiffResult<DecodingResult> { fn new_u16(size: usize, limits: &Limits) -> TiffResult<DecodingResult> {
if size as u64*2 > limits.decoding_buffer_size { if size > limits.decoding_buffer_size / 2 {
Err(TiffError::LimitsExceeded) Err(TiffError::LimitsExceeded)
} }
else { else {
@@ -133,10 +133,10 @@ pub struct Limits {
/// 256MiB. If the entire image is decoded at once, then this will /// 256MiB. If the entire image is decoded at once, then this will
/// be the maximum size of the image. If it is decoded one strip at a /// be the maximum size of the image. If it is decoded one strip at a
/// time, this will be the maximum size of a strip. /// time, this will be the maximum size of a strip.
decoding_buffer_size: u64, decoding_buffer_size: usize,
/// The maximum size of any ifd value in bytes, the default is /// The maximum size of any ifd value in bytes, the default is
/// 1MiB. /// 1MiB.
ifd_value_size: u64, ifd_value_size: usize,
} }
impl Default for Limits { impl Default for Limits {
@@ -493,7 +493,7 @@ impl<R: Read + Seek> Decoder<R> {
method => return Err(TiffError::UnsupportedError(TiffUnsupportedError::UnsupportedCompressionMethod(method))) method => return Err(TiffError::UnsupportedError(TiffUnsupportedError::UnsupportedCompressionMethod(method)))
}; };
if bytes > max_uncompressed_length*buffer.byte_len() { if bytes / buffer.byte_len() > max_uncompressed_length {
return Err(TiffError::FormatError(TiffFormatError::InconsistentSizesEncountered)); return Err(TiffError::FormatError(TiffFormatError::InconsistentSizesEncountered));
} }
@@ -569,7 +569,7 @@ impl<R: Read + Seek> Decoder<R> {
let buffer_size = self.width as usize * strip_height * self.bits_per_sample.len(); let buffer_size = self.width as usize * strip_height * self.bits_per_sample.len();
if buffer.len() < buffer_size || byte_count as usize > buffer_size*buffer.byte_len() { if buffer.len() < buffer_size || byte_count as usize / buffer.byte_len() > buffer_size {
return Err(TiffError::FormatError(TiffFormatError::InconsistentSizesEncountered)); return Err(TiffError::FormatError(TiffFormatError::InconsistentSizesEncountered));
} }