From d86ccf83091d26005af0fea74ce7e32247fd3c4e Mon Sep 17 00:00:00 2001 From: bruvzg <7645683+bruvzg@users.noreply.github.com> Date: Mon, 14 Jun 2021 18:51:09 +0300 Subject: [PATCH] Fix loading RLE compressed TGA files. Fix memory reads outside of input buffer when loading invalid TGA files. --- modules/tga/image_loader_tga.cpp | 22 ++++++++++++++-------- modules/tga/image_loader_tga.h | 4 ++-- 2 files changed, 16 insertions(+), 10 deletions(-) diff --git a/modules/tga/image_loader_tga.cpp b/modules/tga/image_loader_tga.cpp index 39404610333..18957adb538 100644 --- a/modules/tga/image_loader_tga.cpp +++ b/modules/tga/image_loader_tga.cpp @@ -35,7 +35,7 @@ #include "core/os/os.h" #include "core/print_string.h" -Error ImageLoaderTGA::decode_tga_rle(const uint8_t *p_compressed_buffer, size_t p_pixel_size, uint8_t *p_uncompressed_buffer, size_t p_output_size) { +Error ImageLoaderTGA::decode_tga_rle(const uint8_t *p_compressed_buffer, size_t p_pixel_size, uint8_t *p_uncompressed_buffer, size_t p_output_size, size_t p_input_size) { Error error; PoolVector pixels; @@ -56,11 +56,14 @@ Error ImageLoaderTGA::decode_tga_rle(const uint8_t *p_compressed_buffer, size_t compressed_pos += 1; count = (c & 0x7f) + 1; - if (output_pos + count * p_pixel_size > output_pos) { + if (output_pos + count * p_pixel_size > p_output_size) { return ERR_PARSE_ERROR; } if (c & 0x80) { + if (compressed_pos + p_pixel_size > p_input_size) { + return ERR_PARSE_ERROR; + } for (size_t i = 0; i < p_pixel_size; i++) { pixels_w.ptr()[i] = p_compressed_buffer[compressed_pos]; compressed_pos += 1; @@ -72,6 +75,9 @@ Error ImageLoaderTGA::decode_tga_rle(const uint8_t *p_compressed_buffer, size_t output_pos += p_pixel_size; } } else { + if (compressed_pos + count * p_pixel_size > p_input_size) { + return ERR_PARSE_ERROR; + } count *= p_pixel_size; for (size_t i = 0; i < count; i++) { p_uncompressed_buffer[output_pos] = p_compressed_buffer[compressed_pos]; @@ -83,7 +89,7 @@ Error ImageLoaderTGA::decode_tga_rle(const uint8_t *p_compressed_buffer, size_t return OK; } -Error ImageLoaderTGA::convert_to_image(Ref p_image, const uint8_t *p_buffer, const tga_header_s &p_header, const uint8_t *p_palette, const bool p_is_monochrome, size_t p_output_size) { +Error ImageLoaderTGA::convert_to_image(Ref p_image, const uint8_t *p_buffer, const tga_header_s &p_header, const uint8_t *p_palette, const bool p_is_monochrome, size_t p_input_size) { #define TGA_PUT_PIXEL(r, g, b, a) \ int image_data_ofs = ((y * width) + x); \ image_data_w[image_data_ofs * 4 + 0] = r; \ @@ -134,7 +140,7 @@ Error ImageLoaderTGA::convert_to_image(Ref p_image, const uint8_t *p_buff if (p_is_monochrome) { while (y != y_end) { while (x != x_end) { - if (i > p_output_size) { + if (i >= p_input_size) { return ERR_PARSE_ERROR; } uint8_t shade = p_buffer[i]; @@ -150,7 +156,7 @@ Error ImageLoaderTGA::convert_to_image(Ref p_image, const uint8_t *p_buff } else { while (y != y_end) { while (x != x_end) { - if (i > p_output_size) { + if (i >= p_input_size) { return ERR_PARSE_ERROR; } uint8_t index = p_buffer[i]; @@ -181,7 +187,7 @@ Error ImageLoaderTGA::convert_to_image(Ref p_image, const uint8_t *p_buff } else if (p_header.pixel_depth == 24) { while (y != y_end) { while (x != x_end) { - if (i + 2 > p_output_size) { + if (i + 2 >= p_input_size) { return ERR_PARSE_ERROR; } @@ -200,7 +206,7 @@ Error ImageLoaderTGA::convert_to_image(Ref p_image, const uint8_t *p_buff } else if (p_header.pixel_depth == 32) { while (y != y_end) { while (x != x_end) { - if (i + 3 > p_output_size) { + if (i + 3 >= p_input_size) { return ERR_PARSE_ERROR; } @@ -309,7 +315,7 @@ Error ImageLoaderTGA::load_image(Ref p_image, FileAccess *f, bool p_force const uint8_t *buffer = nullptr; if (is_encoded) { - err = decode_tga_rle(src_image_r.ptr(), pixel_size, uncompressed_buffer_w.ptr(), buffer_size); + err = decode_tga_rle(src_image_r.ptr(), pixel_size, uncompressed_buffer_w.ptr(), buffer_size, src_image_len); if (err == OK) { uncompressed_buffer_r = uncompressed_buffer.read(); diff --git a/modules/tga/image_loader_tga.h b/modules/tga/image_loader_tga.h index bbfc3fed329..e822743cb90 100644 --- a/modules/tga/image_loader_tga.h +++ b/modules/tga/image_loader_tga.h @@ -72,8 +72,8 @@ class ImageLoaderTGA : public ImageFormatLoader { uint8_t pixel_depth; uint8_t image_descriptor; }; - static Error decode_tga_rle(const uint8_t *p_compressed_buffer, size_t p_pixel_size, uint8_t *p_uncompressed_buffer, size_t p_output_size); - static Error convert_to_image(Ref p_image, const uint8_t *p_buffer, const tga_header_s &p_header, const uint8_t *p_palette, const bool p_is_monochrome, size_t p_output_size); + static Error decode_tga_rle(const uint8_t *p_compressed_buffer, size_t p_pixel_size, uint8_t *p_uncompressed_buffer, size_t p_output_size, size_t p_input_size); + static Error convert_to_image(Ref p_image, const uint8_t *p_buffer, const tga_header_s &p_header, const uint8_t *p_palette, const bool p_is_monochrome, size_t p_input_size); public: virtual Error load_image(Ref p_image, FileAccess *f, bool p_force_linear, float p_scale);