fix(iff): detect corrupt chunk sizes, flags, channel configs - #5268
Conversation
Detect and rejecct corrupt chunk sizes, flags, and channel configurations in the header. Assisted-by: Claude Code / Claude Opus 4.8 Signed-off-by: Larry Gritz <lg@larrygritz.com>
A crafted Maya IFF with the TBHD ZBUFFER flag set but RGBA clear took the
ZBUFFER-only branch, which set rgba_count=1/rgba_bits=32 while leaving
zbuffer=0. open() then exposed the image as 1-channel UINT16 (so callers
size their tile buffer from ImageSpec::tile_bytes(true)), but the internal
pixel_bytes() stayed 32-bit. read_native_tile() copied by the internal
pixel size, writing past the smaller caller buffer -- a heap out-of-bounds
write.
Such files can never be decoded anyway: readimg()'s tile loop only handles
8- and 16-bit RGBA pixels and explicitly errors on 32-bit. So reject
ZBUFFER-only headers at open() instead of fabricating an inconsistent spec.
Also:
- Generalize the channel-config check to require rgba_count in {3,4}, which
additionally rejects headers with no color flags at all.
- Clear m_buf when readimg() fails. readimg() resizes m_buf before decoding,
so a partial/failed decode left a non-empty buffer that a later tile
request would reuse, skipping the (failed) decode and copying stale data.
Adds regression test src/zbuffer_only.iff.
Assisted-by: Claude Code / Claude Opus 4.8
Signed-off-by: Larry Gritz <lg@larrygritz.com>
|
I have amended this PR to handle an additional related case. |
mikaelsundell
left a comment
mikaelsundell
left a comment
There was a problem hiding this comment.
LGTM. Z-only Maya depth files may exist and could be handled in a separate PR with a real .z sample and dedicated tests. Let me see what I can do about that.
|
Did we support it before? If we never supported it properly, let's let this stand and we'll come back to it. |
|
My code was broken, I suggest we move on, let me prepare a new PR |
|
OK, but actually, maybe wait until I get some more PRs submitted. I have more iff ones in flight, so let's let the security bug fixes settle down before adding support for things that never worked. If it didn't work before and nobody complained, there can't be much of a rush. |
|
Thats cool, it may have worked but never properly tested or validated. Need to create a sample file in Maya so no stress 👍🏻 |
Detect and reject corrupt chunk sizes, flags, and channel configurations in the header. Assisted-by: Claude Code / Claude Opus 4.8 --------- Signed-off-by: Larry Gritz <lg@larrygritz.com>
…SoftwareFoundation#5268) Detect and reject corrupt chunk sizes, flags, and channel configurations in the header. Assisted-by: Claude Code / Claude Opus 4.8 --------- Signed-off-by: Larry Gritz <lg@larrygritz.com>
|
CVE-2026-63419 |
2 participants
Detect and reject corrupt chunk sizes, flags, and channel configurations in the header.
Assisted-by: Claude Code / Claude Opus 4.8