Skip to content

fix(psd): guard row interleave bounds on corrupt data #5307

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lgritz merged 1 commit into from
Jul 11, 2026
Merged

fix(psd): guard row interleave bounds on corrupt data #5307

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 40 additions & 14 deletions src/psd.imageio/psdinput.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -306,7 +306,7 @@ class PSDInput final : public ImageInput {
// Interleave channels (RRRGGGBBB -> RGBRGBRGB) while copying from
// channel_buffers[0..nchans-1] to dst.
template<typename T>
static void
static bool
interleave_row(T* dst, cspan<std::vector<unsigned char>> channel_buffers,
int width, int nchans);

Expand Down Expand Up @@ -808,25 +808,37 @@ PSDInput::read_native_scanline(int subimage, int miplevel, int y, int /*z*/,
|| m_header.color_mode == ColorMode_Grayscale) {
switch (bps) {
case 4:
interleave_row((float*)dst, channel_buffers, spec.width,
spec.nchannels);
if (!interleave_row((float*)dst, channel_buffers, spec.width,
spec.nchannels)) {
errorfmt("Corrupt PSD channel data for row {}", y + spec.y);
return false;
}
break;
case 2:
interleave_row((unsigned short*)dst, channel_buffers, spec.width,
spec.nchannels);
if (!interleave_row((unsigned short*)dst, channel_buffers,
spec.width, spec.nchannels)) {
errorfmt("Corrupt PSD channel data for row {}", y + spec.y);
return false;
}
break;
default:
interleave_row((unsigned char*)dst, channel_buffers, spec.width,
spec.nchannels);
if (!interleave_row((unsigned char*)dst, channel_buffers,
spec.width, spec.nchannels)) {
errorfmt("Corrupt PSD channel data for row {}", y + spec.y);
return false;
}
break;
}
} else if (m_header.color_mode == ColorMode_CMYK) {
span_size_t cmyklen = channel_count * spec.width;
switch (bps) {
case 4: {
std::unique_ptr<float[]> cmyk(new float[cmyklen]);
interleave_row(cmyk.get(), channel_buffers, spec.width,
channel_count);
if (!interleave_row(cmyk.get(), channel_buffers, spec.width,
channel_count)) {
errorfmt("Corrupt PSD channel data for row {}", y + spec.y);
return false;
}
cmyk_to_rgb(spec.width, make_cspan(cmyk.get(), cmyklen),
channel_count,
make_span((float*)dst, spec.width * spec.nchannels),
Expand All @@ -835,8 +847,11 @@ PSDInput::read_native_scanline(int subimage, int miplevel, int y, int /*z*/,
}
case 2: {
std::unique_ptr<unsigned short[]> cmyk(new unsigned short[cmyklen]);
interleave_row(cmyk.get(), channel_buffers, spec.width,
channel_count);
if (!interleave_row(cmyk.get(), channel_buffers, spec.width,
channel_count)) {
errorfmt("Corrupt PSD channel data for row {}", y + spec.y);
return false;
}
cmyk_to_rgb(spec.width, make_cspan(cmyk.get(), cmyklen),
channel_count,
make_span((uint16_t*)dst, spec.width * spec.nchannels),
Expand All @@ -845,8 +860,11 @@ PSDInput::read_native_scanline(int subimage, int miplevel, int y, int /*z*/,
}
default: {
std::unique_ptr<unsigned char[]> cmyk(new unsigned char[cmyklen]);
interleave_row(cmyk.get(), channel_buffers, spec.width,
channel_count);
if (!interleave_row(cmyk.get(), channel_buffers, spec.width,
channel_count)) {
errorfmt("Corrupt PSD channel data for row {}", y + spec.y);
return false;
}
cmyk_to_rgb(spec.width, make_cspan(cmyk.get(), cmyklen),
channel_count,
make_span((uint8_t*)dst, spec.width * spec.nchannels),
Expand Down Expand Up @@ -2191,16 +2209,24 @@ PSDInput::read_channel_row(ChannelInfo& channel_info, uint32_t row, char* data)


template<typename T>
void
bool
PSDInput::interleave_row(T* dst,
cspan<std::vector<unsigned char>> channel_buffers,
int width, int nchans)
{
if (!dst || width < 0 || nchans < 0
|| span_size_t(channel_buffers.size()) < size_t(nchans))
return false;

const uint64_t row_bytes = uint64_t(width) * sizeof(T);
for (int c = 0; c < nchans; ++c) {
if (channel_buffers[c].size() < row_bytes)
return false;
const T* cbuf = reinterpret_cast<const T*>(channel_buffers[c].data());
for (int x = 0; x < width; ++x)
dst[nchans * x + c] = cbuf[x];
}
return true;
}


Expand Down
6 changes: 6 additions & 0 deletions testsuite/psd/ref/out-linuxarm.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2117,3 +2117,9 @@ oiiotool ERROR: read : Read error: hit end of file in psd reader
failed to open "src/crash-eofstring.psd": failed load_resources
Full command line was:
> oiiotool --info -v -a --hash src/crash-eofstring.psd
Reading src/crash-rowbounds-f999.psd
oiiotool ERROR: -info : SHA-1: Corrupt PSD channel data for row 0
Full command line was:
> oiiotool --info -v -a --hash src/crash-rowbounds-f999.psd
src/crash-rowbounds-f999.psd : 10 x 111, 3 channel, uint8 psd
channel list: R, G, B
6 changes: 6 additions & 0 deletions testsuite/psd/ref/out.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2117,3 +2117,9 @@ oiiotool ERROR: read : Read error: hit end of file in psd reader
failed to open "src/crash-eofstring.psd": failed load_resources
Full command line was:
> oiiotool --info -v -a --hash src/crash-eofstring.psd
Reading src/crash-rowbounds-f999.psd
oiiotool ERROR: -info : SHA-1: Corrupt PSD channel data for row 0
Full command line was:
> oiiotool --info -v -a --hash src/crash-rowbounds-f999.psd
src/crash-rowbounds-f999.psd : 10 x 111, 3 channel, uint8 psd
channel list: R, G, B
2 changes: 2 additions & 0 deletions testsuite/psd/run.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,3 +38,5 @@
command += info_command ("src/crash-layerres.psd", failureok=True)
# Corruption where eof was hit in the end of a string read
command += info_command ("src/crash-eofstring.psd", failureok=True)
# Corruption where short per-channel rows could overrun interleaving
command += info_command ("src/crash-rowbounds-f999.psd", failureok=True)
Binary file added testsuite/psd/src/crash-rowbounds-f999.psd
View file
Open in desktop
Binary file not shown.
Loading