File us-Restrict-image-size-to-16384x16384.patch of Package celestia

Overview Repositories Revisions Requests Users Attributes Meta

File us-Restrict-image-size-to-16384x16384.patch of Package celestia (Revision 262f5d4901cd090507d8fb7258cab8b6)

Currently displaying revision 262f5d4901cd090507d8fb7258cab8b6 , Show latest

From fb3278b318bb0b94d507e2fca5ec661763baf8ed Mon Sep 17 00:00:00 2001
From: Andrew Tribick <ajtribick@googlemail.com>
Date: Thu, 7 Nov 2024 22:43:20 +0100
Subject: [PATCH] Restrict image size to 16384x16384

---
 src/celengine/dds.cpp   | 16 ++++++++++++++--
 src/celengine/image.cpp | 29 +++++++++++++++++++++++++----
 src/celengine/image.h   |  4 ++++
 3 files changed, 43 insertions(+), 6 deletions(-)

diff --git a/src/celengine/dds.cpp b/src/celengine/dds.cpp
index a09fc7608f..6e85d9bc8e 100644
--- a/src/celengine/dds.cpp
+++ b/src/celengine/dds.cpp
@@ -66,7 +66,7 @@ struct DDSurfaceDesc
 
     DDPixelFormat format;
     DDSCaps caps;
-    
+
     uint32 textureStage;
 };
 
@@ -117,6 +117,18 @@ Image* LoadDDSImage(const string& filename)
     LE_TO_CPU_INT32(ddsd.format.bpp, ddsd.format.bpp);
     LE_TO_CPU_INT32(ddsd.format.fourCC, ddsd.format.fourCC);
 
+    if (ddsd.width == 0 || ddsd.width > Image::MAX_IMAGE_DIMENSION)
+    {
+        cerr << "Width out of range in DDS file\n";
+        return NULL;
+    }
+
+    if (ddsd.height == 0 || ddsd.height > Image::MAX_IMAGE_DIMENSION)
+    {
+        cerr << "Height out of range in DDS file\n";
+        return NULL;
+    }
+
     int format = -1;
 
     if (ddsd.format.fourCC != 0)
@@ -135,7 +147,7 @@ Image* LoadDDSImage(const string& filename)
         }
         else
         {
-            cerr << "Unknown FourCC in DDS file: " << ddsd.format.fourCC;
+            cerr << "Unknown FourCC in DDS file: " << ddsd.format.fourCC << '\n';
         }
     }
     else
diff --git a/src/celengine/image.cpp b/src/celengine/image.cpp
index 5de784feb9..bc96d55a08 100644
--- a/src/celengine/image.cpp
+++ b/src/celengine/image.cpp
@@ -81,7 +81,6 @@ using namespace std;
 
 #endif // PNG_SUPPORT
 
-
 // All rows are padded to a size that's a multiple of 4 bytes
 static int pad(int n)
 {
@@ -474,6 +473,13 @@ Image* LoadJPEGImage(const string& filename, int)
 
     // Step 3: read file parameters with jpeg_read_header()
     (void) jpeg_read_header(&cinfo, TRUE);
+    if (cinfo.image_width == 0 || cinfo.image_width > Image::MAX_IMAGE_DIMENSION ||
+        cinfo.image_height == 0 || cinfo.image_height > Image::MAX_IMAGE_DIMENSION)
+    {
+        jpeg_destroy_decompress(&cinfo);
+        fclose(in);
+        return NULL;
+    }
 
     // We can ignore the return value from jpeg_read_header since
     //  (a) suspension is not possible with the stdio data source, and
@@ -612,10 +618,10 @@ Image* LoadPNGImage(const string& filename)
 
     if (setjmp(png_jmpbuf(png_ptr)))
     {
-        fclose(fp);
         delete row_pointers;
         delete img;
         png_destroy_read_struct(&png_ptr, &info_ptr, (png_infopp) NULL);
+        fclose(fp);
         clog << _("Error reading PNG image file ") << filename << '\n';
         return NULL;
     }
@@ -631,6 +637,15 @@ Image* LoadPNGImage(const string& filename)
                  &color_type, &interlace_type,
                  NULL, NULL);
 
+    if (width == 0 || width > Image::MAX_IMAGE_DIMENSION ||
+        height == 0 || height > Image::MAX_IMAGE_DIMENSION)
+    {
+        png_destroy_read_struct(&png_ptr, &info_ptr, (png_infopp) NULL);
+        fclose(fp);
+        clog << _("PNG dimensions out of range " ) << filename << '\n';
+        return NULL;
+    }
+
     GLenum glformat = GL_RGB;
     switch (color_type)
     {
@@ -787,10 +802,16 @@ static Image* LoadBMPImage(ifstream& in)
         return NULL;
     }
 
-    if (!readInteger(in, imageHeader.width) || imageHeader.width <= 0)
+    if (!readInteger(in, imageHeader.width) ||
+        imageHeader.width <= 0 || imageHeader.width > Image::MAX_IMAGE_DIMENSION)
+    {
         return NULL;
-    if (!readInteger(in, imageHeader.height) || imageHeader.height <= 0)
+    }
+    if (!readInteger(in, imageHeader.height) ||
+        imageHeader.height <= 0 || imageHeader.height > Image::MAX_IMAGE_DIMENSION)
+    {
         return NULL;
+    }
     if (!readInteger(in, imageHeader.planes) || imageHeader.planes != 1)
         return NULL;
     if (!readInteger(in, imageHeader.bpp) ||
diff --git a/src/celengine/image.h b/src/celengine/image.h
index f06c1cc815..88a43a1a1e 100644
--- a/src/celengine/image.h
+++ b/src/celengine/image.h
@@ -48,6 +48,10 @@ class Image
         AlphaChannel = 2
     };
 
+    enum {
+        MAX_IMAGE_DIMENSION = 16384
+    };
+
  private:
     int width;
     int height;

Places

File us-Restrict-image-size-to-16384x16384.patch of Package celestia (Revision 262f5d4901cd090507d8fb7258cab8b6)

Places