Fix buffer overflow in sreadHeaderSpix (found by cluster-fuzz)

DanBloomberg · Jul 28, 2020 · 13f812c · 13f812c
1 parent c0fb788
commit 13f812c
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 3 deletions.
diff --git a/src/allheaders.h b/src/allheaders.h
@@ -2561,7 +2561,7 @@ LEPT_DLL extern l_ok pixFindNormalizedSquareSum ( PIX *pixs, l_float32 *phratio,
 LEPT_DLL extern PIX * pixReadStreamSpix ( FILE *fp );
 LEPT_DLL extern l_ok readHeaderSpix ( const char *filename, l_int32 *pwidth, l_int32 *pheight, l_int32 *pbps, l_int32 *pspp, l_int32 *piscmap );
 LEPT_DLL extern l_ok freadHeaderSpix ( FILE *fp, l_int32 *pwidth, l_int32 *pheight, l_int32 *pbps, l_int32 *pspp, l_int32 *piscmap );
-LEPT_DLL extern l_ok sreadHeaderSpix ( const l_uint32 *data, l_int32 *pwidth, l_int32 *pheight, l_int32 *pbps, l_int32 *pspp, l_int32 *piscmap );
+LEPT_DLL extern l_ok sreadHeaderSpix ( const l_uint32 *data, size_t size, l_int32 *pwidth, l_int32 *pheight, l_int32 *pbps, l_int32 *pspp, l_int32 *piscmap );
 LEPT_DLL extern l_ok pixWriteStreamSpix ( FILE *fp, PIX *pix );
 LEPT_DLL extern PIX * pixReadMemSpix ( const l_uint8 *data, size_t size );
 LEPT_DLL extern l_ok pixWriteMemSpix ( l_uint8 **pdata, size_t *psize, PIX *pix );

diff --git a/src/readfile.c b/src/readfile.c
@@ -1070,7 +1070,7 @@ PIX     *pix;
         return ERROR_INT("Pdf reading is not supported\n", procName, 1);
 
     case IFF_SPIX:
-        ret = sreadHeaderSpix((l_uint32 *)data, &w, &h, &bps,
+        ret = sreadHeaderSpix((l_uint32 *)data, size, &w, &h, &bps,
                                &spp, &iscmap);
         if (ret)
             return ERROR_INT( "pnm: no header info returned", procName, 1);

diff --git a/src/spixio.c b/src/spixio.c
@@ -190,7 +190,7 @@ l_uint32  data[6];
         return ERROR_INT("file too small to be spix", procName, 1);
     if (fread(data, 4, 6, fp) != 6)
         return ERROR_INT("error reading data", procName, 1);
-    ret = sreadHeaderSpix(data, pwidth, pheight, pbps, pspp, piscmap);
+    ret = sreadHeaderSpix(data, nbytes, pwidth, pheight, pbps, pspp, piscmap);
     return ret;
 }
 
@@ -199,6 +199,7 @@ l_uint32  data[6];
  * \brief   sreadHeaderSpix()
  *
  * \param[in]    data
+ * \param[in]    size      of data
  * \param[out]   pwidth    width
  * \param[out]   pheight   height
  * \param[out]   pbps      bits/sample
@@ -213,6 +214,7 @@ l_uint32  data[6];
  */
 l_ok
 sreadHeaderSpix(const l_uint32  *data,
+                size_t           size,
                 l_int32         *pwidth,
                 l_int32         *pheight,
                 l_int32         *pbps,
@@ -231,6 +233,8 @@ l_int32  d, ncolors;
     *pwidth = *pheight = *pbps = *pspp = 0;
     if (piscmap)
       *piscmap = 0;
+    if (size < 28)
+        return ERROR_INT("size too small", procName, 1);
 
         /* Check file id */
     id = (char *)data;