wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-10-21 14:47:31 +09:00
Code Issues Projects Releases Packages Wiki Activity

Avoid overflow in nsPNGEncoder::WriteCallback.

Browse source
This commit is contained in:
wolfbeast 2018-12-13 14:25:47 +01:00 • committed by Roy Tam
commit f52945acfa
2 changed files with 40 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

52
image/encoders/png/nsPNGEncoder.cpp
View file

@ -9,6 +9,7 @@
#include "nsStreamUtils.h" #include "nsStreamUtils.h"
#include "nsString.h" #include "nsString.h"
#include "prprf.h" #include "prprf.h"
#include "mozilla/CheckedInt.h"
using namespace mozilla; using namespace mozilla;
@ -703,30 +704,55 @@ nsPNGEncoder::WriteCallback(png_structp png, png_bytep data,
return; return;
} }
if (that->mImageBufferUsed + size > that->mImageBufferSize) { CheckedUint32 sizeNeeded = CheckedUint32(that->mImageBufferUsed) + size;
if (!sizeNeeded.isValid()) {
// Take the lock to ensure that nobody is trying to read from the buffer
// we are destroying
ReentrantMonitorAutoEnter autoEnter(that->mReentrantMonitor);
that->NullOutImageBuffer();
return;
}
if (sizeNeeded.value() > that->mImageBufferSize) {
// When we're reallocing the buffer we need to take the lock to ensure // When we're reallocing the buffer we need to take the lock to ensure
// that nobody is trying to read from the buffer we are destroying // that nobody is trying to read from the buffer we are destroying
ReentrantMonitorAutoEnter autoEnter(that->mReentrantMonitor); ReentrantMonitorAutoEnter autoEnter(that->mReentrantMonitor);
// expand buffer, just double each time while (sizeNeeded.value() > that->mImageBufferSize) {
that->mImageBufferSize *= 2; // expand buffer, just double each time
uint8_t* newBuf = (uint8_t*)realloc(that->mImageBuffer, CheckedUint32 bufferSize = CheckedUint32(that->mImageBufferSize) * 2;
that->mImageBufferSize); if (!bufferSize.isValid()) {
if (!newBuf) { that->NullOutImageBuffer();
// can't resize, just zero (this will keep us from writing more) return;
free(that->mImageBuffer); }
that->mImageBuffer = nullptr; that->mImageBufferSize *= 2;
that->mImageBufferSize = 0; uint8_t* newBuf = (uint8_t*)realloc(that->mImageBuffer,
that->mImageBufferUsed = 0; that->mImageBufferSize);
return; if (!newBuf) {
// can't resize, just zero (this will keep us from writing more)
that->NullOutImageBuffer();
return;
}
that->mImageBuffer = newBuf;
} }
that->mImageBuffer = newBuf;
} }
memcpy(&that->mImageBuffer[that->mImageBufferUsed], data, size); memcpy(&that->mImageBuffer[that->mImageBufferUsed], data, size);
that->mImageBufferUsed += size; that->mImageBufferUsed += size;
that->NotifyListener(); that->NotifyListener();
} }
void nsPNGEncoder::NullOutImageBuffer()
{
mReentrantMonitor.AssertCurrentThreadIn();
free(mImageBuffer);
mImageBuffer = nullptr;
mImageBufferSize = 0;
mImageBufferUsed = 0;
}
void void
nsPNGEncoder::NotifyListener() nsPNGEncoder::NotifyListener()
{ {

1
image/encoders/png/nsPNGEncoder.h
View file

@ -54,6 +54,7 @@ protected:
static void WarningCallback(png_structp png_ptr, png_const_charp warning_msg); static void WarningCallback(png_structp png_ptr, png_const_charp warning_msg);
static void ErrorCallback(png_structp png_ptr, png_const_charp error_msg); static void ErrorCallback(png_structp png_ptr, png_const_charp error_msg);
static void WriteCallback(png_structp png, png_bytep data, png_size_t size); static void WriteCallback(png_structp png, png_bytep data, png_size_t size);
void NullOutImageBuffer();
void NotifyListener(); void NotifyListener();
png_struct* mPNG; png_struct* mPNG;