Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cast int before potentially exceeding INT_MAX #8402

Merged
merged 1 commit into from
Oct 1, 2024

Conversation

radarhere
Copy link
Member

@radarhere radarhere commented Sep 22, 2024

Resolves #8401

tablen is an integer

int tablen;

and before we set it to im->bands * im->ysize, we check that the value will be less than INT_MAX

if (im->xsize > INT_MAX / im->bands || im->ysize > INT_MAX / im->bands) {
state->errcode = IMAGING_CODEC_MEMORY;
return -1;

but we then temporarily multiply it by 8, which might exceed INT_MAX.

c->tablen = im->bands * im->ysize;
/* below, we populate the starttab and lentab into the bufsize,
each with 4 bytes per element of tablen
Check here before we allocate any memory
*/
if (c->bufsize < 8 * c->tablen) {

So this PR casts it to int64_t before applying the multiplication.

@hugovk hugovk merged commit 747fdf5 into python-pillow:main Oct 1, 2024
49 checks passed
@radarhere radarhere deleted the sgirle branch October 1, 2024 11:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Possible integer overflow in ImagingSgiRleDecode (SgiRleDecode.c)
2 participants