ext / ext/jpegsplit

code segfaults if there is missing or maliciously crafted appended png header after the file

Open
#1 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
0
Forks
0
PR merge metrics
No merged PRs in 30d

Description

@ext
code throws segfault if the end of file marker is maliciously modified as well as if a legitimate header is inserted after the file as the break for IEND never fires
suggest changing the loop condition in the do_png function to while (ptr <= end); as well as not parsing if there are bytes leftover past end mark as re-parsing the maliciously spliced header causes the program to loop forever searching for non existing end in second part untill it segfaults
I'm attaching two example test files that can make the program segfault as well as my proof-of-concept fix
![GRIM_REAPER1](https://user-images.githubusercontent.com/87328679/178575287-677f88b0-934d-4cb0-87c3-2e53df1aefbe.png)
![GRIM_REAPER2](https://user-images.githubusercontent.com/87328679/178575314-22fa32fa-fe5f-4468-9a53-7e1e05a15b10.png)
[Superjpegsplit.c.zip](https://github.com/ext/jpegsplit/files/9096134/Superjpegsplit.c.zip)

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.