external/zxing/0004-Apply-stb-PR-1223-to-stb_image.patch

   1 From 5ca63122c53fa0703cad9a8257f123a1ca4c43b1 Mon Sep 17 00:00:00 2001
   2 From: "Benjamin A. Beasley" <code@musicinmybrain.net>
   3 Date: Wed, 8 Dec 2021 18:24:31 -0500
   4 Subject: [PATCH 4/4] Apply stb PR#1223 to stb_image
   5
   6 Fixes a crash and an infinite loop in stb_image that could occur with
   7 specially constructed PGM and HDR files
   8
   9 https://github.com/nothings/stb/pull/1223
  10
  11 This is a candidate fix for:
  12
  13   https://nvd.nist.gov/vuln/detail/CVE-2021-42715
  14
  15   In stb_image's HDR reader, loading a specially constructed invalid HDR
  16   file can result in an infinite loop within the RLE decoder
  17   https://github.com/nothings/stb/issues/1224
  18
  19 Additionally, this is a candidate fix for:
  20
  21   https://nvd.nist.gov/vuln/detail/CVE-2021-42716
  22
  23   stbi__pnm_load heap-buffer-overflow bug
  24   https://github.com/nothings/stb/issues/1166
  25
  26   In stb_image's PNM reader, loading a specially constructed valid
  27   16-bit PGM file with 4 channels can cause a crash due to an
  28   out-of-bounds read
  29   https://github.com/nothings/stb/issues/1225
  30 ---
  31  thirdparty/stb/stb_image.h     | 17 ++++++++++++-----
  32  thirdparty/stb/stb_image.patch |  4 ++--
  33  2 files changed, 14 insertions(+), 7 deletions(-)
  34
  35 diff --git a/thirdparty/stb/stb_image.h b/thirdparty/stb/stb_image.h
  36 index c58bc0c..612bc4c 100644
  37 --- a/thirdparty/stb/stb_image.h
  38 +++ b/thirdparty/stb/stb_image.h
  39 @@ -108,7 +108,7 @@ RECENT REVISION HISTORY:
  40      Cass Everitt            Ryamond Barbiero                        github:grim210
  41      Paul Du Bois            Engin Manap        Aldo Culquicondor    github:sammyhw
  42      Philipp Wiesemann       Dale Weiler        Oriol Ferrer Mesia   github:phprus
  43 -    Josh Tobin                                 Matthew Gregan       github:poppolopoppo
  44 +    Josh Tobin              Neil Bickford      Matthew Gregan       github:poppolopoppo
  45      Julian Raschke          Gregory Mullen     Christian Floisand   github:darealshinji
  46      Baldur Karlsson         Kevin Schmidt      JR Smith             github:Michaelangel007
  47                              Brad Weinberger    Matvey Cherevko      github:mosra
  48 @@ -7191,12 +7191,12 @@ static float *stbi__hdr_load(stbi__context *s, int *x, int *y, int *comp, int re
  49                    // Run
  50                    value = stbi__get8(s);
  51                    count -= 128;
  52 -                  if (count > nleft) { STBI_FREE(hdr_data); STBI_FREE(scanline); return stbi__errpf("corrupt", "bad RLE data in HDR"); }
  53 +                  if ((count == 0) || (count > nleft)) { STBI_FREE(hdr_data); STBI_FREE(scanline); return stbi__errpf("corrupt", "bad RLE data in HDR"); }
  54                    for (z = 0; z < count; ++z)
  55                       scanline[i++ * 4 + k] = value;
  56                 } else {
  57                    // Dump
  58 -                  if (count > nleft) { STBI_FREE(hdr_data); STBI_FREE(scanline); return stbi__errpf("corrupt", "bad RLE data in HDR"); }
  59 +                  if ((count == 0) || (count > nleft)) { STBI_FREE(hdr_data); STBI_FREE(scanline); return stbi__errpf("corrupt", "bad RLE data in HDR"); }
  60                    for (z = 0; z < count; ++z)
  61                       scanline[i++ * 4 + k] = stbi__get8(s);
  62                 }
  63 @@ -7450,10 +7450,17 @@ static void *stbi__pnm_load(stbi__context *s, int *x, int *y, int *comp, int req
  64
  65     out = (stbi_uc *) stbi__malloc_mad4(s->img_n, s->img_x, s->img_y, ri->bits_per_channel / 8, 0);
  66     if (!out) return stbi__errpuc("outofmem", "Out of memory");
  67 -   stbi__getn(s, out, s->img_n * s->img_x * s->img_y * (ri->bits_per_channel / 8));
  68 +   if (!stbi__getn(s, out, s->img_n * s->img_x * s->img_y * (ri->bits_per_channel / 8))) {
  69 +      STBI_FREE(out);
  70 +      return stbi__errpuc("bad PNM", "PNM file truncated");
  71 +   }
  72
  73     if (req_comp && req_comp != s->img_n) {
  74 -      out = stbi__convert_format(out, s->img_n, req_comp, s->img_x, s->img_y);
  75 +      if (ri->bits_per_channel == 16) {
  76 +         out = (stbi_uc *) stbi__convert_format16((stbi__uint16 *) out, s->img_n, req_comp, s->img_x, s->img_y);
  77 +      } else {
  78 +         out = stbi__convert_format(out, s->img_n, req_comp, s->img_x, s->img_y);
  79 +      }
  80        if (out == NULL) return out; // stbi__convert_format frees input on failure
  81     }
  82     return out;
  83 diff --git a/thirdparty/stb/stb_image.patch b/thirdparty/stb/stb_image.patch
  84 index f1fee52..1768ba8 100644
  85 --- a/thirdparty/stb/stb_image.patch
  86 +++ b/thirdparty/stb/stb_image.patch
  87 @@ -1,6 +1,6 @@
  88  diff -Naur upstream/stb_image.h zxing/stb_image.h
  89 ---- upstream/stb_image.h       2021-12-08 18:18:07.485461782 -0500
  90 -+++ zxing/stb_image.h  2021-12-08 18:18:29.596689004 -0500
  91 +--- upstream/stb_image.h       2021-12-08 18:22:56.724466161 -0500
  92 ++++ zxing/stb_image.h  2021-12-08 18:23:15.084657043 -0500
  93  @@ -1725,7 +1725,11 @@
  94
  95   static stbi_uc stbi__compute_y(int r, int g, int b)
  96 --
  97 2.33.1
  98