Skip to content

Fixed fread size check for corrupted PNGs#26734

Merged
asmorkalov merged 1 commit intoopencv:4.xfrom
asmorkalov:as/png_corrupted
Jan 8, 2025
Merged

Fixed fread size check for corrupted PNGs#26734
asmorkalov merged 1 commit intoopencv:4.xfrom
asmorkalov:as/png_corrupted

Conversation

@asmorkalov
Copy link
Copy Markdown
Contributor

Pull Request Readiness Checklist

See details at https://github.com/opencv/opencv/wiki/How_to_contribute#making-a-good-pull-request

  • I agree to contribute to the project under Apache 2 License.
  • To the best of my knowledge, the proposed patch is not based on a code under GPL or another license that is incompatible with OpenCV
  • The PR is proposed to the proper branch
  • There is a reference to the original bug report and related work
  • There is accuracy test, performance test and test data in opencv_extra repository, if applicable
    Patch to opencv_extra has the same branch name.
  • The feature is well documented and sample code can be built with the project CMake

@vrabaud
Copy link
Copy Markdown
Contributor

vrabaud commented Jan 8, 2025

LGTM. That does not fix the asan issue though.

@vrabaud
Copy link
Copy Markdown
Contributor

vrabaud commented Jan 8, 2025

Or maybe:

                if (fread(sig, 8, 1, m_f) != 1)
                    return false;
                id = read_chunk(m_chunkIHDR);

To have code similar to what's below.

@vrabaud
Copy link
Copy Markdown
Contributor

vrabaud commented Jan 8, 2025

Actually, shoulnd't that be out of the {} ?

            if( !m_buf.empty() )
                png_set_read_fn(png_ptr, this, (png_rw_ptr)readDataFromBuf );
            else
            {
                m_f = fopen(m_filename.c_str(), "rb");
                if (!m_f)
                {
                    return false;
                }
                png_init_io(png_ptr, m_f);
            }

            if (read_from_io(&sig, 8, 1) != 1)
                return false;
            id = read_chunk(m_chunkIHDR);

            if (!(id == id_IHDR && m_chunkIHDR.p.size() == 25))
            {
                return false;
            }

@asmorkalov
Copy link
Copy Markdown
Contributor Author

yes, makes sense.

@vrabaud
Copy link
Copy Markdown
Contributor

vrabaud commented Jan 8, 2025

While at it read_from_io always takes 1 as a last argument, let's remove it (and replace it by 1 internally) and have it return a bool instead.

@asmorkalov
Copy link
Copy Markdown
Contributor Author

Let's do it after release. There are more cases for cleanup, but they are less important for now.

@asmorkalov asmorkalov merged commit d270454 into opencv:4.x Jan 8, 2025
@asmorkalov asmorkalov mentioned this pull request Jan 15, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants