sergiotarxz/libvips
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

stop JPEG load after 20 warnings

Browse Source 
mitigates some DoS attacks somewhat

see https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24383
This commit is contained in:
John Cupitt 2022-04-03 19:21:06 +01:00
parent 55b857d446
commit 89bd46d1c4
2 changed files with 29 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libvips/foreign/jpeg2vips.c
View File

@ -488,6 +488,12 @@ read_jpeg_header( ReadJpeg *jpeg, VipsImage *out )
size_t data_length;
int i;
/* Trace level 3 means emit warning messages as they happen. This
* lets us spot files with crazy numbers of warnings early and
* prevents some DoS attacks.
*/
jpeg->eman.pub.trace_level = 3;
/* Read JPEG header. libjpeg will set out_color_space sanely for us
* for YUV YCCK etc.
*/

32
libvips/foreign/vips2jpeg.c
View File

@ -165,20 +165,34 @@
void
vips__new_output_message( j_common_ptr cinfo )
{
char buffer[JMSG_LENGTH_MAX];
/* Some DoS attacks use jpg files with thousands of warnings. Try to
* limit the effect these have.
*/
if( cinfo->err->num_warnings >= 20 ) {
if( cinfo->err->num_warnings == 20 ) {
vips_error( "VipsJpeg",
"%s", _( "too many warnings" ) );
}
(*cinfo->err->format_message)( cinfo, buffer );
vips_error( "VipsJpeg", _( "%s" ), buffer );
jpeg_abort( cinfo );
}
else {
char buffer[JMSG_LENGTH_MAX];
(*cinfo->err->format_message)( cinfo, buffer );
vips_error( "VipsJpeg", _( "%s" ), buffer );
#ifdef DEBUG
printf( "vips__new_output_message: \"%s\"\n", buffer );
printf( "vips__new_output_message: \"%s\"\n", buffer );
#endif /*DEBUG*/
/* This is run for things like file truncated. Signal invalidate to
* force this op out of cache.
*/
if( cinfo->client_data )
vips_foreign_load_invalidate( VIPS_IMAGE( cinfo->client_data ) );
/* This is run for things like file truncated. Signal
* invalidate to force this op out of cache.
*/
if( cinfo->client_data )
vips_foreign_load_invalidate(
VIPS_IMAGE( cinfo->client_data ) );
}
}
/* New error_exit handler.