[
https://issues.apache.org/jira/browse/PDFBOX-6302?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Tilman Hausherr updated PDFBOX-6302:
------------------------------------
Affects Version/s: 3.0.5 JBIG2
> JBIG2: validate segment dimensions/counts before allocating (overflow
> hardening)
> --------------------------------------------------------------------------------
>
> Key: PDFBOX-6302
> URL: https://issues.apache.org/jira/browse/PDFBOX-6302
> Project: PDFBox
> Issue Type: Improvement
> Components: JBIG2
> Affects Versions: 3.0.5 JBIG2
> Reporter: Sharang Gupta
> Priority: Major
>
> Several JBIG2 segment decoders size allocations directly from 32-bit header
> fields with no bounds check, so a malformed stream can overflow an int into
> an undersized backing array (later written past), or request a negative
> allocation that throws NegativeArraySizeException out of ImageIO.read.
> PR: https://github.com/apache/pdfbox-jbig2/pull/6 adds overflow/negative
> guards at four allocation sites (Bitmap, SymbolDictionary, PatternDictionary,
> HalftoneRegion), mirroring the project's existing validation
> (SymbolDictionary.getToExportFlags, PatternDictionary.checkInput), with
> BitmapTest cases that fail on master and pass with the change.
> Scope: these guard against int overflow and negative sizing (the
> memory-safety issue - an undersized array that is then written past); they do
> not cap large-but-in-range allocations, which remain the embedding
> application's responsibility. Reached via ImageIO.read / PDFBox JBIG2
> decoding on malformed input. No security impact is claimed: per the PDFBox
> security policy, resource exhaustion is out of scope, so this is robustness
> hardening.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
