Sharang Gupta created PDFBOX-6302:
-------------------------------------
Summary: JBIG2: validate segment dimensions/counts before
allocating (overflow hardening)
Key: PDFBOX-6302
URL: https://issues.apache.org/jira/browse/PDFBOX-6302
Project: PDFBox
Issue Type: Improvement
Components: JBIG2
Reporter: Sharang Gupta
Several JBIG2 segment decoders size allocations directly from 32-bit header
fields with no bounds check, so a malformed stream can overflow an int into an
undersized backing array (later written past), or request a negative allocation
that throws NegativeArraySizeException out of ImageIO.read.
PR: https://github.com/apache/pdfbox-jbig2/pull/6 adds overflow/negative guards
at four allocation sites (Bitmap, SymbolDictionary, PatternDictionary,
HalftoneRegion), mirroring the project's existing validation
(SymbolDictionary.getToExportFlags, PatternDictionary.checkInput), with
BitmapTest cases that fail on master and pass with the change.
Scope: these guard against int overflow and negative sizing (the memory-safety
issue - an undersized array that is then written past); they do not cap
large-but-in-range allocations, which remain the embedding application's
responsibility. Reached via ImageIO.read / PDFBox JBIG2 decoding on malformed
input. No security impact is claimed: per the PDFBox security policy, resource
exhaustion is out of scope, so this is robustness hardening.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
