[
https://issues.apache.org/jira/browse/PDFBOX-6302?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18140271#comment-18140271
]
ASF subversion and git services commented on PDFBOX-6302:
---------------------------------------------------------
Commit 918348db13f8114006d6d7022abbcd1bdbb3cf29 in pdfbox-jbig2's branch
refs/heads/master from Tilman Hausherr
[ https://gitbox.apache.org/repos/asf?p=pdfbox-jbig2.git;h=918348d ]
PDFBOX-6302: Validate JBIG2 dimensions before allocating, by Sharang Gupta with
help by copilot; closes #6
> JBIG2: validate segment dimensions/counts before allocating (overflow
> hardening)
> --------------------------------------------------------------------------------
>
> Key: PDFBOX-6302
> URL: https://issues.apache.org/jira/browse/PDFBOX-6302
> Project: PDFBox
> Issue Type: Improvement
> Components: JBIG2
> Affects Versions: 3.0.5 JBIG2
> Reporter: Sharang Gupta
> Priority: Major
> Fix For: 3.0.6 JBIG2
>
> Time Spent: 2h 10m
> Remaining Estimate: 0h
>
> Several JBIG2 segment decoders size allocations directly from 32-bit header
> fields with no bounds check, so a malformed stream can overflow an int into
> an undersized backing array (later written past), or request a negative
> allocation that throws NegativeArraySizeException out of ImageIO.read.
> PR: https://github.com/apache/pdfbox-jbig2/pull/6 adds overflow/negative
> guards at four allocation sites (Bitmap, SymbolDictionary, PatternDictionary,
> HalftoneRegion), mirroring the project's existing validation
> (SymbolDictionary.getToExportFlags, PatternDictionary.checkInput), with
> BitmapTest cases that fail on master and pass with the change.
> Scope: these guard against int overflow and negative sizing (the
> memory-safety issue - an undersized array that is then written past); they do
> not cap large-but-in-range allocations, which remain the embedding
> application's responsibility. Reached via ImageIO.read / PDFBox JBIG2
> decoding on malformed input. No security impact is claimed: per the PDFBox
> security policy, resource exhaustion is out of scope, so this is robustness
> hardening.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
