cjpeg: Fix OOB read caused by malformed 8-bit TGA

... in which one or more of the color indices is out of range for the
number of palette entries.

Fix partly borrowed from jpeg-9c.

Fixes #295

diff --git a/ChangeLog.md b/ChangeLog.md
index 1b9ac698812a6cf2ac0feabde363d7c3a14a49b9..e479b579b0dac30f99671b5a585ea44ee2a11067 100644 (file)
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -18,6 +18,11 @@ incompatible with the soft float ABI.
 the AVX2 SIMD extensions (2.0 beta1[1]), that caused libjpeg-turbo to crash on
 Windows 7 if Service Pack 1 was not installed.
 
+4. Fixed out-of-bounds read in cjpeg that occurred when attempting to compress
+a specially-crafted malformed color-index (8-bit-per-sample) Targa file in
+which some of the samples (color indices) exceeded the bounds of the Targa
+file's color table.
+
 
 2.0.0
 =====

diff --git a/rdtarga.c b/rdtarga.c
index e0c6947befd0ed7ac71b251be243bb7746fe497e..37bd286ae1dadda0c4678d88a50ede90d70928d5 100644 (file)
--- a/rdtarga.c
+++ b/rdtarga.c
@@ -3,8 +3,9 @@
  *
  * This file was part of the Independent JPEG Group's software:
  * Copyright (C) 1991-1996, Thomas G. Lane.
- * It was modified by The libjpeg-turbo Project to include only code relevant
- * to libjpeg-turbo.
+ * Modified 2017 by Guido Vollbeding.
+ * libjpeg-turbo Modifications:
+ * Copyright (C) 2018, D. R. Commander.
  * For conditions of distribution and use, see the accompanying README.ijg
  * file.
  *
@@ -66,6 +67,7 @@ typedef struct _tga_source_struct {
   U_CHAR tga_pixel[4];
 
   int pixel_size;               /* Bytes per Targa pixel (1 to 4) */
+  int cmap_length;              /* colormap length */
 
   /* State info for reading RLE-coded pixels; both counts must be init to 0 */
   int block_count;              /* # of pixels remaining in RLE block */
@@ -196,11 +198,14 @@ get_8bit_row(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
   register JSAMPROW ptr;
   register JDIMENSION col;
   register JSAMPARRAY colormap = source->colormap;
+  int cmaplen = source->cmap_length;
 
   ptr = source->pub.buffer[0];
   for (col = cinfo->image_width; col > 0; col--) {
     (*source->read_pixel) (source); /* Load next pixel into tga_pixel */
     t = UCH(source->tga_pixel[0]);
+    if (t >= cmaplen)
+      ERREXIT(cinfo, JERR_TGA_BADPARMS);
     *ptr++ = colormap[0][t];
     *ptr++ = colormap[1][t];
     *ptr++ = colormap[2][t];
@@ -452,12 +457,14 @@ start_input_tga(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
     /* Allocate space to store the colormap */
     source->colormap = (*cinfo->mem->alloc_sarray)
       ((j_common_ptr)cinfo, JPOOL_IMAGE, (JDIMENSION)maplen, (JDIMENSION)3);
+    source->cmap_length = (int)maplen;
     /* and read it from the file */
     read_colormap(source, (int)maplen, UCH(targaheader[7]));
   } else {
     if (cmaptype)               /* but you promised a cmap! */
       ERREXIT(cinfo, JERR_TGA_BADPARMS);
     source->colormap = NULL;
+    source->cmap_length = 0;
   }
 
   cinfo->input_components = components;