Segmentation Fault on a PCD image #568
Comments
|
Ok, that's weird. The backtrace I'm getting is entirely python code. I'm seeing it on multiple python versions, multiple versions of Pillow. |
|
@lehins Thanks for reporting |
|
I'm currently targeting 2.4.0 for this, though I expect we may not get to it. |
|
Ok. This is still weird. I've thrown this at Fedora 20, where GDB is better integrated with the python runtime. It's failing in ImageFile.load: n = 64512, len(b) == 66560. It's the second time through, so b == ~1k from the first round, and 64k from this read, and we're indexing for the last 2k. This seems entirely reasonable to me. The only thing that I can think of is that the decode must be messing with the buffer, but that doesn't seem to be the case. Detailed traces &c follow. Py-bt is really short: The locals from the current python frame: Full bt, truncated to the call to Image.resize |
|
I'm getting a suspicious memory error when run under glibc 2.20 with Pillow 2.5.3 on an authentic PhotoCD image: Curiously, the Valgrind gives even more useful messages; here is a selection: |
|
@dfandrich can you please try with 2.7.0 and confirm the same issue still exists? Thanks |
|
I just tried with git HEAD with seemingly identical results. The line numbers were slightly different, e.g. ==5395== Invalid write of size 1 |
|
If it's an invalid write, then our output buffer for decoding the image is bad: That's a strange error, but this is a strange format. It looks like there's a project that claims to decode all the sizes in a .pcd, with color mangement: http://pcdtojpeg.sourceforge.net/Home.html That may be a better approach than Pillow, since we don't even pretend to do the compressed higher res images. |
|
The link to the problem file no longer works. Can anyone provide a file to demonstrate the problem? |
|
Here is another file, that causes segmentation fault on |
|
Thanks for that. I will note that it's not just |
|
Ok, I got it. The shuffle/state buffer is malloc'd at 24bpp, and the filling of it is at 32 bpp. Now, what's really lovely is that the original image (which I still have hanging around) comes up with color issues in pillow, but works in imagemagick. And the one posted today has color issues in imagemagick but works on pillow. But that's an issue for another PR. |
wiredfool
added a commit
that referenced
this issue
Feb 4, 2016
PCD decoder overruns the shuffle buffer, Fixes #568
wiredfool
added a commit
that referenced
this issue
Feb 4, 2016
|
Could this buffer overflow have security implications? Can it overflow by more than a single byte (which isn't necessary safe either)? |
|
It overflows 768 bytes. The pattern is writing the first three bytes of the word, then leaves the next untouched. I'd recommend updating to 3.1.1, which includes this fix. |
|
In that case, it sounds very strongly like this is a potentially exploitable security problem. Are you planning on applying for a CVE number? |
|
I found the CVE request—http://openwall.com/lists/oss-security/2016/02/02/5 |
|
Yep. The release notes may be helpful as well: https://github.com/python-pillow/Pillow/blob/3.1.x/docs/releasenotes/3.1.1.rst |
uqs
pushed a commit
to freebsd/freebsd-ports
that referenced
this issue
Feb 13, 2016
Backport security fixes from 3.1.1 release, resolving the following vulnerabilities: * CVE-2016-0775: Buffer overflow in FLI decoding code * CVE-2016-0740: Buffer overflow in TIFF decoding code * Integer overflow in Resample.c [1] * Buffer overflow in PCD decoder [2] [1] python-pillow/Pillow#1710 [2] python-pillow/Pillow#568 PR: 207053 Submitted by: rakuco MFH: 2016Q1 Security: a8de962a-cf15-11e5-805c-5453ed2e2b49 git-svn-id: svn+ssh://svn.freebsd.org/ports/head@408782 35697150-7ecd-e111-bb59-0022644237b5
uqs
pushed a commit
to freebsd/freebsd-ports
that referenced
this issue
Feb 13, 2016
Backport security fixes from 3.1.1 release, resolving the following vulnerabilities: * CVE-2016-0775: Buffer overflow in FLI decoding code * CVE-2016-0740: Buffer overflow in TIFF decoding code * Integer overflow in Resample.c [1] * Buffer overflow in PCD decoder [2] [1] python-pillow/Pillow#1710 [2] python-pillow/Pillow#568 PR: 207053 Submitted by: rakuco MFH: 2016Q1 Security: a8de962a-cf15-11e5-805c-5453ed2e2b49
uqs
pushed a commit
to freebsd/freebsd-ports
that referenced
this issue
Feb 13, 2016
Backport security fixes from 3.1.1 release, resolving the following vulnerabilities: * CVE-2016-0775: Buffer overflow in FLI decoding code * CVE-2016-0740: Buffer overflow in TIFF decoding code * Integer overflow in Resample.c [1] * Buffer overflow in PCD decoder [2] [1] python-pillow/Pillow#1710 [2] python-pillow/Pillow#568 PR: 207053 Submitted by: rakuco Security: a8de962a-cf15-11e5-805c-5453ed2e2b49 Approved by: ports-secteam (security)
tota
pushed a commit
to tota/freebsd-ports
that referenced
this issue
Feb 20, 2016
Backport security fixes from 3.1.1 release, resolving the following vulnerabilities: * CVE-2016-0775: Buffer overflow in FLI decoding code * CVE-2016-0740: Buffer overflow in TIFF decoding code * Integer overflow in Resample.c [1] * Buffer overflow in PCD decoder [2] [1] python-pillow/Pillow#1710 [2] python-pillow/Pillow#568 PR: 207053 Submitted by: rakuco MFH: 2016Q1 Security: a8de962a-cf15-11e5-805c-5453ed2e2b49 git-svn-id: svn+ssh://svn.freebsd.org/ports/head@408782 35697150-7ecd-e111-bb59-0022644237b5
uqs
pushed a commit
to freebsd/freebsd-ports
that referenced
this issue
Dec 2, 2016
Backport security fixes from 3.1.1 release, resolving the following vulnerabilities: * CVE-2016-0775: Buffer overflow in FLI decoding code * CVE-2016-0740: Buffer overflow in TIFF decoding code * Integer overflow in Resample.c [1] * Buffer overflow in PCD decoder [2] [1] python-pillow/Pillow#1710 [2] python-pillow/Pillow#568 PR: 207053 Submitted by: rakuco Security: a8de962a-cf15-11e5-805c-5453ed2e2b49 Approved by: ports-secteam (security)
uqs
pushed a commit
to freebsd/freebsd-ports
that referenced
this issue
Apr 1, 2021
Backport security fixes from 3.1.1 release, resolving the following vulnerabilities: * CVE-2016-0775: Buffer overflow in FLI decoding code * CVE-2016-0740: Buffer overflow in TIFF decoding code * Integer overflow in Resample.c [1] * Buffer overflow in PCD decoder [2] [1] python-pillow/Pillow#1710 [2] python-pillow/Pillow#568 PR: 207053 Submitted by: rakuco Security: a8de962a-cf15-11e5-805c-5453ed2e2b49 Approved by: ports-secteam (security)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Here is a link to the file that causes the problem: http://526ddd950476442e0e6c-adab491b4c7746bcac4e5a193c3c94e6.r70.cf1.rackcdn.com/golden.pcd
This file was created using 'convert', so it might not have proper formatting/header or whatever else, but it most definitely shouldn't cause a seg fault.
Let me know if any other info is needed.
A fix for this error is not crucial for me, just want to help make this library even better.
The text was updated successfully, but these errors were encountered: