Skip to content

Fix CVEs #38

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
liberodark wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Fix CVEs #38

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions Source/Plugins/PSDParser.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -777,6 +777,10 @@ int psdThumbnail::Read(FreeImageIO *io, fi_handle handle, int iResourceSize, boo
FreeImage_Unload(_dib);
}

if (_WidthBytes != _Width * _BitPerPixel / 8) {
throw "Invalid PSD image";
}

if (_Format == 1) {
// kJpegRGB thumbnail image
_dib = FreeImage_LoadFromHandle(FIF_JPEG, io, handle);
Expand Down
37 changes: 20 additions & 17 deletions Source/Plugins/PluginICO.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,15 +65,15 @@ typedef struct tagICONDIRECTORYENTRY {

/** How wide, in bytes, would this many bits be, uint32_t aligned ?
*/
static int
static int
WidthBytes(int bits) {
return ((((bits) + 31)>>5)<<2);
}

/** Calculates the size of a single icon image
@return Returns the size for that image
*/
static uint32_t
static uint32_t
CalculateImageSize(FIBITMAP* icon_dib) {
uint32_t dwNumBytes = 0;

Expand All @@ -93,10 +93,10 @@ CalculateImageSize(FIBITMAP* icon_dib) {
/** Calculates the file offset for an icon image
@return Returns the file offset for that image
*/
static uint32_t
static uint32_t
CalculateImageOffset(const std::vector<std::unique_ptr<FIBITMAP, decltype(&FreeImage_Unload)>> &vPages, int nIndex ) {
// calculate the ICO header size
uint32_t dwSize = sizeof(ICONHEADER);
uint32_t dwSize = sizeof(ICONHEADER);
// add the ICONDIRENTRY's
dwSize += (uint32_t)( vPages.size() * sizeof(ICONDIRENTRY) );
// add the sizes of the previous images
Expand Down Expand Up @@ -220,7 +220,7 @@ SupportsExportDepth(int depth) {
);
}

static FIBOOL DLL_CALLCONV
static FIBOOL DLL_CALLCONV
SupportsExportType(FREE_IMAGE_TYPE type) {
return (type == FIT_BITMAP) ? TRUE : FALSE;
}
Expand Down Expand Up @@ -297,6 +297,9 @@ LoadStandardIcon(FreeImageIO *io, fi_handle handle, int flags, FIBOOL header_onl
const int width = bmih.biWidth;
const int height = bmih.biHeight / 2; // height == xor + and mask
const unsigned bit_count = bmih.biBitCount;
if (bit_count != 1 && bit_count != 2 && bit_count != 4 && bit_count != 8 && bit_count != 16 && bit_count != 24 && bit_count != 32) {
return NULL;
Copy link
Contributor

@lordnn lordnn Dec 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nullptr

}
const unsigned line = CalculateLine(width, bit_count);
const unsigned pitch = CalculatePitch(line);

Expand All @@ -318,7 +321,7 @@ LoadStandardIcon(FreeImageIO *io, fi_handle handle, int flags, FIBOOL header_onl
}
#endif
}

if (header_only) {
// header only mode
return dib.release();
Expand Down Expand Up @@ -445,7 +448,7 @@ Load(FreeImageIO *io, fi_handle handle, int page, int flags, void *data) {

// ----------------------------------------------------------

static FIBOOL
static FIBOOL
SaveStandardIcon(FreeImageIO *io, FIBITMAP *dib, fi_handle handle) {
// write the BITMAPINFOHEADER
auto *bmih = FreeImage_GetInfoHeader(dib);
Expand Down Expand Up @@ -558,13 +561,13 @@ SaveStandardIcon(FreeImageIO *io, FIBITMAP *dib, fi_handle handle) {
for (int x = 0; x < width; x++) {
if (bits[x].alpha != 0xFF) {
// set any transparent color to full transparency
and_bits[x >> 3] |= (0x80 >> (x & 0x7));
and_bits[x >> 3] |= (0x80 >> (x & 0x7));
}
}

and_bits += width_and;
}
}
}
else if (bit_count <= 8) {
// create the AND mask from the transparency table

Expand All @@ -586,7 +589,7 @@ SaveStandardIcon(FreeImageIO *io, FIBITMAP *dib, fi_handle handle) {
uint8_t index = (bits[x >> 3] & (0x80 >> (x & 0x07))) != 0;
if (trns[index] != 0xFF) {
// set any transparent color to full transparency
and_bits[x >> 3] |= (0x80 >> (x & 0x7));
and_bits[x >> 3] |= (0x80 >> (x & 0x7));
}
}
and_bits += width_and;
Expand All @@ -604,7 +607,7 @@ SaveStandardIcon(FreeImageIO *io, FIBITMAP *dib, fi_handle handle) {
uint8_t index = (bits[x >> 1] & (0x0F << shift)) >> shift;
if (trns[index] != 0xFF) {
// set any transparent color to full transparency
and_bits[x >> 3] |= (0x80 >> (x & 0x7));
and_bits[x >> 3] |= (0x80 >> (x & 0x7));
}
}
and_bits += width_and;
Expand All @@ -621,7 +624,7 @@ SaveStandardIcon(FreeImageIO *io, FIBITMAP *dib, fi_handle handle) {
uint8_t index = bits[x];
if (trns[index] != 0xFF) {
// set any transparent color to full transparency
and_bits[x >> 3] |= (0x80 >> (x & 0x7));
and_bits[x >> 3] |= (0x80 >> (x & 0x7));
}
}
and_bits += width_and;
Expand Down Expand Up @@ -663,7 +666,7 @@ Save(FreeImageIO *io, FIBITMAP *dib, fi_handle handle, int page, int flags, void
if (page == -1) {
page = 0;
}

// get the icon header
icon_header = (ICONHEADER*)data;

Expand Down Expand Up @@ -696,7 +699,7 @@ Save(FreeImageIO *io, FIBITMAP *dib, fi_handle handle, int page, int flags, void

// write all icons
// ...

// save the icon descriptions

std::unique_ptr<void, decltype(&free)> safeList(calloc(icon_header->idCount, sizeof(ICONDIRENTRY)), &free);
Expand Down Expand Up @@ -731,12 +734,12 @@ Save(FreeImageIO *io, FIBITMAP *dib, fi_handle handle, int page, int flags, void
io->write_proc(icon_list, sizeof(ICONDIRENTRY) * icon_header->idCount, 1, handle);

// write the image bits for each image

uint32_t dwImageOffset = (uint32_t)io->tell_proc(handle);

for (k = 0; k < icon_header->idCount; k++) {
icon_dib = vPages[k].get();

if ((icon_list[k].bWidth == 0) && (icon_list[k].bHeight == 0)) {
// Vista icon support
FreeImage_SaveToHandle(FIF_PNG, icon_dib, io, handle, PNG_DEFAULT);
Expand All @@ -747,7 +750,7 @@ Save(FreeImageIO *io, FIBITMAP *dib, fi_handle handle, int page, int flags, void
SaveStandardIcon(io, icon_dib, handle);
}

// update ICONDIRENTRY members
// update ICONDIRENTRY members
uint32_t dwBytesInRes = (uint32_t)io->tell_proc(handle) - dwImageOffset;
icon_list[k].dwImageOffset = dwImageOffset;
icon_list[k].dwBytesInRes = dwBytesInRes;
Expand Down
Loading