From dfb95b31fc511a86956d1d569851a323de5ad2b2 Mon Sep 17 00:00:00 2001 From: George Karagiannidis Date: Mon, 4 May 2026 23:00:56 +0200 Subject: [PATCH] [PATCH] fax: Three allocation-related arithmetic operations use attacker-influenced dimensions without overflow checks: From e5f088674223019fafac26800a2ae0c0d6afc85b Mon Sep 17 00:00:00 2001 From: George Karagiannidis Date: Mon, 4 May 2026 22:47:41 +0200 Subject: [PATCH] fax: The Ghostscript / PC Research fax header handling at line 109 performs From 466786c354d890e39a3871f80ed686958d2513a2 Mon Sep 17 00:00:00 2001 From: George Karagiannidis Date: Mon, 4 May 2026 22:47:23 +0200 Subject: [PATCH] fax: A zero-byte .g3 file causes getstrip() to allocate a 4-byte buffer Gbp-Pq: Name fax-security.patch --- generators/fax/faxdocument.cpp | 34 ++++++++++++++++++++++++++++++---- 1 file changed, 30 insertions(+), 4 deletions(-) diff --git a/generators/fax/faxdocument.cpp b/generators/fax/faxdocument.cpp index 4c955c3..afb5e2c 100644 --- a/generators/fax/faxdocument.cpp +++ b/generators/fax/faxdocument.cpp @@ -55,7 +55,18 @@ static bool new_image(pagenode *pn, int width, int height) pn->image.setColor(1, qRgb(0, 0, 0)); pn->bytes_per_line = pn->image.bytesPerLine(); pn->dpi = FAX_DPI_FINE; - pn->imageData = new uchar[width * height]; + + if (width <= 0 || height <= 0) { + return false; + } + const size_t alloc_size = static_cast(width) * static_cast(height); + if (alloc_size / width != static_cast(height)) { + return false; + } + if (alloc_size > 256 * 1024 * 1024) { + return false; + } + pn->imageData = new uchar[alloc_size]; return !pn->image.isNull(); } @@ -88,6 +99,10 @@ static unsigned char *getstrip(pagenode *pn, int strip) return nullptr; } + if (pn->length == 0) { + return nullptr; + } + /* round size to full boundary plus t32bits */ roundup = (pn->length + 7) & ~3; @@ -106,7 +121,7 @@ static unsigned char *getstrip(pagenode *pn, int strip) pn->data = reinterpret_cast(data); - if (pn->strips == nullptr && memcmp(data, FAXMAGIC, sizeof(FAXMAGIC) - 1) == 0) { + if (pn->strips == nullptr && pn->length >= 64 && memcmp(data, FAXMAGIC, sizeof(FAXMAGIC) - 1) == 0) { /* handle ghostscript / PC Research fax file */ pn->length -= 64; pn->vres = data[29]; @@ -116,7 +131,11 @@ static unsigned char *getstrip(pagenode *pn, int strip) normalize(pn, !pn->lsbfirst, ShortOrder, roundup); if (pn->size.height() == 0) { - pn->size.setHeight(G3count(pn, pn->expander == g32expand)); + int h = G3count(pn, pn->expander == g32expand); + if (h > 65536) { + h = 0; + } + pn->size.setHeight(h); } if (pn->size.height() == 0) { @@ -270,7 +289,14 @@ bool FaxDocument::load() int height = d->mPageNode.size.height(); int bytes_per_line = d->mPageNode.size.width() / 8; - QByteArray bytes(height * bytes_per_line, 0); + if (height <= 0 || bytes_per_line <= 0) { + return false; + } + const qint64 total = static_cast(height) * static_cast(bytes_per_line); + if (total > 256 * 1024 * 1024) { + return false; + } + QByteArray bytes(static_cast(total), 0); for (int y = height - 1; y >= 0; --y) { quint32 offset = y * bytes_per_line; quint32 *source = reinterpret_cast(d->mPageNode.imageData + offset); -- 2.30.2