[PATCH] fax: Three allocation-related arithmetic operations use attacker-influenced...

From e5f088674223019fafac26800a2ae0c0d6afc85b Mon Sep 17 00:00:00 2001
From: George Karagiannidis <gbkaragiannidis@gmail.com>
Date: Mon, 4 May 2026 22:47:41 +0200
Subject: [PATCH] fax: The Ghostscript / PC Research fax header handling at
 line 109 performs

From 466786c354d890e39a3871f80ed686958d2513a2 Mon Sep 17 00:00:00 2001
From: George Karagiannidis <gbkaragiannidis@gmail.com>
Date: Mon, 4 May 2026 22:47:23 +0200
Subject: [PATCH] fax: A zero-byte .g3 file causes getstrip() to allocate a
 4-byte buffer

Gbp-Pq: Name fax-security.patch

diff --git a/generators/fax/faxdocument.cpp b/generators/fax/faxdocument.cpp
index 4c955c3076595a9d4dfe30ebe19393995219a499..afb5e2cad88cc7a69361d24ccfab2dda0720ccc9 100644 (file)
--- a/generators/fax/faxdocument.cpp
+++ b/generators/fax/faxdocument.cpp
@@ -55,7 +55,18 @@ static bool new_image(pagenode *pn, int width, int height)
     pn->image.setColor(1, qRgb(0, 0, 0));
     pn->bytes_per_line = pn->image.bytesPerLine();
     pn->dpi = FAX_DPI_FINE;
-    pn->imageData = new uchar[width * height];
+
+    if (width <= 0 || height <= 0) {
+        return false;
+    }
+    const size_t alloc_size = static_cast<size_t>(width) * static_cast<size_t>(height);
+    if (alloc_size / width != static_cast<size_t>(height)) {
+        return false;
+    }
+    if (alloc_size > 256 * 1024 * 1024) {
+        return false;
+    }
+    pn->imageData = new uchar[alloc_size];
 
     return !pn->image.isNull();
 }
@@ -88,6 +99,10 @@ static unsigned char *getstrip(pagenode *pn, int strip)
         return nullptr;
     }
 
+    if (pn->length == 0) {
+        return nullptr;
+    }
+
     /* round size to full boundary plus t32bits */
     roundup = (pn->length + 7) & ~3;
 
@@ -106,7 +121,7 @@ static unsigned char *getstrip(pagenode *pn, int strip)
 
     pn->data = reinterpret_cast<t16bits *>(data);
 
-    if (pn->strips == nullptr && memcmp(data, FAXMAGIC, sizeof(FAXMAGIC) - 1) == 0) {
+    if (pn->strips == nullptr && pn->length >= 64 && memcmp(data, FAXMAGIC, sizeof(FAXMAGIC) - 1) == 0) {
         /* handle ghostscript / PC Research fax file */
         pn->length -= 64;
         pn->vres = data[29];
@@ -116,7 +131,11 @@ static unsigned char *getstrip(pagenode *pn, int strip)
 
     normalize(pn, !pn->lsbfirst, ShortOrder, roundup);
     if (pn->size.height() == 0) {
-        pn->size.setHeight(G3count(pn, pn->expander == g32expand));
+        int h = G3count(pn, pn->expander == g32expand);
+        if (h > 65536) {
+            h = 0;
+        }
+        pn->size.setHeight(h);
     }
 
     if (pn->size.height() == 0) {
@@ -270,7 +289,14 @@ bool FaxDocument::load()
     int height = d->mPageNode.size.height();
     int bytes_per_line = d->mPageNode.size.width() / 8;
 
-    QByteArray bytes(height * bytes_per_line, 0);
+    if (height <= 0 || bytes_per_line <= 0) {
+        return false;
+    }
+    const qint64 total = static_cast<qint64>(height) * static_cast<qint64>(bytes_per_line);
+    if (total > 256 * 1024 * 1024) {
+        return false;
+    }
+    QByteArray bytes(static_cast<int>(total), 0);
     for (int y = height - 1; y >= 0; --y) {
         quint32 offset = y * bytes_per_line;
         quint32 *source = reinterpret_cast<quint32 *>(d->mPageNode.imageData + offset);