504888 - Integer overflow in qcms

Status: RESOLVED FIXED

(Core :: Graphics: Color Management, defect)

Description

[Jeff Muizelaar [:jrmuizel]]

From Chris Evans:

I saw a possible (but harmless) integer overflow in read_u32() and
similar functions:

static uint32_t read_u32(struct mem_source *mem, size_t offset)
{
 if (offset + 4 > mem->size) {
   invalid_source(mem, "Invalid offset");
   return 0;
 } else {
   return be32_to_cpu(*(__be32*)(mem->buf + offset));
 }
}

On 32-bit platforms where size_t is 32-bits, that first addition could
overflow if offset >= 0xfffffffc (from a tag being declared with such
an offset in the tag table). The impact would seem to be a 4-byte
out-of-bounds read before the "buf" buffer. I know, lame :)

Comment 1

[Jeff Muizelaar [:jrmuizel]]

Attachment: Fix the integer overflow

Comment 2

[Jeff Muizelaar [:jrmuizel]]

Attachment: Test for Nino

Comment 3

[Bobby Holley (:bholley)]

Comment on attachment 389179 [details] [diff] [review]
Fix the integer overflow

looks good. r=bholley

Comment 4

[Jeff Muizelaar [:jrmuizel]]

http://hg.mozilla.org/mozilla-central/rev/8b4c3179b68f

Comment 5

[Samuel Sidler (old account; do not CC)]

I'm guessing we need this on 1.9.1 as well. Jeff, can you work up a patch (or just check if the current one applies) and request approval?

Comment 6

[Samuel Sidler (old account; do not CC)]

Comment on attachment 389179 [details] [diff] [review]
Fix the integer overflow

Approved for 1.9.1.2. a=ss for release-drivers

Please land on mozilla-1.9.1 and use the ".2-fixed" option of the "status1.9.1" flag.

Comment 7

[Samuel Sidler (old account; do not CC)]

Comment on attachment 389179 [details] [diff] [review]
Fix the integer overflow

This didn't land in time for 1.9.1.2.

Comment 8

[Daniel Veditz [:dveditz]]

Comment on attachment 389179 [details] [diff] [review]
Fix the integer overflow

Approved for 1.9.1.4, a=dveditz for release-drivers

Comment 9

[Jeff Muizelaar [:jrmuizel]]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/b7481a9766ef