Skip to content

Commit 002bd36

Browse files
committed
misc: Fix potential buffer overflow bug with our stb_image support code
1 parent 05e02fe commit 002bd36

File tree

2 files changed

+7
-4
lines changed

2 files changed

+7
-4
lines changed

ChangeLog

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@
44

55
Noteworthy changes compared to the previous release, 9.2.0:
66

7+
Bug fixes:
8+
- Fix potential buffer overflow bug with our stb_image support code.
9+
710
Miscellaneous:
811
- Dynamically allocate volume index instead of relying on a hard coded
912
limit and a fixed allocation. This fixes potential panics or failure

common/stb_image.patch

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66

77
+#include <stddef.h>
88
+#include <lib/libc.h>
9+
+#include <lib/misc.h>
910
+#include <mm/pmm.h>
1011
+
1112
+#define STBI_ASSERT(x)
@@ -34,8 +35,10 @@
3435
+ void *STBI_REALLOC_buf = (x); \
3536
+ size_t STBI_REALLOC_alloc_size = (y); \
3637
+ void *STBI_REALLOC_new_buf = STBI_MALLOC(STBI_REALLOC_alloc_size); \
38+
+ size_t STBI_REALLOC_old_size = *(size_t *)((void *)STBI_REALLOC_buf - 16); \
3739
+ if (STBI_REALLOC_buf != NULL) { \
38-
+ memcpy(STBI_REALLOC_new_buf, STBI_REALLOC_buf, STBI_REALLOC_alloc_size); \
40+
+ memcpy(STBI_REALLOC_new_buf, STBI_REALLOC_buf, \
41+
+ MIN(STBI_REALLOC_alloc_size, STBI_REALLOC_old_size)); \
3942
+ STBI_FREE(STBI_REALLOC_buf); \
4043
+ } \
4144
+ STBI_REALLOC_new_buf; \
@@ -45,9 +48,6 @@
4548
+#define STBI_NO_STDIO
4649
+#define STBI_NO_SIMD
4750
+#define STBI_NO_LINEAR
48-
+
49-
+
50-
+
5151
+#define STBI_ONLY_JPEG
5252
+#define STBI_ONLY_PNG
5353
+#define STBI_ONLY_BMP

0 commit comments

Comments
 (0)