Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Integer overflow in SequentialStreamReader causes wrong length check #428

Closed
KirkLandTrip opened this issue Oct 7, 2024 · 0 comments · Fixed by #427
Closed

Integer overflow in SequentialStreamReader causes wrong length check #428

KirkLandTrip opened this issue Oct 7, 2024 · 0 comments · Fixed by #427

Comments

@KirkLandTrip
Copy link
Contributor

I have a corrupt image which goes into an infinite loop when running Metadata Extractor on it.
Some of the bad code is on my end (bad implementation of Stream) but one of the fail points is also in Metadata Extractor.

In the SequentialStreamReader class, The Skip method does a bounds check on position + n > length:

image

In my case, n (num bytes to skip) was very large but still positive (top-most bit is off) 0x7fffffffffffffef = 9223372036854775791
and the addition of position + n lit the top-most bit, so the result is a negative long 0x8000000000014b86 = -9223372036854690938

Since both sides of the comparison are long and -9223372036854690938 < 131072 then the bounds violation is not detected.

I made a PR to fix this issue: simply casting both sides of the comparison to ulong should solve it:
#427

I hope this helps.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
1 participant