Mirrors_UI_SDK/wxWidgets
1
0
Fork 0
mirror of https://github.com/wxWidgets/wxWidgets.git synced 2026-09-26 09:35:12 +08:00
Code Issues Actions 9 Packages Projects Releases Wiki Activity

Fix potentially using uninitialised data in PCX image handler

Browse Source 
Reject truncated reads to avoid uninitialised data.

Closes #26624.
This commit is contained in:
dxbjavid
2026-06-23 20:00:54 +02:00
committed by Vadim Zeitlin
parent b3dea2e64d
commit c77b7ebd2a
2 changed files with 38 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/image/image.cpp
+27
View File
@@ -1560,6 +1560,33 @@ TEST_CASE_METHOD(ImageHandlersInit, "wxImage::BadPCX", "[image][pcx][error]")
REQUIRE( !img.LoadFile(mis, wxBITMAP_TYPE_PCX) );
}
TEST_CASE_METHOD(ImageHandlersInit, "wxImage::TruncatedPCXPalette", "[image][pcx][error]")
{
// A 1x1 8-bit PCX whose 256-colour palette (which follows the 0x0c
// marker at the very end of the file) is truncated. ReadPCX() used to
// read the fixed 768-byte palette without checking how many bytes were
// actually present, so the unread tail of the buffer stayed
// uninitialised and was then copied into the image data and the
// wxImage palette.
unsigned char data[128 + 2 + 1 + 10] = { 0 };
data[0] = 0x0a; // manufacturer
data[1] = 0x05; // version
data[2] = 0x01; // RLE encoding
data[3] = 0x08; // bits per pixel
// xmin/ymin/xmax/ymax all zero gives a 1x1 image
data[65] = 0x01; // one plane
data[66] = 0x01; // bytes per line
// a single RLE run for one pixel with palette index 255
data[128] = 0xc1;
data[129] = 0xff;
// palette marker followed by only 10 of the expected 768 palette bytes
data[130] = 0x0c;
wxMemoryInputStream mis(data, WXSIZEOF(data));
wxImage img;
REQUIRE( !img.LoadFile(mis, wxBITMAP_TYPE_PCX) );
}
#endif // wxUSE_PCX
TEST_CASE_METHOD(ImageHandlersInit, "wxImage::BadANI", "[image][ani][error]")