Skip to content

Fix panic when prediction calculation is invalid #282

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

Conversation

richard-viney
Copy link
Contributor

@richard-viney richard-viney commented Mar 5, 2025

This bug was found during fuzz testing of a library that depends on jpeg-decoder, on the following line:

let prediction = 1 << (frame.precision - scan.point_transform - 1) as i32;

It's triggered when the math underflows in the situation that scan.point_transform isn't less than frame.precision.

This PR adds a check in the parser that errors when this situation is detected, as well as the test case generated by the fuzz tester.

(I also changed to explicitly specify Ubuntu 22.04 in CI due to failures running on 24.04).

@@ -8,7 +8,7 @@ on:

jobs:
build:
runs-on: ubuntu-latest
runs-on: ubuntu-22.04
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I saw that the cross_compile jobs failed due to Ubuntu version, but do you know whether this one can stay Ubuntu latest?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll see if the issue on 24.04 can be fixed, may just be a package that changed its name

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed!

@richard-viney richard-viney force-pushed the fix-panic-in-invalid-prediction-shift branch from 00d6bd9 to 2059842 Compare March 7, 2025 02:26
@fintelia fintelia merged commit 95550d7 into image-rs:master Mar 7, 2025
20 checks passed
@fintelia
Copy link
Contributor

fintelia commented Mar 7, 2025

Thanks!

@richard-viney
Copy link
Contributor Author

Thanks for merging! If it's possible to release a v0.3.2 at some stage that'd be great, but no urgency.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants