镜像站点 · 本页由第三方 GitHub 只读镜像提供,非 GitHub 官方站点,不接受任何登录或凭据输入。前往 github.com
Skip to content

Fix OOB Read when writing TIFF with custom Metadata - #5148

Merged
radarhere merged 1 commit into
python-pillow:masterfrom
wiredfool:tiff_oob_read
Dec 28, 2020
Merged

radarhere merged 1 commit into
python-pillow:masterfrom
wiredfool:tiff_oob_read

Conversation

@wiredfool

Copy link
Copy Markdown
Member

(triggered in Tests/test_file_libtiff.py::TestFileLibTiff::test_custom_metadata)

Valgrind output:

**88** **********************************************************************
**88** Tests/test_file_libtiff.py::TestFileLibTiff::test_custom_metadata
**88** **********************************************************************
==88== Invalid read of size 1
==88==    at 0x890596C: _TIFFSetupFields (in /usr/lib/x86_64-linux-gnu/libtiff.so.5.5.0)
==88==    by 0x8904EEC: TIFFDefaultDirectory (in /usr/lib/x86_64-linux-gnu/libtiff.so.5.5.0)
==88==    by 0x890504C: TIFFCreateDirectory (in /usr/lib/x86_64-linux-gnu/libtiff.so.5.5.0)
==88==    by 0x8912141: ??? (in /usr/lib/x86_64-linux-gnu/libtiff.so.5.5.0)
==88==    by 0x89126EF: TIFFRewriteDirectory (in /usr/lib/x86_64-linux-gnu/libtiff.so.5.5.0)
==88==    by 0x891A2ED: TIFFFlush (in /usr/lib/x86_64-linux-gnu/libtiff.so.5.5.0)
==88==    by 0x87BD5CC: ImagingLibTiffEncode (TiffDecode.c:678)
==88==    by 0x877D519: _encode (encode.c:141)

Passing in a stack allocated array is going to fail, as a reference
is retained to the name and used later when flushing the Tiff to
the file.

==3330==    at 0xBD4110C: _TIFFSetupFields (tif_dirinfo.c:327)

Passing in a stack allocated array is going to fail, as a reference
is retained to the name and used later when flushing the Tiff to
the file.
@radarhere

Copy link
Copy Markdown
Member

Thanks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants