#170 CVE-2020-24292: reject illegal ICO BITMAPINFOHEADER bpp/size

[Anonymous]

Applies to FreeImage SVN trunk r1911 (also 3.18.0 / 3.19.0 [r1859/r1909]).

CVE-2020-24292 — heap buffer overflow in PluginICO.cpp LoadStandardIcon().

LoadStandardIcon() copies BITMAPINFOHEADER.biBitCount / biWidth / biHeight into CalculateLine / AllocateHeader / read_proc with no check that they describe a real Windows icon. An illegal bpp makes line/pitch disagree with the allocated DIB; a non-positive width or (height/2) then lets the XOR-mask read and the AND-mask loop walk off the heap.

Fix: reject bpp outside {1,2,4,8,16,24,32} and non-positive dimensions before any size math. Same approach as the Fedora/Buildroot downstream patch.

Apply from the FreeImage tree root:

patch -p0 < CVE-2020-24292.patch

CWE-120. CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

References:

• https://www.cve.org/CVERecord?id=CVE-2020-24292
• https://nvd.nist.gov/vuln/detail/CVE-2020-24292
• Original report: https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/
• GitHub fork PR: https://github.com/danoli3/FreeImage/pull/108

Note: ticket #169 was an accidental empty stub of this same summary; please use this ticket.

License: same as FreeImage (GPL or FIPL).

[Daniel Rosser]

SVN-style unified diff against FreeImage trunk r1911 is attached (CVE-2020-24292, PluginICO.cpp LoadStandardIcon).

Same change: https://github.com/danoli3/FreeImage/pull/108 (merged).

Siblings on this tracker:

• 171 CVE-2020-24293 psdThumbnail::Read
• 172 CVE-2020-24295 ReadImageLine
• 173 CVE-2020-22524 PFM integer overflow (earlier GitHub PR #56)

Original report: https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/

Apply from the FreeImage tree root: patch -p0 < CVE-2020-24292.patch

Ticket 169 is an empty accidental stub with description "test"; ignore it and use this ticket.