#171 CVE-2020-24293: bound psdThumbnail::Read packed-row copy
Applies to FreeImage SVN trunk r1911 (also 3.18.0 / 3.19.0 [r1859/r1909]).
CVE-2020-24293 — heap buffer overflow in psdThumbnail::Read() (PSDParser.cpp).
Raw PSD thumbnail rows memcpy width * bpp/8 bytes into a scanline whose pitch came from FreeImage_Allocate, while the source buffer is sized from a separate WidthBytes field. All four values are attacker-controlled. If they disagree, the copy writes past the DIB (and can read past a too-small WidthBytes allocation).
Fix:
- Reject non-positive dimensions/bpp, bpp not a multiple of 8, and overflow in the packed-row multiply.
- WidthBytes is DWORD-padded per the PSD spec, so it may be larger than width*bpp/8; it must never be smaller (an exact-equality check would reject valid padded thumbnails).
- Fail Allocate and a packed row that does not fit in DIB pitch.
- memcpy the packed size, not an unchecked width*bpp/8.
Apply from the FreeImage tree root:
patch -p0 < CVE-2020-24293.patch
Independent of the CVE-2020-24295 patch; both apply to the same PSDParser.cpp.
CWE-120. CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
References:
- https://www.cve.org/CVERecord?id=CVE-2020-24293
- https://nvd.nist.gov/vuln/detail/CVE-2020-24293
- Original report: https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/
- GitHub fork PR: https://github.com/danoli3/FreeImage/pull/109
License: same as FreeImage (GPL or FIPL).
Discussion
Anonymous
SVN-style unified diff against FreeImage trunk r1911 is attached (CVE-2020-24293, psdThumbnail::Read packed-row copy).
Same change: https://github.com/danoli3/FreeImage/pull/109
Siblings: 170 (ICO), 172 (ReadImageLine), 173 (PFM). Original report: https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/
Apply from the FreeImage tree root: patch -p0 < CVE-2020-24293.patch