#172 CVE-2020-24295: bound psdParser::ReadImageLine destination writes

[Anonymous]

Applies to FreeImage SVN trunk r1911 (also 3.18.0 / 3.19.0 [r1859/r1909]).

CVE-2020-24295 — heap buffer overflow in psdParser::ReadImageLine() (PSDParser.cpp).

ReadImageData writes each channel row at dst_first_line + channelOffset via ReadImageLine() with no check that channelOffset + lineSize fits in the allocated DIB. A crafted PSD header can walk that write off the bitmap on both the raw and RLE paths.

Fix:

• Reject pitch * height overflow.
• Before ReadImageLine (raw and RLE loops), refuse a channel write that does not fit in dstLineSize * nHeight.
• Unload the DIB and free line caches on failure so the throw does not leak.

Apply from the FreeImage tree root:

patch -p0 < CVE-2020-24295.patch

Independent of the CVE-2020-24293 patch; both apply to the same PSDParser.cpp (apply either order).

CWE-120. CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

References:

• https://www.cve.org/CVERecord?id=CVE-2020-24295
• https://nvd.nist.gov/vuln/detail/CVE-2020-24295
• Original report: https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/
• GitHub fork PR: https://github.com/danoli3/FreeImage/pull/110

License: same as FreeImage (GPL or FIPL).

[Daniel Rosser]

SVN-style unified diff against FreeImage trunk r1911 is attached (CVE-2020-24295, psdParser::ReadImageLine destination writes).

Same change: https://github.com/danoli3/FreeImage/pull/110

Siblings: 170 (ICO), 171 (thumbnail), 173 (PFM). Original report: https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/

Apply from the FreeImage tree root: patch -p0 < CVE-2020-24295.patch