#173 CVE-2020-22524: fix PFM integer overflow in line buffer allocation
Applies to FreeImage SVN trunk r1911 (also 3.18.0 / 3.19.0 [r1828]).
CVE-2020-22524 — integer overflow leading to undersized allocation in PluginPFM.cpp Load().
Load() computed the PFM scanline buffer as const unsigned lineWidth = 3 * width (RGBF) or = width (FLOAT). width is an int from the PFM header (only width <= 0 is rejected). For RGBF, 3 * width is a 32-bit signed multiply, so a large width (~715M+) wraps to a small value. malloc() then succeeds with a buffer far smaller than one scanline, while the unpack loop still iterates for (x = 0; x < width; x++) and reads/writes past the end of that buffer.
Fix: compute lineWidth in size_t so the multiply cannot overflow before malloc. Unreasonable widths fail malloc(), which Load() already handles.
Apply from the FreeImage tree root:
patch -p0 < CVE-2020-22524.patch
CWE-190 leading to CWE-787/CWE-125. CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
References:
- https://www.cve.org/CVERecord?id=CVE-2020-22524
- https://nvd.nist.gov/vuln/detail/CVE-2020-22524
- GitHub fork: https://github.com/danoli3/FreeImage/commit/668385e561a4a338f5b3513a6f09a0502933281e
- GitHub PR: https://github.com/danoli3/FreeImage/pull/56
License: same as FreeImage (GPL or FIPL).
Related
Discussion
Anonymous
SVN-style unified diff against FreeImage trunk r1911 is attached (CVE-2020-22524, PluginPFM.cpp Load 32-bit 3*width overflow before malloc).
This is the earlier GitHub fix: https://github.com/danoli3/FreeImage/commit/668385e / PR https://github.com/danoli3/FreeImage/pull/56
Siblings just posted for the 2020 ICO/PSD heap overflows: 170, 171, 172. Original ICO/PSD report: https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/
Apply from the FreeImage tree root: patch -p0 < CVE-2020-22524.patch