#174 CVE-2020-24294 / CVE-2024-28565: clamp psdParser::UnpackRLE src and dst

[Daniel Rosser]

Applies to FreeImage SVN trunk r1911 (also 3.18.0 / 3.19.0 [r1859/r1909]).

CVE-2020-24294 / CVE-2024-28565 (also tracked as CVE-2025-65803) — heap buffer overflow in psdParser::UnpackRLE().

UnpackRLE() clamped the memcpy/memset write against line_end, but then always advanced line / rle_line / srcSize by the raw packet length:

• line could pass line_end, so the next iteration's (line_end - line) went negative and became a huge size_t copy
• srcSize (unsigned) underflowed when len > srcSize, so rle_line ran past the source buffer

This patch clamps both the destination copy and the source consume before advancing pointers, and stops when line reaches line_end.

Related tracker ticket #159 described the same bug but the attached patch only documented the memcpy line and did not clamp source consumption or stop the loop.

NVD:
https://nvd.nist.gov/vuln/detail/CVE-2020-24294
https://nvd.nist.gov/vuln/detail/CVE-2024-28565

GitHub: https://github.com/danoli3/FreeImage/commit/62971de (PR https://github.com/danoli3/FreeImage/pull/54)

Apply from the FreeImage tree root:

patch -p0 < CVE-2020-24294.patch

Independent of #170/#171/#172 (ICO / thumbnail / ReadImageLine). Apply this before those two PSD patches if you take all three; they still apply in either order.

[Daniel Rosser]

Index of the SVN r1911 CVE patch series from danoli3/FreeImage (GitHub 3.19.14 + follow-ups). Apply from the FreeImage tree root with: patch -p0 < CVE-....patch

Already on this tracker:

• 170 CVE-2020-24292 ICO LoadStandardIcon

• 171 CVE-2020-24293 psdThumbnail::Read

• 172 CVE-2020-24295 ReadImageLine

• 173 CVE-2020-22524 PFM integer overflow

• 174 (this ticket) CVE-2020-24294 / CVE-2024-28565 UnpackRLE

• 175 CVE-2024-28579 / CVE-2024-28582 HDR

• 176 CVE-2024-28584 J2K NULL

• 177 CVE-2024-28581 TARGA IOCache

• 178 CVE-2024-28567 TIFF ICC UAF

• 179 CVE-2021-33367 Exif IFD bound

• 180 CVE-2024-28568/9029/28570/28573/28577/28578/28580 IPTC/Exif/XPM/RAS

• 181 CVE-2024-28566/28571/28572/28583 TIFF AssignPixel / JPEG src / MakerNote / XBM

Suggested apply order when taking the overlapping-file patches: 179 then 178 then 180 then 181. The others are independent.

Not posted (whole-tree vendor replacements, not a small plugin diff):

• CVE-2024-28562/28563/28564/28569 bundled OpenEXR 2.2 Imf_2_2 — fixed in GitHub by OpenEXR 3.3.13 (#69) or -DUSE_SYSTEM_OPENEXR=ON
• CVE-2024-28574/28575/28576 bundled OpenJPEG j2k.c — fixed in GitHub by OpenJPEG 2.5.4 (#68) or -DUSE_SYSTEM_LIBOPENJPEG=ON

Ticket #169 is an empty stub; use #170 for the ICO patch.