#177 CVE-2024-28581: TARGA RLE IOCache at least one pixel wide

[Daniel Rosser]

Applies to FreeImage SVN trunk r1911 (also 3.19.0 [r1909]).

CVE-2024-28581 — NVD attributes an overflow to _assignPixel<>() when reading TARGA. Trunk r1911 already clamps RLE packet writes against dib_end before _assignPixel. A remaining bug on the same malformed-TGA class: IOCache size is (remaining_size / height), which can be smaller than one file pixel. loadRLE() then calls getBytes(file_pixel_size) and reads past the undersized cache.

This patch clamps the cache size to at least file_pixel_size.

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-28581

GitHub: https://github.com/danoli3/FreeImage/commit/68af81b (PR https://github.com/danoli3/FreeImage/pull/39)

Apply from the FreeImage tree root:

patch -p0 < CVE-2024-28581.patch