classification
Title: Buffer overflow in imageop module
Type: crash Stage:
Components: Versions: Python 2.4, Python 2.6
process
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: Nosy List: amaury.forgeotdarc, benjamin.peterson, haypo
Priority: release blocker Keywords: patch

Created on 2008-11-13 22:57 by amaury.forgeotdarc, last changed 2008-11-18 22:56 by amaury.forgeotdarc. This issue is now closed.

Files
File name Uploaded Description Edit
rgbcrash.diff amaury.forgeotdarc, 2008-11-13 23:01
test_imageop.py haypo, 2008-11-18 05:48
Messages (6)
msg75840 - (view) Author: Amaury Forgeot d'Arc (amaury.forgeotdarc) * (Python committer) Date: 2008-11-13 22:57
The interpreter sometimes segfaults when running the test suite, in 
test_imageop.
A more reliable crasher is:

>>> import imageop
>>> s = "A" * 32000
>>> imageop.rgb2rgb8(s, 1, len(s))

The failure was recently introduced by r66689, a "security fix" :-(
and backported today in 2.4!

This is a 2.4 release blocker. Patch is attached, please review.
msg75841 - (view) Author: STINNER Victor (haypo) * (Python committer) Date: 2008-11-13 22:59
Ooops. That's why I asked for one or more reviewers :-)
msg75842 - (view) Author: Amaury Forgeot d'Arc (amaury.forgeotdarc) * (Python committer) Date: 2008-11-13 23:01
Of course I uploaded the wrong patch. Trying again.
msg75988 - (view) Author: Benjamin Peterson (benjamin.peterson) * (Python committer) Date: 2008-11-17 22:41
Looks good.
msg76000 - (view) Author: STINNER Victor (haypo) * (Python committer) Date: 2008-11-18 05:48
When I wrote my patch to fix division by zero (and detection of -n 
* -n overflow), I also wrote a script to test imageop module. I fixed 
the limit of the input string to 1024 bytes, and so the rgb crash was 
not detected. Here is my script with a limit of 2^20 bytes which raise 
the crash. With the patch, there are no more crash ;-)
msg76027 - (view) Author: Amaury Forgeot d'Arc (amaury.forgeotdarc) * (Python committer) Date: 2008-11-18 22:56
Fixed in revisions r67266, 67267, r67268, r67270: (trunk, 2.6, 2.5, 2.4)
History
Date User Action Args
2008-11-18 22:56:21amaury.forgeotdarcsetstatus: open -> closed
resolution: fixed
messages: + msg76027
2008-11-18 05:48:38hayposetfiles: + test_imageop.py
messages: + msg76000
2008-11-17 22:41:55benjamin.petersonsetkeywords: - needs review
nosy: + benjamin.peterson
messages: + msg75988
2008-11-13 23:02:00amaury.forgeotdarcsetfiles: + rgbcrash.diff
messages: + msg75842
2008-11-13 23:01:31amaury.forgeotdarcsetfiles: - rgbcrash.diff
2008-11-13 23:00:00hayposetnosy: + haypo
messages: + msg75841
2008-11-13 22:57:49amaury.forgeotdarccreate