Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Program crashes when processing certain maliciously crafted images #6

Merged
merged 1 commit into from
Jun 17, 2023

Conversation

pic4xiu
Copy link
Contributor

@pic4xiu pic4xiu commented Jun 17, 2023

I found that in the ConvertToGraphicField function, in the first layer of for loop, if the width is 0, the calculation of line[lineIndex] will cause the program to go out of bounds. Because the line definition statement is line := make([]uint8, width), the program directly crashes.

func ConvertToGraphicField(source image.Image, graphicType GraphicType) string {
	var gfType string
	var lastLine string
	size := source.Bounds().Size()
	width := size.X / 8
	height := size.Y
	if size.Y%8 != 0 {
		width = width + 1
	}

	var GraphicFieldData string

	for y := 0; y < size.Y; y++ {
		line := make([]uint8, width)
		lineIndex := 0
		index := uint8(0)
		currentByte := line[lineIndex]//line[0] is out of bounds
		...

The reason why did not choose to introduce error to indicate that the program went wrong is that it seems reasonable to return an empty string, because the image width is 0.

@SimonWaldherr SimonWaldherr merged commit c0d018f into SimonWaldherr:master Jun 17, 2023
@SimonWaldherr
Copy link
Owner

👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants