From b659038e4296534c2e068de9bce8d9e17fbe58b4 Mon Sep 17 00:00:00 2001
From: Emmanuele Bassi <ebassi@gnome.org>
Date: Tue, 9 Aug 2022 16:10:40 +0100
Subject: jpeg: Limit the memory size when loading image data

Specially crafted JPEG images may lead to a crash when their size is too
large; in the most benign of cases, the OS might terminate the process
after it tries to allocate all the memory in the world.

We can tell libjpeg to limit the size of the memory pool when loading,
to avoid this kind of result. For the time being, 100 MB seems like a
good threshold.

Original patch by: Sam Ezeh <sam.z.ezeh@gmail.com>

Fixes: #205
---
 tests/issue205.jpg  | Bin 0 -> 1407 bytes
 tests/meson.build   |   1 +
 tests/pixbuf-jpeg.c |  36 ++++++++++++++++++++++++++++++++++++
 3 files changed, 37 insertions(+)
 create mode 100644 tests/issue205.jpg

(limited to 'tests')

diff --git a/tests/issue205.jpg b/tests/issue205.jpg
new file mode 100644
index 000000000..b45ebca78
Binary files /dev/null and b/tests/issue205.jpg differ
diff --git a/tests/meson.build b/tests/meson.build
index 7c6cb113a..28c252535 100644
--- a/tests/meson.build
+++ b/tests/meson.build
@@ -152,6 +152,7 @@ test_data = [
   'aero.gif',
   'circular-table.gif',
   'issue70.jpg',
+  'issue205.jpg',
 ]
 
 installed_test_bindir = join_paths(gdk_pixbuf_libexecdir, 'installed-tests', meson.project_name())
diff --git a/tests/pixbuf-jpeg.c b/tests/pixbuf-jpeg.c
index 3b1f2e4f0..be2c6b4fe 100644
--- a/tests/pixbuf-jpeg.c
+++ b/tests/pixbuf-jpeg.c
@@ -170,6 +170,41 @@ test_jpeg_markers (void)
   g_free (contents);
 }
 
+static void
+test_jpeg_fbfbfbfb (void)
+{
+  GdkPixbufLoader *loader;
+  GdkPixbuf *pixbuf;
+  GError *error = NULL;
+  gchar *contents;
+  gsize size;
+
+  if (!format_supported ("jpeg"))
+    {
+      g_test_skip ("format not supported");
+      return;
+    }
+
+  g_test_message ("Load JPEG with size 0xfbfbfbfb (issue: 250)");
+
+  g_file_get_contents (g_test_get_filename (G_TEST_DIST, "issue205.jpg", NULL), &contents, &size, &error);
+  g_assert_no_error (error);
+
+  loader = gdk_pixbuf_loader_new ();
+
+  gdk_pixbuf_loader_write (loader, (const guchar*)contents, size, &error);
+  g_assert_no_error (error);
+
+  gdk_pixbuf_loader_close (loader, &error);
+  g_assert_error (error, GDK_PIXBUF_ERROR, GDK_PIXBUF_ERROR_CORRUPT_IMAGE);
+
+  pixbuf = gdk_pixbuf_loader_get_pixbuf (loader);
+  g_assert_nonnull (pixbuf);
+
+  g_object_unref (loader);
+  g_free (contents);
+}
+
 int
 main (int argc, char **argv)
 {
@@ -181,6 +216,7 @@ main (int argc, char **argv)
   g_test_add_func ("/pixbuf/jpeg/comment", test_comment);
   g_test_add_func ("/pixbuf/jpeg/at_size", test_at_size);
   g_test_add_func ("/pixbuf/jpeg/issue70", test_jpeg_markers);
+  g_test_add_func ("/pixbuf/jpeg/issue205", test_jpeg_fbfbfbfb);
 
   return g_test_run ();
 }
-- 
cgit v1.2.1