Bug fix. Add limits for chunk and item

[Issue]
  A crash occurred while allocating big-size memory due to incorrect size.

Change-Id: I381da7a60acb27f028a9b92e9fcab0e87a14a9e4

diff --git a/src/heif_box_util.c b/src/heif_box_util.c
index fba6887a3c1e23823cec8d944c6171b3c3ed6465..b6806f94228e1fde3b50de9a97315fc46ba69c9a 100644 (file)
--- a/src/heif_box_util.c
+++ b/src/heif_box_util.c
@@ -26,6 +26,10 @@
 #include "heif_debug.h"
 #include "heif_box_util.h"
 
+/* There is no practical limit on the HEIF box size (64bit length).
+ * But we limit it to 100MByte due to memory allocation issue.
+ */
+#define MAX_CHUNK_SIZE (100 * 1024 * 1024)
 
 #ifdef __ENABLE_DEBUG_MODE
 static void __type_to_fourcc_string(uint32_t type, char *str);
@@ -168,6 +172,9 @@ int _parse_box_chunk(heif_source_h source, off_t *offset, _parse_chunk_cb parse_
                // The smallest valid chunk is 8 bytes long.
                heif_error("invalid chunk size: %"PRIu64, chunk_size);
                return LIBHEIF_ERROR_INVALID_PARAMETER;
+       } else if (chunk_size > MAX_CHUNK_SIZE) {
+               heif_error("too large chunk size: %"PRIu64, chunk_size);
+               return LIBHEIF_ERROR_INVALID_PARAMETER;
        }
 
        DEBUG_CHUNK_TYPE_AND_OFFSET("sub_box", chunk_type, chunk_size, data_offset);

diff --git a/src/heif_itemtable.c b/src/heif_itemtable.c
index 447edd6b000a1a5521730d866991f01734bd8cfa..6376596c2ee8bba1595b53289aba94e9e0828636 100644 (file)
--- a/src/heif_itemtable.c
+++ b/src/heif_itemtable.c
@@ -43,6 +43,11 @@
 #define START_CODE_LEN         4
 #define IMAGE_HEADER_LEN       4
 
+/* There is no practical limit on the HEIF item size (64bit length).
+ * But we limit it to 100MByte due to memory allocation issue.
+ */
+#define MAX_ITEM_DATA_SIZE (100 * 1024 * 1024)
+
 typedef struct {
        uint8_t completeness;
        uint8_t unit_type;
@@ -994,6 +999,11 @@ static int __build_image_if_possible(heif_itemtable_t *item_table)
                        return ret;
                }
 
+               if (size > MAX_ITEM_DATA_SIZE) {
+                       heif_error("invalid item size %zu", size);
+                       return LIBHEIF_ERROR_INVALID_PARAMETER;
+               }
+
                if (item_info->item_type == FOURCC('E', 'x', 'i', 'f')) {
                        // Only add if the Exif data is non-empty. The first 4 bytes contain
                        // the offset to TIFF header, which the Exif parser doesn't use.