jpeg: Throw error when number of color components is unsupported
Explicitly check "3" or "4" output color components. gdk-pixbuf assumed that the value of output_components to be either 3 or 4, but not an invalid value (9) or an unsupported value (1). The way the buffer size was deduced was using a naive "== 4" check, with a 1, 3 or 9 color component picture getting the same buffer size, a size just sufficient for 3 color components, causing invalid writes later when libjpeg-turbo was decoding the image. CVE-2017-2862 Sent by from Marcin 'Icewall' Noga of Cisco Talos https://bugzilla.gnome.org/show_bug.cgi?id=784866
parent
4ffc78b6
Please register or sign in to comment