Browse Source

Fix 32-bit overflow in CVE-2026-42046 patch

This patch adds an additional overflow check after computing new_size
to ensure the multiplication by sizeof(uint32_t) will not overflow:

if (new_size > 0 && (size_t)new_size > SIZE_MAX / sizeof(uint32_t))
This check is added in:
- caca_resize() in caca/canvas.c
- caca_create_frame() in caca/frame.c

Fixes #86
Fixes #89
Fixes CVE-2026-42046
pull/90/head
vlefebvre 3 weeks ago
parent
commit
8ff61c9036
2 changed files with 16 additions and 0 deletions
  1. +7
    -0
      caca/canvas.c
  2. +9
    -0
      caca/frame.c

+ 7
- 0
caca/canvas.c View File

@@ -375,6 +375,13 @@ int caca_resize(caca_canvas_t *cv, int width, int height)
return -1;
}
int new_size = width * height;
/* Check for overflow when multiplying by sizeof(uint32_t) on 32-bit
* systems */
if (new_size > 0 && (size_t)new_size > SIZE_MAX / sizeof(uint32_t))
{
seterrno(EOVERFLOW);
return -1;
}

old_width = cv->width;
old_height = cv->height;


+ 9
- 0
caca/frame.c View File

@@ -147,6 +147,15 @@ int caca_create_frame(caca_canvas_t *cv, int id)
int size = cv->width * cv->height;
int f;


/* Check for overflow when multiplying by sizeof(uint32_t) on 32-bit
* systems */
if (size > 0 && (size_t)size > SIZE_MAX / sizeof(uint32_t))
{
seterrno(EOVERFLOW);
return -1;
}

if(id < 0)
id = 0;
else if(id > cv->framecount)


Loading…
Cancel
Save