浏览代码

Fix 32-bit overflow in CVE-2026-42046 patch

This patch adds an additional overflow check after computing new_size
to ensure the multiplication by sizeof(uint32_t) will not overflow:

if (new_size > 0 && (size_t)new_size > SIZE_MAX / sizeof(uint32_t))
This check is added in:
- caca_resize() in caca/canvas.c
- caca_create_frame() in caca/frame.c

Fixes #86
Fixes #89
Fixes CVE-2026-42046
pull/90/head
vlefebvre 3 周前
父节点
当前提交
8ff61c9036
共有 2 个文件被更改,包括 16 次插入0 次删除
  1. +7
    -0
      caca/canvas.c
  2. +9
    -0
      caca/frame.c

+ 7
- 0
caca/canvas.c 查看文件

@@ -375,6 +375,13 @@ int caca_resize(caca_canvas_t *cv, int width, int height)
return -1;
}
int new_size = width * height;
/* Check for overflow when multiplying by sizeof(uint32_t) on 32-bit
* systems */
if (new_size > 0 && (size_t)new_size > SIZE_MAX / sizeof(uint32_t))
{
seterrno(EOVERFLOW);
return -1;
}

old_width = cv->width;
old_height = cv->height;


+ 9
- 0
caca/frame.c 查看文件

@@ -147,6 +147,15 @@ int caca_create_frame(caca_canvas_t *cv, int id)
int size = cv->width * cv->height;
int f;


/* Check for overflow when multiplying by sizeof(uint32_t) on 32-bit
* systems */
if (size > 0 && (size_t)size > SIZE_MAX / sizeof(uint32_t))
{
seterrno(EOVERFLOW);
return -1;
}

if(id < 0)
id = 0;
else if(id > cv->framecount)


正在加载...
取消
保存