- chunkSizeData is read here: https://github.com/KDE/kimageformats/blob/c97ee00f5e8c0c1caf836fa68416157b1a153e3a/src/imageformats/ani.cpp#L353 - converted to uint32 here: https://github.com/KDE/kimageformats/blob/c97ee00f5e8c0c1caf836fa68416157b1a153e3a/src/imageformats/ani.cpp#L357 - used as argument to read here: https://github.com/KDE/kimageformats/blob/c97ee00f5e8c0c1caf836fa68416157b1a153e3a/src/imageformats/ani.cpp#L379 Resulting in an unbounded read (bounded only by UINT32_MAX), because QIODevice::read will resize its byte array to the passed value here: https://github.com/qt/qtbase/blob/403a47cfd571c9954e91234084c6994901939326/src/corelib/io/qiodevice.cpp#L1213.
Please attach a file that causes a problem.
https://github.com/TokTok/toktok-stack/blob/31385ffceba1ab2f8672893bbef6c8ef8a32eb07/third_party/kimageformats/test/qimage_test.cpp#L48-L50 Base64-encoded: ``` AFJJRkYOAACAQUNPTgB+YAAAAAAAUklGRg4AAIBBQ09OAH5gAAAAAABzZXEgANra2tra2tra2tra2t ra2tra2tra2tra2tra2tra2tra2traAAAAAAAAAAAAAAAAAF0= ``` Strip the first byte, then it's an input file that causes this.
i can not reproduce any wrong memory access with that code neigher with valgrind nor with asan. Do you have a backtrace you can share with us?
It's not a wrong memory access, it's a 4GB memory allocation. Try setting ulimit to something not unlimited.
A possibly relevant merge request was started @ https://invent.kde.org/frameworks/kimageformats/-/merge_requests/310
Git commit f39ca9dc9bff27a7c087fd4fc58c148c0f66914a by Albert Astals Cid. Committed on 13/01/2025 at 23:40. Pushed by mircomir into branch 'master'. ani: Read chunk elements one at a time instead all at once This way if the file is malformed and there's not that many elements we don't try allocate too much memory to read into M +7 -5 src/imageformats/ani.cpp https://invent.kde.org/frameworks/kimageformats/-/commit/f39ca9dc9bff27a7c087fd4fc58c148c0f66914a
Thank you so much for the quick fixes. I'll be running a fuzzer against all the plugins for a while. If I find more issues, I'll file more bugs. We want to use these plugins for our chat client (qTox) and want to be sure people can't abuse it easily.