CVE-2022-0137: Out-of-bounds Write (CWE-787)
value: A heap buffer overflow in image_set_mask function of HTMLDOC before 1.9.15 allows an attacker to write outside the buffer boundaries.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2022-11-14T18:15Z
Repository: https://github.com/michaelrsweet/htmldoc
Language: Markdown
Files changed: CHANGES.md, htmldoc/image.cxx
Commit date: 2021-12-30 13:34:50 -0500
Commit message: Fix potential heap overflow bug with GIF images (Issue #461)

Diff: diff --git a/CHANGES.md b/CHANGES.md
index 02343860..5f25e647 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,5 +1,10 @@
+# Changes in HTMLDOC v1.9.15
+
+- Fixed a potential heap overflow bug with GIF images (Issue #461)
+
+
 # Changes in HTMLDOC v1.9.14
 
 - BMP image support is now deprecated and will be removed in a future
   release of HTMLDOC.
 - Fixed a potential stack overflow bug with GIF images.
diff --git a/htmldoc/image.cxx b/htmldoc/image.cxx
index 98c8698e..17ddb6d8 100644
--- a/htmldoc/image.cxx
+++ b/htmldoc/image.cxx
@@ -1310,10 +1310,17 @@ image_load_gif(image_t *img,	/* I - Image pointer */
 
 	    if (gif_read_cmap(fp, ncolors, cmap, &gray))
 	      return (-1);
 	  }
 
+          img->width  = (buf[5] << 8) | buf[4];
+          img->height = (buf[7] << 8) | buf[6];
+          img->depth  = gray ? 1 : 3;
+
+	  if (img->width <= 0 || img->width > 32767 || img->height <= 0 || img->height > 32767)
+	    return (-1);
+
           if (transparent >= 0)
           {
            /*
             * Map transparent color to background color...
             */
@@ -1341,17 +1348,10 @@ image_load_gif(image_t *img,	/* I - Image pointer */
 	    */
 
             image_need_mask(img);
 	  }
 
-          img->width  = (buf[5] << 8) | buf[4];
-          img->height = (buf[7] << 8) | buf[6];
-          img->depth  = gray ? 1 : 3;
-
-	  if (img->width <= 0 || img->width > 32767 || img->height <= 0 || img->height > 32767)
-	    return (-1);
-
 	  if (!load_data)
 	    return (0);
 
           img->pixels = (uchar *)malloc((size_t)(img->width * img->height * img->depth));
           if (img->pixels == NULL)
@@ -1782,11 +1782,11 @@ image_set_mask(image_t *img,	/* I - Image to operate on */
 		  { 8,  10, 5,  13 }
 	        };
 
 
   if (img == NULL || img->mask == NULL || x < 0 || x >= img->width ||
-      y < 0 || y > img->height)
+      y < 0 || y >= img->height)
     return;
 
   if (img->maskscale == 8)
   {
     // Store the alpha value directly...

Vulnerable code:           img->width  = (buf[5] << 8) | buf[4];
          img->height = (buf[7] << 8) | buf[6];
          img->depth  = gray ? 1 : 3;

	  if (img->width <= 0 || img->width > 32767 || img->height <= 0 || img->height > 32767)
	    return (-1);

      y < 0 || y > img->height)
Fixed code: # Changes in HTMLDOC v1.9.15

- Fixed a potential heap overflow bug with GIF images (Issue #461)


          img->width  = (buf[5] << 8) | buf[4];
          img->height = (buf[7] << 8) | buf[6];
          img->depth  = gray ? 1 : 3;

	  if (img->width <= 0 || img->width > 32767 || img->height <= 0 || img->height > 32767)
	    return (-1);

      y < 0 || y >= img->height)