CVE-2020-36279 (published 2021-03-12T00:15Z)

Leptonica before 1.80.0 allows a heap-based buffer over-read in rasteropGeneralLow, related to adaptmap_reg.c and adaptmap.c.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/DanBloomberg/leptonica
commit_details: repo_url: https://github.com/DanBloomberg/leptonica
author: Dan Bloomberg
author_date: 2020-05-26 22:24:40-07:00
msg: Fixing oss-fuzz issue 22512: Heap-buffer-overflow in rasteropGeneralLow()
* Simplified the hole-filling function
`
repository: repo_url: https://github.com/DanBloomberg/leptonica
repo_name: DanBloomberg/leptonica
description: Leptonica is an open source library containing software that is broadly useful for image processing and image analysis applications. The official github repository for Leptonica is: danbloomberg/leptonica.  See leptonica.org for more documentation.
repo_language: C
owner: DanBloomberg
file_changes: filename: adaptmap_reg.c
change_type: ModificationType.MODIFY
diff: @@ -57,7 +57,7 @@ int main(int    argc,
 l_int32       w, h;
 PIX          *pixs, *pixg, *pixim, *pixgm, *pixmi, *pix1, *pix2;
 PIX          *pixmr, *pixmg, *pixmb, *pixmri, *pixmgi, *pixmbi;
-PIXA         *pixa;
+PIXA         *pixa, *pixa2;
 L_REGPARAMS  *rp;
 
     if (regTestSetup(argc, argv, &rp))
@@ -159,10 +159,31 @@ L_REGPARAMS  *rp;
     pixaAddPix(pixa, pix2, L_INSERT);
     pixDestroy(&pixim);
 
+        /* Check pixFillMapHoles() */
+    pixa2 = pixaCreate(3);
+    pix1 = pixRead("weasel8.png");  /* use this as the map */
+    pixGammaTRC(pix1, pix1, 1.0, 0, 270);  /* darken white pixels */
+    pixaAddPix(pixa2, pix1, L_COPY);
+    pixGetDimensions(pix1, &w, &h, NULL);
+    pixRasterop(pix1, 0, 0, 5, h, PIX_SET, NULL, 0, 0);  /* add white holes */
+    pixRasterop(pix1, 20, 0, 2, h, PIX_SET, NULL, 0, 0);
+    pixRasterop(pix1, 40, 0, 3, h, PIX_SET, NULL, 0, 0);
+    pixRasterop(pix1, 0, 0, w, 3, PIX_SET, NULL, 0, 0);
+    pixRasterop(pix1, 0, 15, w, 3, PIX_SET, NULL, 0, 0);
+    pixRasterop(pix1, 0, 35, w, 2, PIX_SET, NULL, 0, 0);
+    pixaAddPix(pixa2, pix1, L_COPY);
+    pixFillMapHoles(pix1, w, h, L_FILL_WHITE);
+    pixaAddPix(pixa2, pix1, L_INSERT);
+    pix2 = pixaDisplayTiledInColumns(pixa2, 3, 1.0, 20, 1);
+    regTestWritePixAndCheck(rp, pix2, IFF_PNG);  /* 14 */
+    pixDisplayWithTitle(pix2, 50, 850, NULL, rp->display);
+    pixaDestroy(&pixa2);
+    pixDestroy(&pix2);
+    
         /* Display results */
     pix1 = pixaDisplayTiledAndScaled(pixa, 32, 400, 4, 0, 20, 2);
     pixWrite("/tmp/lept/adapt/results.jpg", pix1, IFF_JFIF_JPEG);
-    pixDisplayWithTitle(pix1, 100, 0, NULL, rp->display);
+    pixDisplayWithTitle(pix1, 50, 0, NULL, rp->display);
     pixDestroy(&pix1);
     pixaDestroy(&pixa);
 

programming_language: C
filename: adaptmap.c
change_type: ModificationType.MODIFY
diff: @@ -1470,7 +1470,6 @@ pixFillMapHoles(PIX     *pix,
 l_int32   w, h, y, nmiss, goodcol, i, j, found, ival, valtest;
 l_uint32  val, lastval;
 NUMA     *na;  /* indicates if there is any data in the column */
-PIX      *pixt;
 
     PROCNAME("pixFillMapHoles");
 
@@ -1522,7 +1521,6 @@ PIX      *pixt;
 
     /* ---------- Fill in missing columns by replication ----------- */
     if (nmiss > 0) {  /* replicate columns */
-        pixt = pixCopy(NULL, pix);
             /* Find the first good column */
         goodcol = 0;
         for (j = 0; j < w; j++) {
@@ -1533,20 +1531,16 @@ PIX      *pixt;
             }
         }
         if (goodcol > 0) {  /* copy cols backward */
-            for (j = goodcol - 1; j >= 0; j--) {
-                pixRasterop(pix, j, 0, 1, h, PIX_SRC, pixt, j + 1, 0);
-                pixRasterop(pixt, j, 0, 1, h, PIX_SRC, pix, j, 0);
-            }
+            for (j = goodcol - 1; j >= 0; j--)
+                pixRasterop(pix, j, 0, 1, h, PIX_SRC, pix, j + 1, 0);
         }
         for (j = goodcol + 1; j < w; j++) {   /* copy cols forward */
             numaGetIValue(na, j, &ival);
             if (ival == 0) {
                     /* Copy the column to the left of j */
-                pixRasterop(pix, j, 0, 1, h, PIX_SRC, pixt, j - 1, 0);
-                pixRasterop(pixt, j, 0, 1, h, PIX_SRC, pix, j, 0);
+                pixRasterop(pix, j, 0, 1, h, PIX_SRC, pix, j - 1, 0);
             }
         }
-        pixDestroy(&pixt);
     }
     if (w > nx) {  /* replicate the last column */
         for (i = 0; i < h; i++) {

programming_language: C++