1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
|
commit ffb7cad1a402377927bc2dc62dad324ae03cec92
Author: Jacob Boerema <jgboerema@gmail.com>
Date: Fri Jul 19 14:42:17 2024 -0400
plug-ins, tga: don't crash when generating a huge amount of messages
A follow-up to the previous commits, that address the tga issues from
issue #11822.
On Windows, when using the error console for messages, a huge amount
of error messages, that can be generated with special fuzzed images,
like crash-f65fd5404bff32c1d9d10ee049d9c98d02bbbdc2.tga from
the above mentioned issue, can cause GIMP to crash.
Although this is most likely caused in the error console or its
dependencies, we should not let it cause problems here until that is
fixed. There is also no real need to generate a huge amount of similar
repeated error messages, so let's limit it to 10 per read line of input.
(cherry picked from commit 1f062867172d5c68b858a6efa3011686aa32bb38)
diff --git a/plug-ins/common/file-tga.c b/plug-ins/common/file-tga.c
index 1e31f1f126..46dacc788c 100644
--- a/plug-ins/common/file-tga.c
+++ b/plug-ins/common/file-tga.c
@@ -893,14 +893,29 @@ apply_colormap (guchar *dest,
guint16 colorMapLength)
{
guint x;
+ gint errcnt = 0;
for (x = 0; x < width; x++)
{
guchar entryIndex = src[x] - colorMapIndex;
if (src[x] < colorMapIndex || entryIndex >= colorMapLength) {
- g_message ("Unsupported colormap entry: %u",
- src[x]);
+ /* On Windows the error console can run out of resources when
+ * producing a huge amount of messages. This can happen when using
+ * fuzzed test images. This causes unresponsiveness at first and
+ * finally crashes GIMP. Eventually this needs to be fixed at the
+ * source, but for now let's limit the error messages to 10
+ * per line (this function is called once per read_line). */
+ if (errcnt < 10)
+ {
+ g_message ("Unsupported colormap entry: %u",
+ src[x]);
+ }
+ else if (errcnt == 10)
+ {
+ g_message ("Too many colormap errors. Image may be corrupt.");
+ }
+ errcnt++;
entryIndex = 0;
}
|
