LibPNG 调色板越界读取漏洞分析与修复细节

漏洞关键信息总结 漏洞概述 类型：越界读取（Out-of-bounds Read） 根因：在读取调色板图像（palletted image）中的像素时，若调色板索引超出有效范围（0 到 255），原代码会返回黑色（black）作为透明色处理。该问题源于对 参数的错误依赖——旧逻辑中 被用作调色板大小的上限，导致当实际调色板小于 256 时，索引在 区间内的像素会被错误地映射为黑色。 修复核心：将调色板大小固定为 256 个条目（ ），忽略 参数，统一分配 256 色调色板，从而消除越界读取。 影响范围 受影响组件：libpng 库中的图像解码与像素读取路径，特别是涉及 、 、 等函数。 触发条件：处理调色板图像（ ）且调色板索引 ≥ 但 ≤ 255 时，原代码返回黑色；修复后统一按 256 色处理。 影响：可能导致图像渲染错误（本应显示的颜色被替换为黑色），属于功能性缺陷而非内存安全漏洞（无崩溃或信息泄露，仅颜色映射错误）。 修复方案 1. 统一调色板大小：定义常量 ，所有调色板图像均分配 256 色空间。 2. 忽略 参数：在 和 中，不再使用 作为上限，而是固定分配 256 个 结构体。 3. 像素读取逻辑修正：在 、 等函数中，对调色板索引进行边界检查： - 若索引 new(size=>2, ysize => 2, type => "palletted"); ok($im, "make palletted image (bad index)"); ok(defined $im->addColor(0, 0, 0, 0), "set a valid color (bad index)"); ok($im->pal_count == 1, "bad index"); my $sc = Imager->Color(0, 0, 0, 0); if (defined $im->read_via_glinp_bad_index) { is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; } is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad index"; is $im->getPixel(0, 0, 0, 0), "read via glinp bad in

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

LibPNG 调色板越界读取漏洞分析与修复细节

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

LibPNG 调色板越界读取漏洞分析与修复细节

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！