OpenImageIO PSD RawColor OOB read vulnerability

OpenImageIO PSD RawColor Indexed Image Out-of-Bounds Read Vulnerability Summary Vulnerability Overview Vulnerability Name: OpenImageIO has an out-of-bounds read vulnerability in the function when parsing RawColor indexed images in PSD files. Trigger Condition: When a PSD file has or present, and is greater than the stored number of channels, performs an out-of-bounds read when accessing . Severity: Moderate (CVSS v3.1 score 5.5, vector ). Impact: An attacker can craft a malicious PSD file to cause a program crash (DoS) or trigger a heap buffer out-of-bounds read, potentially leaking memory information. Scope of Impact Affected Versions: and earlier versions ( is affected; fixed in ). Affected Component: The PSD parsing module in ( ). Trigger Path: → → out-of-bounds access to . Fix Core Fix Approach: In , change the upper bound of the loop to to ensure that uninitialized channel buffers are not accessed. Regression Testing: Add regression test cases for this PoC to ensure that safely handles channel count mismatches. Verification Results: - : Triggers (reported by ASan). - : ASan detects . - : Triggers . - : The control group shows no crash (rc=0), confirming the vulnerability is strongly correlated with the flag. PoC Code Key Information from ASan Log ```text ==ASan== ==ASan==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x55b5b5b5b5b5b5b5 READ of size 4 at 0x55b5b5b5b5b5b5b5 thread T0 #0 0x55b5b5b5b5b5b5b5 in std::vector::data() const /usr/lib/gcc/x86_64/9/../../../../include/c++/9/bits/stl_vector.h:804 #1 0x55b5b5b5b5b5b5b5 in void OpenImageIO::PSDInput::read_native_scanline(int, int, int, int, void) /home/trb/run/OpenImageIO/src/lib/OpenImageIO/Core/OpenImageIO/Core/psd.cpp:2050 #2 0x55b5b5b5b5b5b5b5 in OpenImageIO::ImageInput::read_native_scanline(int, int, int, int, void) /home/trb/run/OpenImageIO/src/lib/OpenImageIO/Core/OpenImageIO/Core/OpenImageIO.cpp:114 #3 0x55b5b5b5b5b5b5b5 in OpenImageIO::ImageInput::read_image(int, int, int, bool, OpenImageIO::TypeSpec) /home/trb/run/OpenImageIO/src/lib/OpenImageIO/Core/OpenImageIO/Core/OpenImageIO.cpp:114 #4 0x55b5b5b5b5b5b5b5 in OpenImageIO::ImageInput::read(int, int, int, bool, OpenImageIO::TypeSpec) /home/trb/run/OpenImageIO/src/lib/OpenImageIO/Core/OpenImageIO/Core/OpenImageIO.cpp:114 #5 0x55b5b5b5b5b5b5b5 in OpenImageIO::ImageInput::read(int, int, int, bool, OpenImageIO::TypeSpec) /home/trb/run/OpenImageIO/src/lib/OpenImageIO/Core/OpenImageIO/Core/OpenImageIO.cpp:114 #6 0x55b5b5b5b5b5b5b5 in OpenImageIO::ImageInput::read(int, int, int, bool, OpenImageIO::TypeSpec) /home/trb/run/OpenImageIO/src/lib/OpenImageIO/Core/OpenImageIO/Core/OpenImageIO.cpp:114 #7 0x55b5b5b5b5b5b5b5 in OpenImageIO::ImageInput::read(int, int, int, bool, OpenImageIO::TypeSpec) /home/trb/run/OpenImageIO/src/lib/OpenImageIO/Core/OpenImageIO/Core/OpenImageIO.cpp:114 #8 0x55b5b5b5b5b5b5b5 in OpenImageIO::ImageInput::read(int, int, int, bool, OpenImageIO::TypeSpec) /home/trb/run/OpenImageIO/src/lib/OpenImageIO/Core/OpenImageIO/Core/OpenImageIO.cpp:114 #9 0x55b5b5b5b5b5b5b5 in OpenImageIO::ImageInput::read(int, int, int, bool, OpenImageIO::TypeSpec) /home/trb/run/OpenImageIO/src/lib/OpenImageIO/Core/OpenImageIO/Core/OpenImageIO.cpp:114 #10 0x55b5b5b5b5b5b5b5 in OpenImageIO::ImageInput::read(int, int, int, bool, OpenImageIO::TypeSpec) /home/trb/run/OpenImageIO/src/lib/OpenImageIO/Core/OpenImageIO/Core/OpenImageIO.cpp:114 #11 0x55b5b5b5b5b5b5b5 in OpenImageIO::ImageInput::read(int, int, int, bool, OpenImageIO::TypeSpec) /home/trb/run/OpenImageIO/src/lib/OpenImageIO/Core/OpenImageIO/Core/OpenImageIO.cpp:114 #12 0x55b5b5b5b5b5b5b5 in OpenImageIO::ImageInput::read(int, int, int, bool, OpenImageIO::TypeSpec) /home/trb/run/OpenImageIO/src/lib/OpenImageIO/Core/OpenImageIO/Core/OpenImageIO.cpp:114 #13 0x55b5b5b5b5b5b5b5 in OpenImageIO::ImageInput::read(int, int, int, bool, OpenImageIO::TypeSpec) /home/trb/run/OpenImageIO/src/lib/OpenImageIO/Core/OpenImageIO/Core/OpenImageIO.cpp:114 #14 0x55b5b5b5b5b5b5b5 in OpenImageIO::ImageInput::read(int, int, int, bool, OpenImageIO::TypeSpec) /home/trb/run/OpenImageIO/src/lib/OpenImageIO/Core/OpenImageIO/Core/OpenImageIO.cpp:114 #15 0x55b5b5b5b5b5b5b5 in OpenImageIO::ImageInput::read(int, int, int, bool, OpenImageIO::TypeSpec) /home/trb/run/OpenImageIO/src/lib/OpenImageIO/Core/OpenImageIO/Core/OpenImageIO.cpp:114 #16 0x55b5b5b5b5b5b5b5 in OpenImageIO::ImageInput::read(int, int, int, bool, OpenImageIO::TypeSpec) /home/trb/run/OpenImageIO/src/lib/OpenImageIO/Core/OpenImageIO/Core/OpenImageIO.cpp:114 #17 0x55b5b5b5b5b5b5b5 in OpenImageIO::ImageInput::read(int, int, int, bool, OpenImageIO::TypeSpec) /home/trb/run/OpenImageIO/src/lib/OpenImageIO/Core/OpenImageIO/Core/OpenImageIO.cpp:114 #18 0x55b5b5b5b5b5b5b5 in OpenImageIO::ImageInput::read(int, int, int, bool, OpenImageIO::TypeSpec) /home/trb/run/OpenImageIO/src/lib/OpenImageIO/Core/OpenImageIO/Core/OpenImageIO.cpp:114 #19 0x55b5b5b5b5b5b5b5 in OpenImageIO::ImageInput::read(int, int, int, bool, OpenImage

Goal Reached Thanks to every supporter — we hit 100%!

OpenImageIO PSD RawColor OOB read vulnerability

More from this source