SixLabors.ImageSharp Image Decoder Input Validation Vulnerability Fix

Vulnerability Overview This vulnerability involves strengthening validation of decoders and metadata inputs. Specific fixes include validating the dimensions of BMP, GIF, and TGA images; detecting duplicate PNG headers; verifying WebP metadata length; validating ICC tags; validating EXIF segments; verifying floating-point pixel conversion; validating TIFF directory entries; and validating EVR block lengths. These fixes aim to prevent decoding failures or data corruption caused by malformed inputs. Impact Scope Affected Component: SixLabors.ImageSharp library Affected Versions: From 3.1.12 to 4.1.2 Impact Type: Insufficient decoder and metadata input validation, which may lead to decoding failures or data corruption Remediation 1. Validate decoded BMP, GIF, and TGA image dimensions: Validate image dimensions before creating the image buffer. 2. Reject duplicate PNG headers: Calculate scanline length during decoding and identification, use wide arithmetic for narrowing to support buffer size, and apply auxiliary integrity policies to invalidate compressed ICC and metadata. 3. Shared stream range validation: Check BMP ICC offset and length as well as WebP metadata length by extending to avoid overflows, and use the same range checks to validate JPEG segments. 4. Apply EXIF segments: Apply EXIF segments at serialization boundaries, including lazily loaded profiles and immediately installed profiles. 5. Validate ICC tag extensions and minimum size: Calculate CLUT storage, verify that the load fits within the allocation, and reject unsupported channel conversions. 6. Make consistent: Map NaN to lower and upper bounds in all scaling and floating-point overloads, and use contracts to match single-pixel and batch behavior in scaling half-precision conversions. 7. Boundary BigTIFF directory entries: Use encoding bit boundaries and use pixel rounding to cover narrow images. 8. Validate EVR decompressed block lengths: Include partial final blocks, interpret signed scanline coordinates relative to the data window, initialize omitted color channels, and clear failed blocks. POC Code/Exploit Code No specific POC code or exploit code was provided in the page. Summary This vulnerability addresses multiple issues related to decoder and metadata input validation in the SixLabors.ImageSharp library, ensuring security and stability when processing various image formats. The remediation measures include validation of image dimensions, headers, metadata lengths, ICC tags, EXIF segments, floating-point pixel conversions, TIFF directory entries, and EVR block lengths. These fixes help prevent decoding failures or data corruption caused by the use of malformed inputs.

Goal Reached Thanks to every supporter — we hit 100%!

SixLabors.ImageSharp Image Decoder Input Validation Vulnerability Fix

More from this source