Skip to content

Conversation

@determ1ne
Copy link

A malicious crafted image will crash the wechat_qrcode module by invalid memory access.

Sample image:

qr

In DecodedBitStreamParser::decodeByteSegment, an attacker can build a qr code with a byte segment, in which the bits count is larger than actually available bits. Code in line 203 will try to read from an invalid memory region and crash the program. An additional sanity check on count should be added.

// try to repair count data if count data is invalid
if (count * 8 > available) {
count = (available + 7 / 8);
}
ArrayRef<char> bytes_(count);
char* readBytes = &(*bytes_)[0];
for (int i = 0; i < count; i++) {
// readBytes[i] = (char) bits.readBits(8);
int readBits = available < 8 ? available : 8;
readBytes[i] = (char)bits.readBits(readBits, err_handler);
}

Pull Request Readiness Checklist

See details at https://github.com/opencv/opencv/wiki/How_to_contribute#making-a-good-pull-request

  • I agree to contribute to the project under Apache 2 License.
  • To the best of my knowledge, the proposed patch is not based on a code under GPL or another license that is incompatible with OpenCV
  • The PR is proposed to the proper branch
  • There is a reference to the original bug report and related work
  • There is accuracy test, performance test and test data in opencv_extra repository, if applicable
    Patch to opencv_extra has the same branch name.
  • The feature is well documented and sample code can be built with the project CMake

@dddzg
Copy link
Contributor

dddzg commented Apr 25, 2023

I am shocked that the community could find this detailed bug with a sample image. Thanks a lot. This PR could be contained with #3480 .

@WanliZhong WanliZhong mentioned this pull request Apr 25, 2023
6 tasks
@WanliZhong
Copy link
Member

Thanks for contribution! This bug was fixed by another PR #3480

@WanliZhong WanliZhong closed this Apr 26, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants