Skip to content

Fix integer overflow vulnerability in exportImagePixels#775

Open
vah13 wants to merge 1 commit intoImagick:masterfrom
vah13:master
Open

Fix integer overflow vulnerability in exportImagePixels#775
vah13 wants to merge 1 commit intoImagick:masterfrom
vah13:master

Conversation

@vah13
Copy link

@vah13 vah13 commented Feb 10, 2026

Fixed a critical integer overflow in Imagick::exportImagePixels() that could lead to heap buffer overflow. The vulnerability occurred when calculating pixel buffer size (map_len * width * height) using 32-bit signed integers, which would overflow for large images and result in undersized buffer allocation followed by out-of-bounds memory writes.

Changes:

  • Changed map_size type from int to size_t to handle large values
  • Added overflow checks before calculating map_size
  • Added overflow check before memory allocation
  • Prevents potential heap corruption and RCE exploits

The fix validates calculations at each step:

  1. Check map_len * width for overflow
  2. Check result * height for overflow
  3. Check final size * sizeof(type) for overflow

Fixed a critical integer overflow in Imagick::exportImagePixels() that could lead to heap buffer overflow. The vulnerability occurred when calculating pixel buffer size (map_len * width * height) using 32-bit signed integers, which would overflow for large images and result in undersized buffer allocation followed by out-of-bounds memory writes.

Changes:
- Changed map_size type from int to size_t to handle large values
- Added overflow checks before calculating map_size
- Added overflow check before memory allocation
- Prevents potential heap corruption and RCE exploits

The fix validates calculations at each step:
1. Check map_len * width for overflow
2. Check result * height for overflow
3. Check final size * sizeof(type) for overflow
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant