KolibriOS/kolibrios
17
27
Fork 69
Code Issues 157 Pull Requests 48 Actions Projects 2 Releases Wiki Activity

libimg/png: fix page fault when unpacked image data ends at page boundary #568

Merged
Burer merged 2 commits from libimg-png-fix into main 2026-07-18 10:54:26 +00:00
Conversation 3 Commits 2 Files Changed 2
+11 -6
Leency commented 2026-07-11 13:58:35 +00:00
Owner
Copy Link
Copy Source

KIV were crashing on the attached files. Now this is fixed.

KIV were crashing on the attached files. Now this is fixed.
0002.PNG
69 KiB
0037.PNG
317 KiB
0058.PNG
122 KiB
0002.PNG 0037.PNG 0058.PNG
Leency requested review from dunkaist 2026-07-11 13:58:50 +00:00
Leency requested review from IgorA 2026-07-11 13:58:50 +00:00
Burer changed title from libimg: fix png.asm page fault on 4096px-tall images (buffer over-read at page boundary) to libimg/png: fix page fault when unpacked image data ends at page boundary 2026-07-11 17:54:50 +00:00
Burer approved these changes 2026-07-11 17:55:19 +00:00
programs/develop/libraries/libs-dev/libimg/png/png.asm Outdated
@@ -931,3 +929,1 @@
mov ecx, ebx
.rgb2.innloop2:
mov eax, [esi]
; do not read a whole dword: the last pixel of the unpacked data may end
dunkaist commented 2026-07-14 21:35:43 +00:00
Owner
Copy Link
Copy Source

I'm not familiar with the internals of PNG, but is it possible that two or three last bytes are unmapped?

I'm not familiar with the internals of PNG, but is it possible that two or three last bytes are unmapped?
Burer commented 2026-07-18 10:51:21 +00:00
Owner
Copy Link
Copy Source

I believe, no.
The three bytes read are the pixel's own R, G, B - the loop advances esi by 3 per pixel, so [esi+2] is the last valid byte and only [esi+3] was past the buffer.
Data the decompressor just wrote cannot be unmapped, so reading exactly as many bytes as the pixel occupies is always safe.

I believe, no. The three bytes read are the pixel's own R, G, B - the loop advances `esi` by 3 per pixel, so `[esi+2]` is the last valid byte and only `[esi+3]` was past the buffer. Data the decompressor just wrote cannot be unmapped, so reading exactly as many bytes as the pixel occupies is always safe.
dunkaist marked this conversation as resolved
IgorA approved these changes 2026-07-15 15:08:04 +00:00
Burer added 2 commits 2026-07-18 10:45:44 +00:00
libimg: fix png.asm page fault on 4096px-tall images (buffer over-read at page boundary) b864b1fd66
libs/libimg: more performant fix
Test PR / Build (ru_RU) (pull_request) Successful in 1m52s
Details
Test PR / Build (en_US) (pull_request) Successful in 1m57s
Details
Test PR / Build (es_ES) (pull_request) Successful in 2m0s
Details
c2e9bcbf8e
Burer force-pushed libimg-png-fix from 880fcf3bf5 to c2e9bcbf8e 2026-07-18 10:45:44 +00:00 Compare
Burer merged commit 3922240df3 into main 2026-07-18 10:54:26 +00:00
Burer deleted branch libimg-png-fix 2026-07-18 10:54:26 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Burer
dunkaist
IgorA
Labels
Clear labels
Influence/Text/TYPO
AI
Eolite
FS
GSoC
This issue or PR in the Google Source of Code program
 Good First PR
The issue is suitable to beginners
 HLL
HardwareTested
IRCC
Influence/Settings
Lang/C
Lang/FASM
Pay for the code
Paid task
 Subsystem/API
Subsystem/Audio
infinity service, audio drivers, midi, speacker, audio programs
 Subsystem/Graphics
vesa, vga, framebuffer, cursors, blitter, and video drivers
 Subsystem/IPC and events
pipes, signals, events, shared memory
 Subsystem/Memory
virt and phys memory allocators, malloc and other
 Subsystem/Network
Subsystem/Services(daemon)
userspace and kernel(for example: serial) services
 Subsystem/Taskmanager
process, threads, run apps, scheduler
 Subsystem/VFS
drivers from filesystem, fs api, blkdev, programs that work with the file system
 Subsystem/Window
windows, skins, buttons, mouse and keyboard code for windows (not the base code)
Category
Applications
Category
Drivers
Category
General
Category
Kernel
Category
Libraries
Kind
Breaking
Breaking change that won't be backward compatible
Kind
Bug
Something is not working
Kind
Build
Kind
Documentation
Documentation changes
Kind
Enhancement
Improve existing functionality
Kind
Feature
New functionality
Kind
Security
This is security issue
Kind
Testing
Issue or pull request related to testing
PR
Ready to merge
Pull request is ready for merge
PR
Conflicts
PR conflicts with main
PR
Dependent
This PR is dependent on another PR
PR
Request changes
Changes requested in pull request
PR
Review required
Priority
Critical
1
The priority is critical
Priority
High
2
The priority is high
Priority
Medium
3
The priority is medium
Priority
Low
4
The priority is low
Reviewed
Confirmed
Issue has been confirmed
Reviewed
Duplicate
This issue or pull request already exists
Reviewed
Invalid
Invalid issue
Reviewed
Won't Fix
This issue won't be fixed
Status
Abandoned
Somebody has started to work on this but abandoned work
Status
Blocked
Something is blocking this issue or pull request
Status
Need More Info
Feedback is required to reproduce issue or to continue work
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
ace-dent (Andrew) b00bl1k (Alexey Ryabov) bad_Dr3dd0x Burer Doczom (Mikhail Frolov) dunkaist (Ivan B) Egor00f (Егор Ярин) hidnplayr IgorA Leency (Kiril Lipatov) mxlgv (Max Logaev) ramenu rgimad sdongles (Serhii Sakhno) Sweetbread (Gleb Zaharov)
No Assignees
4 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: KolibriOS/kolibrios#568