Richard Geldreich 3454230543 KTX2: overflow-safe range checks and input bounds in ktx2_transcoder::init ...

The KTX2 level and supercompression-global-data (SGD) offset/length
fields are full 64-bit values read from the file. init() validated them
with "offset + length > m_data_size", where the addition can wrap around
and incorrectly pass for out-of-range values. Rewrite both checks as
"offset > m_data_size || length > (uint64_t)m_data_size - offset", which
cannot overflow (offset is confirmed <= m_data_size before the
subtraction, so it can't underflow either). The result is identical to
the original for every in-range input.

Also in init():
- Reject a level whose byte_length is 0. This case already logged an
  error but fell through without returning false.
- Add KTX2_MAX_SUPPORTED_LAYER_COUNT (65535) and reject files whose
  layer_count exceeds it, mirroring KTX2_MAX_SUPPORTED_LEVEL_COUNT, so
  layer_count * face_count * level_count stays bounded.

read_slice_offset_len_global_data(): compute image_count in 64-bit,
verify m_sgd_byte_length == image_count * descriptor_size before sizing
the descriptor array, and use try_resize() (returns false on failure)
instead of resize() (which aborts the process) so an out-of-range count
fails cleanly instead of attempting an oversized allocation. Also
compute image_count in 64-bit in decompress_etc1s_global_data().

Valid files are handled exactly as before.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-18 16:47:58 -04:00

1.6 MiB

Raw Blame History

View Raw