Thanks to visit codestin.com
Credit goes to github.com

Skip to content

heif{load,save}: guard against NULL strings #3608

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Aug 14, 2023

Conversation

kleisauke
Copy link
Member

This would prevent a NULL string from being printed with vsnprintf in case of a write error.

See: #3588.

Targets the 8.14 branch.

This would prevent a `NULL` string from being printed with
`vsnprintf` in case of a write error.

See: libvips#3588.
Copy link
Member

@jcupitt jcupitt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1!

@kleisauke kleisauke changed the title heifsave: ensure error->message is initialized heif{load,save}: guard against NULL strings Aug 14, 2023
@kleisauke
Copy link
Member Author

I simplified/improved this with commit b3bfa34. PTAL.

@kleisauke kleisauke merged commit 7784143 into libvips:8.14 Aug 14, 2023
@kleisauke kleisauke deleted the 8.14-fix-ub-heifsave branch August 14, 2023 12:04
@negator
Copy link

negator commented Aug 14, 2023

@kleisauke Sorry just saw this. Would it make sense to do the NULL check in the vips_vsnprintf instead/also? To catch all attempts to write a NULL to vsnprintf.

@jcupitt
Copy link
Member

jcupitt commented Aug 14, 2023

C doesn't allow that, unfortunately, unless you parse the format string yourself.

@kleisauke
Copy link
Member Author

Indeed, it would be a bit difficult to do this in vips_vsnprintf. Perhaps this fix is a bit too cautious, as libheif says that this will never be NULL:
https://github.com/strukturag/libheif/blob/9493f9a7f9389ad15ae45ae04b119bcca4aec049/libheif/heif.h#L322

But, "better safe than sorry". :)

@negator
Copy link

negator commented Aug 14, 2023

Ah I see, you're right this would be very clunky to NULL check. Thanks for the fast replies and fixes!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants