BUG: Free the previous filename when an ASCII header repeats the attribute - #100
Open
hjmjohnson wants to merge 1 commit into
Open
hjmjohnson wants to merge 1 commit into
hjmjohnson wants to merge 1 commit into
Conversation
…ibute
nifti_image_from_ascii() walks the attributes of an ASCII header and
assigns the two filename fields with
nim->fname = nifti_strdup(rhs) ;
nim->iname = nifti_strdup(rhs) ;
Nothing stops a header from carrying header_filename or image_filename
twice, and nothing rejects the repeat, so the second assignment drops
the first string. The input comes from a file, so the leak is
attacker-controlled in size and count: one copy per repetition.
Direct leak of 5 byte(s) in 1 object(s) allocated from:
#0 malloc
#1 nifti_strdup nifti2_io.c:1301
#2 nifti_image_from_ascii nifti2_io.c:8874
Freeing before the assignment costs one call and keeps the last value,
which is what the function already documented by overwriting. The
fields are NULL until the first assignment, and free(NULL) is defined,
so no other path changes.
The same two lines exist in nifti1_io.c and are fixed there too.
Found by fuzzing nifti_image_from_ascii() with clang's libFuzzer under
AddressSanitizer.
(cherry picked from commit b4c6894)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Re-submission of #69, reverted from
masteron 2026-09-24 so it can bereviewed before merging. Content is unchanged from the original.
Base:
master. Independent: nothing has to land before it.Commits
Ordering for all the re-submitted work is tracked in #84.