BUG: Check dim[0] before using it to index dim[] in the NIFTI-2 converter - #105
Open
hjmjohnson wants to merge 1 commit into
Open
hjmjohnson wants to merge 1 commit into
hjmjohnson wants to merge 1 commit into
Conversation
…rter
nifti_convert_n2hdr2nim() uses nhdr.dim[0], the number of dimensions,
as a loop bound over the eight-element dim[] array:
for( ii=2 ; ii <= nhdr.dim[0] ; ii++ ) ...
for( ii=nhdr.dim[0]+1 ; ii <= 7 ; ii++ ) ...
for( ii=1 ; ii <= nhdr.dim[0] ; ii++ ) ...
It never checks that dim[0] is in [0,7]. The NIFTI-1 converter gets
that check for free, because need_nhdr_swap() rejects a dim[0] outside
[1,7] in either byte order, but the NIFTI-2 path decides swapping from
sizeof_hdr and reaches the loops with whatever the file said.
A NIFTI-2 header with a large negative dim[0] therefore starts the
second loop at a wild negative index, reads far outside the header and
segfaults. This is not confined to the header API: nifti_image_read()
gets there for any file with a valid 540 byte NIFTI-2 header, so a
604 byte file crashes nifti_tool:
$ nifti_tool -disp_nim -infiles bad_n2_dim0.nii
nifti2_io.c:5079: runtime error: index -6727636073941130588 out of
bounds for type 'int64_t[8]'
AddressSanitizer: SEGV ... in nifti_convert_n2hdr2nim
dim[0] is now range checked in the same place, and in the same style,
as the dim[1] check just below it. Zero stays acceptable, as it is on
the NIFTI-1 side. Valid headers are unaffected: dim[0] outside [0,7]
has no meaning in either format.
Found by fuzzing nifti_convert_n2hdr2nim() with clang's libFuzzer under
AddressSanitizer.
(cherry picked from commit 5e32002)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Re-submission of #64, reverted from
masteron 2026-09-24 so it can bereviewed before merging. Content is unchanged from the original.
Base:
master. Independent: nothing has to land before it.Commits
Ordering for all the re-submitted work is tracked in #84.