Mojira Archive
MC-215771

Mutliple NativeImage methods are susceptible to numeric overflow

The bug

Multiple methods of com.mojang.blaze3d.platform.NativeImage are susceptible to numeric overflow. Because this class is directly reading and writing memory (through Unsafe) this could cause JVM crashes or malfunction of the game.
However, it appears this might only occur for images larger than 2GB which is difficult to exploit.

While you are at it, please also fix MC-162953 by adjusting the size checks and checking for negative values.
Would also be good for sanity to verify that width and height provided to the NativeImage constructors are not negative.

Affected code

Last checked for 21w18a

  • com.mojang.blaze3d.platform.NativeImage.NativeImage(Format, int, int, boolean, long)
    Value of size field could overflow. (Fixed in 21w18a)
    Also why not have other constructor delegate to this one?
  • Maybe: com.mojang.blaze3d.platform.NativeImage.copyFromFont(STBTTFontinfo, int, int, int, float, float, float, float, int, int)
    Should cast operands of n * this.getWidth() to long.
  • com.mojang.blaze3d.platform.NativeImage.copyFrom(NativeImage)
  • com.mojang.blaze3d.platform.NativeImage.flipY()
  • com.mojang.blaze3d.platform.NativeImage.getPixelRGBA(int, int) (Fixed in 21w18a)
  • com.mojang.blaze3d.platform.NativeImage.setPixelRGBA(int, int, int) (Fixed in 21w18a)
  • com.mojang.blaze3d.platform.NativeImage.getRedOrLuminance(int, int)
  • com.mojang.blaze3d.platform.NativeImage.getGreenOrLuminance(int, int)
  • com.mojang.blaze3d.platform.NativeImage.getBlueOrLuminance(int, int)
  • com.mojang.blaze3d.platform.NativeImage.getLuminanceOrAlpha(int, int)

All of these should cast the operands of the multiplication to long.

Unresolved

Marcono1234

2021-02-17, 02:06 AM

2023-08-22, 02:25 PM

2

3

Plausible

Normal

Platform

Crash

21w06a, 21w18a

-