Mutliple NativeImage methods are susceptible to numeric overflow
The bug
Multiple methods of com.mojang.blaze3d.platform.NativeImage are susceptible to numeric overflow. Because this class is directly reading and writing memory (through Unsafe) this could cause JVM crashes or malfunction of the game.
However, it appears this might only occur for images larger than 2GB which is difficult to exploit.
While you are at it, please also fix MC-162953 by adjusting the size checks and checking for negative values.
Would also be good for sanity to verify that width and height provided to the NativeImage constructors are not negative.
Affected code
Last checked for 21w18a
com.mojang.blaze3d.platform.NativeImage.NativeImage(Format, int, int, boolean, long)
Value of size field could overflow.(Fixed in 21w18a)
Also why not have other constructor delegate to this one?- Maybe: com.mojang.blaze3d.platform.NativeImage.copyFromFont(STBTTFontinfo, int, int, int, float, float, float, float, int, int)
Should cast operands of n * this.getWidth() to long. - com.mojang.blaze3d.platform.NativeImage.copyFrom(NativeImage)
- com.mojang.blaze3d.platform.NativeImage.flipY()
com.mojang.blaze3d.platform.NativeImage.getPixelRGBA(int, int)(Fixed in 21w18a)com.mojang.blaze3d.platform.NativeImage.setPixelRGBA(int, int, int)(Fixed in 21w18a)- com.mojang.blaze3d.platform.NativeImage.getRedOrLuminance(int, int)
- com.mojang.blaze3d.platform.NativeImage.getGreenOrLuminance(int, int)
- com.mojang.blaze3d.platform.NativeImage.getBlueOrLuminance(int, int)
- com.mojang.blaze3d.platform.NativeImage.getLuminanceOrAlpha(int, int)
All of these should cast the operands of the multiplication to long.
2021-02-17, 02:06 AM
2023-08-22, 02:25 PM
2
3
-