DjVuLibre’s Arithmetic Misadventures: When Unsigned Integers Go Rogue!
DjVuLibre 3.5.29 contains a bug that wraps around like a boomerang with an attitude problem. When unsigned integers overflow during arithmetic encoding, bad things happen—memory corruption, crashes, and chaos ensue. Proceed with caution if you’re processing untrusted PPM/DjVu input.
Hot Take:
Oh DjVuLibre, you weren’t supposed to take “overflowing with potential” so literally! It seems our favorite document compression library has been hitting the wrong numbers in its arithmetic encoding. Time to update that math textbook, or better yet, maybe just stick to compressing your feelings about this whole debacle!
Key Points:
- DjVuLibre 3.5.29’s ZPCodec component has multiple unsigned integer overflow issues.
- Arithmetic encoding operations like zemit and encode_lps are affected.
- Crafted input can lead to memory corruption, crashes, and incorrect buffer writes.
- High risk for systems processing untrusted PPM/DjVu input.
- Proof of concept and sanitizer output provided by Ron E.
Already a member? Log in here