Skip to content

fix(iff): clear tile staging buffer before decode to avoid heap reveal - #5466

Open
lgritz wants to merge 1 commit into
AcademySoftwareFoundation:mainfrom
lgritz:lg-iffdecode
Open

lgritz wants to merge 1 commit into
AcademySoftwareFoundation:mainfrom
lgritz:lg-iffdecode

Conversation

@lgritz

@lgritz lgritz commented Sep 12, 2026

Copy link
Copy Markdown
Collaborator

Funny thing about iff: if not all tiles are present in a corrupt file, there is no read error per se, but not all of m_buf staging area gets overwritten, leading to reveal of stale heap data (since m_heap is a default_init_vector). Fixed by zero-filling the buffer. We timed and this is a negligible cost, since the pre-fill with zero ends up bringing the whole thing in cache, making the actual decode into the buffer cheaper than if it was touching the memory for the first time.

Add several new tests for full coverage of all code paths that might involve this kind of situation.

Assisted-by: Claude Code / claude-opus-5

Funny thing about iff: if not all tiles are present in a corrupt file,
there is no read error per se, but not all of m_buf staging area gets
overwritten, leading to reveal of stale heap data (since m_heap is a
default_init_vector). Fixed by zero-filling the buffer. We timed and
this is a negligible cost, since the pre-fill with zero ends up
bringing the whole thing in cache, making the actual decode into the
buffer cheaper than if it was touching the memory for the first time.

Add several new tests for full coverage of all code paths that might
involve this kind of situation.

Assisted-by: Claude Code / claude-opus-5

Signed-off-by: Larry Gritz <lg@larrygritz.com>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Full-buffer clearing can cause excessive memory use or termination when decoding sparse corrupt files.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Fixes IFF decoding to prevent stale heap data from appearing in uncovered tile regions.

Changes:

  • Zero-fills the staging buffer before tile decoding.
  • Adds regression coverage for incomplete and unusual tile layouts.
  • Updates expected test hashes and metadata.
File summaries
File Summary
testsuite/iff/run.py Adds regression test commands.
testsuite/iff/ref/out.txt Updates expected metadata and hashes.
src/iff.imageio/iffinput.cpp Clears the staging buffer before decoding.
Review details
  • Files reviewed: 3/9 changed files
  • Comments generated: 1
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread src/iff.imageio/iffinput.cpp
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants