search

Kalpanika / x3f

Tools for manipulating X3F files from Sigma cameras
88 stars 28 forks source link

Handling of broken data #116

Closed LibRaw closed 4 years ago

LibRaw commented 4 years ago

We (in LibRaw) use (outdated) version of x3f_tools to handle Sigma Foveon files. We've received several bugreports: 1: https://github.com/LibRaw/LibRaw/issues/270 2: https://github.com/LibRaw/LibRaw/issues/271 3: https://github.com/LibRaw/LibRaw/issues/271 (there are POC files in these reports) And here are fixes for that: 1: https://github.com/LibRaw/LibRaw/commit/d75af00681a74dcc8b929207eb895611a6eceb68 2: https://github.com/LibRaw/LibRaw/commit/5ab45b085898e379fedc6b113e2e82a890602b1e 3: https://github.com/LibRaw/LibRaw/commit/11c4db253ef2c9bb44247b578f5caa57c66a1eeb

It would be good to backport this fixes (or, may be, provide more checks on input data) in the upstream.

rolkar commented 4 years ago

First of all - we are sorry to say that we do not actively update the x3f code any more. There are several reasons for this. One is that we do other stuff instead. Another one is that the formats of Sigma files are so unpredictable and strange so it is impossible to keep up with changes Sigma do. We still do not understand 100% how to handle color and field flattening. Which makes many images to have strange colors.

Second - you errors seems to be due to broken files. The code might go bananas everywhere if files are broken. There are no guarantee against that. So, there would be LOTS of tests everywhere.

Third - your fix is to throw a libraw exception. That is nothing we can do in the library.

LibRaw commented 4 years ago

Yes, it is fixed using throw, because libraw handles it properly.

The problem with broken data handling is not a real problem in most cases, excluding a) some service that deals with any input file (e.g. file upload on web service) b) other ways to receive files from outside (E-mail, etc)

In both cases specially crafted file may cause stack overrun, so executing of arbitrary code in user application context.

This may happen in, for example, this software stack: Website uses ImageMagic for image processing for incoming images ImageMagic uses LibRaw LibRaw uses x3f tools code

We're unable to maintain x3f tools code on our side.

So: we'll disable x3f tools code usage in LibRaw if compiled w/ default compilation flags, if someone wish to process x3f files, one should use specially compiled LibRaw.

rolkar commented 4 years ago

OK - I understand your decision. It was just such a mess with the Sigma files so we got fed up with it. And modern Sigma/Foveon cameras do output DNG files anyhow.

rolkar commented 4 years ago

Pushed the wrong button. Reopen instead of comment. So - I close it. Again :)