Skip to content

reject undersized payload in load_ktx_compressed_image #658

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
solidpixel merged 2 commits into from
Jul 18, 2026
Merged

reject undersized payload in load_ktx_compressed_image #658

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5393f1a
reject undersized payload in load_ktx_compressed_image
sahvx655-wq Jul 11, 2026
cc1c638
Use block_size helper to improve readability
solidpixel Jul 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 24 additions & 2 deletions Source/astcenccli_image_load_store.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1361,6 +1361,28 @@ bool load_ktx_compressed_image(
data_len = reverse_bytes_u32(data_len);
}

// The data size and pixel dimensions are independent header fields, so
// reject a data size that is too small for the given image dimensions
size_t block_x = fmt->x;
size_t block_y = fmt->y;
size_t block_z = fmt->z == 0 ? 1 : fmt->z;

size_t dim_z = hdr.pixel_depth == 0 ? 1 : hdr.pixel_depth;
size_t blocks_x = astc::get_block_count_safe(hdr.pixel_width, block_x);
size_t blocks_y = astc::get_block_count_safe(hdr.pixel_height, block_y);
size_t blocks_z = astc::get_block_count_safe(dim_z, block_z);

bool overflow { false };
size_t size_needed = astc::mul_safe(blocks_x, blocks_y, overflow);
size_needed = astc::mul_safe(size_needed, blocks_z, overflow);
size_needed = astc::mul_safe(size_needed, 16, overflow);

if (overflow || data_len < size_needed)
{
print_error("ERROR: Image header corrupt '%s'\n", filename);
return true;
}

// Read the data
img.data.resize(data_len);
file.read(reinterpret_cast<char*>(img.data.data()), data_len);
Expand Down Expand Up @@ -1472,8 +1494,8 @@ static bool store_ktx_uncompressed_image(
// Size of image data padded to a multiple of 4 bytes
size_t image_write_bytes = (image_bytes + 3) & ~3;

// The KTX imageSize field is a fixed 32-bit value, so check that the size_t
/// value can be safely narrowed, and does not wrap when padded
// The KTX data size field is a fixed 32-bit value, so check that the
// size_t value can be safely narrowed and does not wrap when padded
uint32_t image_bytes_field = static_cast<uint32_t>(image_bytes);
if ((image_bytes_field != image_bytes) || (image_write_bytes < image_bytes))
{
Expand Down
Loading