Bryan Henderson

A heap-based buffer overflow exists in the `readChannels()` function of sgitopnm when processing RLE-compressed SGI images. RLE (Run-Length Encoding) is a simple form of lossless data compression. An attacker can use crafted SGI files with oversized offset table lengths to write controlled data beyond the heap buffer, which may lead to application crashes or arbitrary code execution.

Multiple issues exist in the software that can lead to crashes or remote code execution when processing crafted files. In the `winicontopam` tool, an integer overflow occurs when handling ICO or CUR files with width or height dimensions exceeding 32767. This causes `int16 t` loop counters to wrap into negative row buffer indices, resulting in heap memory corruption. Additionally, the `picttoppm` tool contains a stack overflow in the `paintPoly()` function when processing PICT polygons with more than 100 points. Finally, the `jbigtopnm` tool is subject to an integer overflow when processing large multi-plane JBIG files, which leads to a heap buffer overflow.

A stack-based buffer overflow exists in the `paintPoly()` function of the picttoppm utility. This occurs because the software does not limit the number of points in a polygon. An attacker can use a specially crafted PICT file containing a polygon with more than 100 points to overwrite the fixed `pts` array, which may lead to application crashes or arbitrary code execution.

A stack-based buffer overflow exists in the `scanPoly()` function within the `converter/ppm/picttoppm.c` file of the picttoppm utility. This occurs when the converter processes a specially crafted PICT file containing polygon edges that generate more than 5000 points, causing the `coord` stack array to overflow. This can lead to a program crash or potential arbitrary code execution.

A heap buffer overflow exists in the `xpmtoppm()` function due to an unvalidated characters-per-pixel value in the XPM header. An attacker can provide a specially crafted XPM file where the characters-per-pixel value exceeds 3, leading to an overrun of fixed 3-byte `colorName` hash entries. This can result in application crashes or potential arbitrary code execution.

An integer overflow exists in the `jbigtopnm` utility when calculating the output buffer size. A remote attacker can exploit this by providing a specially crafted multi-plane JBIG file with excessively large header dimensions. This leads to a heap buffer overflow within the `jbg dec merge planes()` function, which may result in application crashes or arbitrary code execution.

An out-of-bounds read exists in the `get pixel()` function of the tgatoppm converter. The issue occurs because the converter uses unchecked pixel values as color map indexes. A remote attacker can provide a specially crafted color-mapped Targa file with pixel values that exceed the declared color map bounds, leading to a program crash or the leakage of adjacent memory into the resulting output image.