Accusoft ImageGear Palette box parser heap-based buffer overflow vulnerability

We discussed this vulnerability during Episode 124 on 01 March 2022

Off-by-one issue in computing the bits_required value. This computation was performed with a while loop, right-shifting the vlaue by 1 until it is zero, number of shifts is the number of bits needed.

while (NE_field = NE_field >> 1, NE_field != 0) { 
	bit_required = bit_required + 1;
}

The problem is that the bits_required value is tracking one behind the number of shifts actually performed. Since it starts off by performing a right-shift and comparing with 0. If the value was 0x01, right-sift by one results in 0x00, which matches the NE_field != 0 check and the escapes the loop without ever incrementing the bits_required value. Similarly for any value, the last right-shift will not be counted.