SEGV in iw_malloc_ex

[whiteHat001]

root@ubuntu:/home/hjy/Desktop# imagew imagew1.png ./imout/ -outfmt jpg
imagew1.png → ./imout/
==13080==ERROR: AddressSanitizer failed to allocate 0x771ff000 (1998581760) bytes of LargeMmapAllocator: 12
==13080==Process memory map follows:
0x08048000-0x0812c000 /usr/local/bin/imagew
0x0812c000-0x0812d000 /usr/local/bin/imagew
0x0812d000-0x08131000 /usr/local/bin/imagew
0x1ffff000-0x24000000
0x24000000-0x28000000
0x28000000-0x40000000
0xb4400000-0xb4500000
0xb4600000-0xb4700000
0xb4800000-0xb4900000
0xb4a00000-0xb4b00000
0xb4c00000-0xb4d00000
0xb4e00000-0xb4f00000
0xb5000000-0xb5100000
0xb5200000-0xb5300000
0xb5400000-0xb5500000
0xb5600000-0xb5800000 /usr/lib/locale/locale-archive
0xb5800000-0xb5900000
0xb5a00000-0xb5b00000
0xb5c00000-0xb5d00000
0xb5d88000-0xb6f1d000
0xb6f1d000-0xb6f38000 /lib/i386-linux-gnu/libgcc_s.so.1
0xb6f38000-0xb6f39000 /lib/i386-linux-gnu/libgcc_s.so.1
0xb6f39000-0xb6f3a000 /lib/i386-linux-gnu/libgcc_s.so.1
0xb6f3a000-0xb6f3d000 /lib/i386-linux-gnu/libdl-2.19.so
0xb6f3d000-0xb6f3e000 /lib/i386-linux-gnu/libdl-2.19.so
0xb6f3e000-0xb6f3f000 /lib/i386-linux-gnu/libdl-2.19.so
0xb6f3f000-0xb6f40000
0xb6f40000-0xb6f58000 /lib/i386-linux-gnu/libpthread-2.19.so
0xb6f58000-0xb6f59000 /lib/i386-linux-gnu/libpthread-2.19.so
0xb6f59000-0xb6f5a000 /lib/i386-linux-gnu/libpthread-2.19.so
0xb6f5a000-0xb6f5c000
0xb6f5c000-0xb7105000 /lib/i386-linux-gnu/libc-2.19.so
0xb7105000-0xb7107000 /lib/i386-linux-gnu/libc-2.19.so
0xb7107000-0xb7108000 /lib/i386-linux-gnu/libc-2.19.so
0xb7108000-0xb710b000
0xb710b000-0xb7123000 /lib/i386-linux-gnu/libz.so.1.2.8
0xb7123000-0xb7124000 /lib/i386-linux-gnu/libz.so.1.2.8
0xb7124000-0xb7125000 /lib/i386-linux-gnu/libz.so.1.2.8
0xb7125000-0xb714b000 /lib/i386-linux-gnu/libpng12.so.0.50.0
0xb714b000-0xb714c000 /lib/i386-linux-gnu/libpng12.so.0.50.0
0xb714c000-0xb714d000 /lib/i386-linux-gnu/libpng12.so.0.50.0
0xb714d000-0xb7196000 /usr/lib/i386-linux-gnu/libjpeg.so.8.0.2
0xb7196000-0xb7197000 /usr/lib/i386-linux-gnu/libjpeg.so.8.0.2
0xb7197000-0xb7198000 /usr/lib/i386-linux-gnu/libjpeg.so.8.0.2
0xb7198000-0xb71a9000
0xb71a9000-0xb71ed000 /lib/i386-linux-gnu/libm-2.19.so
0xb71ed000-0xb71ee000 /lib/i386-linux-gnu/libm-2.19.so
0xb71ee000-0xb71ef000 /lib/i386-linux-gnu/libm-2.19.so
0xb71ef000-0xb728e000 /usr/lib/i386-linux-gnu/libasan.so.1.0.0
0xb728e000-0xb7290000 /usr/lib/i386-linux-gnu/libasan.so.1.0.0
0xb7290000-0xb7291000 /usr/lib/i386-linux-gnu/libasan.so.1.0.0
0xb7291000-0xb76e9000
0xb76f1000-0xb76f5000
0xb76f6000-0xb76f8000
0xb76f8000-0xb76f9000 /usr/lib/locale/locale-archive
0xb76f9000-0xb7700000
0xb7700000-0xb7701000 [vdso]
0xb7701000-0xb7721000 /lib/i386-linux-gnu/ld-2.19.so
0xb7721000-0xb7722000 /lib/i386-linux-gnu/ld-2.19.so
0xb7722000-0xb7723000 /lib/i386-linux-gnu/ld-2.19.so
0xbff53000-0xbff74000 [stack]
==13080==End of process memory map.
==13080==AddressSanitizer CHECK failed: ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix.cc:66 "(("unable to mmap" && 0)) != (0)" (0x0, 0x0)
#0 0xb72434c1 (/usr/lib/i386-linux-gnu/libasan.so.1+0x544c1)
#1 0xb72476a9 in __sanitizer::CheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) (/usr/lib/i386-linux-gnu/libasan.so.1+0x586a9)
#2 0xb724ce22 (/usr/lib/i386-linux-gnu/libasan.so.1+0x5de22)
#3 0xb720799b (/usr/lib/i386-linux-gnu/libasan.so.1+0x1899b)
#4 0xb7208488 (/usr/lib/i386-linux-gnu/libasan.so.1+0x19488)
#5 0xb723d84a in __interceptor_malloc (/usr/lib/i386-linux-gnu/libasan.so.1+0x4e84a)
#6 0x8115495 in iw_malloc_ex src/imagew-util.c:48
#7 0x8115495 in iw_malloc_large src/imagew-util.c:77
#8 0x80d2a97 in bmpr_read_rle src/imagew-bmp.c:869
#9 0x80d2a97 in iwbmp_read_bits src/imagew-bmp.c:916
#10 0x80d2a97 in iw_read_bmp_file src/imagew-bmp.c:983
#11 0x80536ad in iwcmd_run src/imagew-cmd.c:1191
#12 0x80689b0 in iwcmd_main src/imagew-cmd.c:3018
#13 0x804a94a in main src/imagew-cmd.c:3067
#14 0xb6f75a82 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x19a82)
#15 0x804ae2f (/usr/local/bin/imagew+0x804ae2f)

[jsummers]

If there really is a SEGV, please explain. The output doesn't seem to show that.

I'm assuming imagew1.png is the file at https://github.com/whiteHat001/FUZZ_POC/blob/master/imagew1.png

[jsummers]

When I try it, if the allocation fails, it prints "imagew error: Out of memory", and exits. If the allocation succeeds, it prints "imagew error: BMP read failed", and exits.

I don't know if what it does is considered to be good behavior, but as far as I can tell, it's working as intended.

[whiteHat001]

I am sorry that I actually want to express the meaning of this question is a out of memory bug