Closed
Description
$rax : 0x0000000000000000
$rbx : 0x00007fffffffd360 → 0x0000000000000000
$rcx : 0x0000000000ec0fed → 0x6e69676522000001
$rdx : 0x00007fffffffd360 → 0x0000000000000000
$rsp : 0x00007fffffffd200 → 0x0000000000000000
$rbp : 0x00000000ffffffea
$rsi : 0x00000000ffffffea
$rdi : 0x0000000000000000
$rip : 0x00000000007685c7 → <Exiv2::DataBuf::alloc(long)+279> mov rdi, rbp
$r8 : 0xffffffffffffe310
$r9 : 0xffffffffffffe300
$r10 : 0xffffffffffffe2f0
$r11 : 0x000000000000047a
$r12 : 0x0000000000ec146b → 0xbcaea80000000000
$r13 : 0x000000000000001c
$r14 : 0x0000000000000000
$r15 : 0x0000000000000000
$eflags: [carry PARITY adjust ZERO sign trap INTERRUPT direction overflow resume virtualx86 identification]
$es: 0x0000 $gs: 0x0000 $ds: 0x0000 $ss: 0x002b $fs: 0x0000 $cs: 0x0033
───────────────────────────────────────────────────────────────────[ stack ]────
0x00007fffffffd200│+0x00: 0x0000000000000000 ← $rsp
0x00007fffffffd208│+0x08: 0x00007fffffffd360 → 0x0000000000000000
0x00007fffffffd210│+0x10: 0x00000000fffffff5
0x00007fffffffd218│+0x18: 0x0000000000813738 → <Exiv2::Internal::PngChunk::zlibUncompress(unsigned+0> mov rdi, QWORD PTR [rbx]
0x00007fffffffd220│+0x20: 0x00000000ffffffea
0x00007fffffffd228│+0x28: 0xa65c0e3e1fcb3000
0x00007fffffffd230│+0x30: 0x0000000000ec0fd0 → 0x2e6d6f633a4c4d58
0x00007fffffffd238│+0x38: 0x00007fffffffd360 → 0x0000000000000000
────────────────────────────────────────────────────────[ code:i386:x86-64 ]────
0x7685b0 <Exiv2::DataBuf::alloc(long)+256> lea rsp, [rsp+0x98]
0x7685b8 <Exiv2::DataBuf::alloc(long)+264> mov QWORD PTR [rbx], 0x0
0x7685bf <Exiv2::DataBuf::alloc(long)+271> mov QWORD PTR [rbx+0x8], 0x0
→ 0x7685c7 <Exiv2::DataBuf::alloc(long)+279> mov rdi, rbp
0x7685ca <Exiv2::DataBuf::alloc(long)+282> call 0x405ac0 <_Znam@plt>
0x7685cf <Exiv2::DataBuf::alloc(long)+287> mov QWORD PTR [rbx+0x8], rbp
0x7685d3 <Exiv2::DataBuf::alloc(long)+291> mov QWORD PTR [rbx], rax
0x7685d6 <Exiv2::DataBuf::alloc(long)+294> add rsp, 0x8
0x7685da <Exiv2::DataBuf::alloc(long)+298> pop rbx
────────────────────────────────────────────────────[ source:types.cpp+153 ]────
148 {
149 if (size > size_) {
150 delete[] pData_;
151 pData_ = 0;
152 size_ = 0;
// size=0xffffffea
→ 153 pData_ = new byte[size];
154 size_ = size;
155 }
156 }
157
158 std::pair<byte*, long> DataBuf::release()
─────────────────────────────────────────────────────────────────[ threads ]────
[#0] Id 1, Name: "exiv2", stopped, reason: SINGLE STEP
───────────────────────────────────────────────────────────────────[ trace ]────
[#0] 0x7685c7 → Name: Exiv2::DataBuf::alloc(this=0x7fffffffd360, size=0xffffffea)
[#1] 0x813738 → Name: Exiv2::Internal::PngChunk::zlibUncompress(compressedText=0xec146b "", compressedTextSize=0xfffffff5, arr=@0x7fffffffd360)
[#2] 0x814330 → Name: Exiv2::Internal::PngChunk::parseTXTChunk(data=@0x7fffffffd3f0, keysize=0x1c, type=Exiv2::Internal::PngChunk::iTXt_Chunk)
[#3] 0x8153fe → Name: Exiv2::Internal::PngChunk::decodeTXTChunk(pImage=0xec0a90, data=@0x7fffffffd3f0, type=Exiv2::Internal::PngChunk::iTXt_Chunk)
[#4] 0x804342 → Name: Exiv2::PngImage::readMetadata(this=0xec0a90)
[#5] 0x480362 → Name: Action::Print::printSummary(this=0xec1c10)
[#6] 0x486d68 → Name: Action::Print::run(this=0xec1c10, path="id:000004,sig:06,src:000036,op:havoc,rep:128")
[#7] 0x40772d → Name: main(argc=0x2, argv=0x7fffffffdf38)
[#8] 0x7fffbe826830 → Name: __libc_start_main(main=0x4073d0 <main(int, char* const*)>, argc=0x2, argv=0x7fffffffdf38, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffdf28)
[#9] 0x4277c9 → Name: _start()
────────────────────────────────────────────────────────────────────────────────
gef➤
terminate called after throwing an instance of 'std::bad_alloc'
what(): std::bad_alloc
Program received signal SIGABRT, Aborted.I find this when I set ‘ulimit -v 1048576(1G)’.
The command is "exiv2 -et [poc]"
https://github.com/legend-issue/pocs/blob/master/exiv2/id:000004%2Csig:06%2Csrc:000036%2Cop:havoc%2Crep:128
Metadata
Metadata
Assignees
Labels
No labels