Skip to content

SIGABRT in types.cpp Exiv2::DataBuf::alloc function #302

Closed
@legend-issue

Description

@legend-issue
$rax   : 0x0000000000000000
$rbx   : 0x00007fffffffd360    0x0000000000000000
$rcx   : 0x0000000000ec0fed    0x6e69676522000001
$rdx   : 0x00007fffffffd360    0x0000000000000000
$rsp   : 0x00007fffffffd200    0x0000000000000000
$rbp   : 0x00000000ffffffea
$rsi   : 0x00000000ffffffea
$rdi   : 0x0000000000000000
$rip   : 0x00000000007685c7    <Exiv2::DataBuf::alloc(long)+279> mov rdi, rbp
$r8    : 0xffffffffffffe310
$r9    : 0xffffffffffffe300
$r10   : 0xffffffffffffe2f0
$r11   : 0x000000000000047a
$r12   : 0x0000000000ec146b    0xbcaea80000000000
$r13   : 0x000000000000001c
$r14   : 0x0000000000000000
$r15   : 0x0000000000000000
$eflags: [carry PARITY adjust ZERO sign trap INTERRUPT direction overflow resume virtualx86 identification]
$es: 0x0000  $gs: 0x0000  $ds: 0x0000  $ss: 0x002b  $fs: 0x0000  $cs: 0x0033  
───────────────────────────────────────────────────────────────────[ stack ]────
0x00007fffffffd200+0x00: 0x0000000000000000	  $rsp
0x00007fffffffd208+0x08: 0x00007fffffffd360    0x0000000000000000
0x00007fffffffd210+0x10: 0x00000000fffffff5
0x00007fffffffd218+0x18: 0x0000000000813738    <Exiv2::Internal::PngChunk::zlibUncompress(unsigned+0> mov rdi, QWORD PTR [rbx]
0x00007fffffffd220+0x20: 0x00000000ffffffea
0x00007fffffffd228+0x28: 0xa65c0e3e1fcb3000
0x00007fffffffd230+0x30: 0x0000000000ec0fd0    0x2e6d6f633a4c4d58
0x00007fffffffd238+0x38: 0x00007fffffffd360    0x0000000000000000
────────────────────────────────────────────────────────[ code:i386:x86-64 ]────
     0x7685b0 <Exiv2::DataBuf::alloc(long)+256> lea    rsp, [rsp+0x98]
     0x7685b8 <Exiv2::DataBuf::alloc(long)+264> mov    QWORD PTR [rbx], 0x0
     0x7685bf <Exiv2::DataBuf::alloc(long)+271> mov    QWORD PTR [rbx+0x8], 0x0
    0x7685c7 <Exiv2::DataBuf::alloc(long)+279> mov    rdi, rbp
     0x7685ca <Exiv2::DataBuf::alloc(long)+282> call   0x405ac0 <_Znam@plt>
     0x7685cf <Exiv2::DataBuf::alloc(long)+287> mov    QWORD PTR [rbx+0x8], rbp
     0x7685d3 <Exiv2::DataBuf::alloc(long)+291> mov    QWORD PTR [rbx], rax
     0x7685d6 <Exiv2::DataBuf::alloc(long)+294> add    rsp, 0x8
     0x7685da <Exiv2::DataBuf::alloc(long)+298> pop    rbx
────────────────────────────────────────────────────[ source:types.cpp+153 ]────
    148	     {
    149	         if (size > size_) {
    150	             delete[] pData_;
    151	             pData_ = 0;
    152	             size_ = 0;
		// size=0xffffffea
   153	             pData_ = new byte[size];
    154	             size_ = size;
    155	         }
    156	     }
    157	 
    158	     std::pair<byte*, long> DataBuf::release()
─────────────────────────────────────────────────────────────────[ threads ]────
[#0] Id 1, Name: "exiv2", stopped, reason: SINGLE STEP
───────────────────────────────────────────────────────────────────[ trace ]────
[#0] 0x7685c7  Name: Exiv2::DataBuf::alloc(this=0x7fffffffd360, size=0xffffffea)
[#1] 0x813738  Name: Exiv2::Internal::PngChunk::zlibUncompress(compressedText=0xec146b "", compressedTextSize=0xfffffff5, arr=@0x7fffffffd360)
[#2] 0x814330  Name: Exiv2::Internal::PngChunk::parseTXTChunk(data=@0x7fffffffd3f0, keysize=0x1c, type=Exiv2::Internal::PngChunk::iTXt_Chunk)
[#3] 0x8153fe  Name: Exiv2::Internal::PngChunk::decodeTXTChunk(pImage=0xec0a90, data=@0x7fffffffd3f0, type=Exiv2::Internal::PngChunk::iTXt_Chunk)
[#4] 0x804342  Name: Exiv2::PngImage::readMetadata(this=0xec0a90)
[#5] 0x480362  Name: Action::Print::printSummary(this=0xec1c10)
[#6] 0x486d68  Name: Action::Print::run(this=0xec1c10, path="id:000004,sig:06,src:000036,op:havoc,rep:128")
[#7] 0x40772d  Name: main(argc=0x2, argv=0x7fffffffdf38)
[#8] 0x7fffbe826830  Name: __libc_start_main(main=0x4073d0 <main(int, char* const*)>, argc=0x2, argv=0x7fffffffdf38, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffdf28)
[#9] 0x4277c9 → Name: _start()
────────────────────────────────────────────────────────────────────────────────
gef➤  
terminate called after throwing an instance of 'std::bad_alloc'
  what():  std::bad_alloc

Program received signal SIGABRT, Aborted.

I find this when I set ‘ulimit -v 1048576(1G)’.
The command is "exiv2 -et [poc]"
https://github.com/legend-issue/pocs/blob/master/exiv2/id:000004%2Csig:06%2Csrc:000036%2Cop:havoc%2Crep:128

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions