Closed
Description
RAX: 0x0
RBX: 0xec0d18 ("Overflow in addition")
RCX: 0x7ffff693b428 (<__GI_raise+56>: cmp rax,0xfffffffffffff000)
RDX: 0x6
RSI: 0x9367
RDI: 0x9367
RBP: 0xe907c0 --> 0x7ffff6ccb540 --> 0xfbad2887
RSP: 0x7fffffffcf78 --> 0x7ffff693d02a (<__GI_abort+362>: mov rdx,QWORD PTR fs:0x10)
RIP: 0x7ffff693b428 (<__GI_raise+56>: cmp rax,0xfffffffffffff000)
R8 : 0x7ffff6ccc770 --> 0x0
R9 : 0x7ffff7fd3740 (0x00007ffff7fd3740)
R10: 0x8
R11: 0x202
R12: 0xec0aa0 --> 0x0
R13: 0xba6958 --> 0x4b40e0 (<Exiv2::FileIo::~FileIo()>: lea rsp,[rsp-0x98])
R14: 0x7fffffffd260 --> 0x14
R15: 0x14
EFLAGS: 0x202 (carry parity adjust zero sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
0x7ffff693b41e <__GI_raise+46>: mov eax,0xea
0x7ffff693b423 <__GI_raise+51>: movsxd rdi,ecx
0x7ffff693b426 <__GI_raise+54>: syscall
=> 0x7ffff693b428 <__GI_raise+56>: cmp rax,0xfffffffffffff000
0x7ffff693b42e <__GI_raise+62>: ja 0x7ffff693b450 <__GI_raise+96>
0x7ffff693b430 <__GI_raise+64>: repz ret
0x7ffff693b432 <__GI_raise+66>: nop WORD PTR [rax+rax*1+0x0]
0x7ffff693b438 <__GI_raise+72>: test ecx,ecx
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffcf78 --> 0x7ffff693d02a (<__GI_abort+362>: mov rdx,QWORD PTR fs:0x10)
0008| 0x7fffffffcf80 --> 0x20 (' ')
0016| 0x7fffffffcf88 --> 0x0
0024| 0x7fffffffcf90 --> 0x0
0032| 0x7fffffffcf98 --> 0x0
0040| 0x7fffffffcfa0 --> 0x0
0048| 0x7fffffffcfa8 --> 0x0
0056| 0x7fffffffcfb0 --> 0x0
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGABRT
0x00007ffff693b428 in __GI_raise (sig=sig@entry=0x6) at ../sysdeps/unix/sysv/linux/raise.c:54
54 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
[ Legend: Modified register | Code | Heap | Stack | String ]
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────[ registers ]────
$rax : 0x0000000000000000
$rbx : 0x0000000000ec0d18 → "Overflow in addition"
$rcx : 0x00007ffff693b428 → 0x2077fffff0003d48 ("H="?)
$rdx : 0x0000000000000006
$rsp : 0x00007fffffffcf78 → 0x00007ffff693d02a → <abort+362> mov rdx, QWORD PTR fs:0x10
$rbp : 0x0000000000e907c0 → 0x00007ffff6ccb540 → 0x00000000fbad2887
$rsi : 0x0000000000009367
$rdi : 0x0000000000009367
$rip : 0x00007ffff693b428 → 0x2077fffff0003d48 ("H="?)
$r8 : 0x00007ffff6ccc770 → 0x0000000000000000
$r9 : 0x00007ffff7fd3740 → 0x00007ffff7fd3740 → [loop detected]
$r10 : 0x0000000000000008
$r11 : 0x0000000000000202
$r12 : 0x0000000000ec0aa0 → 0x0000000000000000
$r13 : 0x0000000000ba6958 → 0x00000000004b40e0 → <Exiv2::FileIo::~FileIo()+0> lea rsp, [rsp-0x98]
$r14 : 0x00007fffffffd260 → 0x0000000000000014
$r15 : 0x0000000000000014
$eflags: [carry parity adjust zero sign trap INTERRUPT direction overflow resume virtualx86 identification]
$gs: 0x0000 $fs: 0x0000 $ss: 0x002b $ds: 0x0000 $es: 0x0000 $cs: 0x0033
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────[ stack ]────
0x00007fffffffcf78│+0x00: 0x00007ffff693d02a → <abort+362> mov rdx, QWORD PTR fs:0x10 ← $rsp
0x00007fffffffcf80│+0x08: 0x0000000000000020
0x00007fffffffcf88│+0x10: 0x0000000000000000
0x00007fffffffcf90│+0x18: 0x0000000000000000
0x00007fffffffcf98│+0x20: 0x0000000000000000
0x00007fffffffcfa0│+0x28: 0x0000000000000000
0x00007fffffffcfa8│+0x30: 0x0000000000000000
0x00007fffffffcfb0│+0x38: 0x0000000000000000
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────[ code:i386:x86-64 ]────
0x7ffff693b41e <raise+46> mov eax, 0xea
0x7ffff693b423 <raise+51> movsxd rdi, ecx
0x7ffff693b426 <raise+54> syscall
→ 0x7ffff693b428 <raise+56> cmp rax, 0xfffffffffffff000
0x7ffff693b42e <raise+62> ja 0x7ffff693b450 <__GI_raise+96>
0x7ffff693b430 <raise+64> repz ret
0x7ffff693b432 <raise+66> nop WORD PTR [rax+rax*1+0x0]
0x7ffff693b438 <raise+72> test ecx, ecx
0x7ffff693b43a <raise+74> jg 0x7ffff693b41b <__GI_raise+43>
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────[ threads ]────
[#0] Id 1, Name: "exiv2", stopped, reason: SIGABRT
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────[ trace ]────
[#0] 0x7ffff693b428 → Name: __GI_raise(sig=0x6)
[#1] 0x7ffff693d02a → Name: __GI_abort()
[#2] 0x7ffff727e84d → Name: __gnu_cxx::__verbose_terminate_handler()()
[#3] 0x7ffff727c6b6 → call 0x7ffff7275fc0 <abort@plt>
[#4] 0x7ffff727c701 → Name: std::terminate()()
[#5] 0x7ffff727c919 → Name: __cxa_throw()
[#6] 0x607c6a → Name: Safe::add<unsigned int>(summand_2=0x8, summand_1=<optimized out>)
[#7] 0x607c6a → Name: Exiv2::Jp2Image::readMetadata(this=<optimized out>)
[#8] 0x47ab61 → Name: Action::Extract::writeThumbnail(this=0xec1cf0)
[#9] 0x496fa0 → Name: Action::Extract::run(this=0xec1cf0, path="/home/aflgo/exiv2/out-2/crashes/id:000008,sig:06,src:000335,op:int32,pos:62,val:-1")command: exiv2 -et [poc]
https://github.com/legend-issue/pocs/blob/master/exiv2/id:000008%2Csig:06%2Csrc:000335%2Cop:int32%2Cpos:62%2Cval:-1
Metadata
Metadata
Assignees
Labels
No labels