Skip to content

[bug report] Program crash due to uncontrolled memory allocation on function DataBuf data(subBox.length-sizeof(box)) #742

Closed
@wcventure

Description

@wcventure

Hi there,

An issue was discovered in DataBuf data(subBox.length-sizeof(box)) function in image.cpp, as distributed in master and version 0.27. There is an uncontrolled memory allocation problem, leading to a program crash. I have also confirmed this issue by using addressSanitizer.

Here is the POC file. Please use the “./exiv2 -pX $POC” to reproduce the bug.
POC.zip

subBox.length = getLong((byte*)&subBox.length, bigEndian);
subBox.type   = getLong((byte*)&subBox.type, bigEndian);

// subBox.length makes no sense if it is larger than the rest of the file
if (subBox.length > io_->size() - io_->tell()) {
     throw Error(kerCorruptedMetadata);
}
DataBuf data(subBox.length-sizeof(box));
io_->read(data.pData_,data.size_);

The ASAN dumps the stack trace as follows:

==9819==WARNING: AddressSanitizer failed to allocate 0xffffffffffffffff bytes
=================================================================
==9819==ERROR: AddressSanitizer: unknown-crash on address 0xffffffffffffffff at pc 0x0000004a9325 bp 0x7fffe470cec0 sp 0x7fffe470c670
WRITE of size 18446744073709551615 at 0xffffffffffffffff thread T0
    #0 0x4a9324 in __asan_memset (/home/wencheng/Documents/FuzzingObject/exiv2/build/bin/exiv2+0x4a9324)
    #1 0x7f3986594f9c in Exiv2::DataBuf::DataBuf(long) /home/wencheng/Documents/FuzzingObject/exiv2/src/types.cpp:141:42
    #2 0x7f39864b354c in Exiv2::Jp2Image::printStructure(std::ostream&, Exiv2::PrintStructureOption, int) /home/wencheng/Documents/FuzzingObject/exiv2/src/jp2image.cpp:506:37
    #3 0x53fa0d in (anonymous namespace)::printStructure(std::ostream&, Exiv2::PrintStructureOption, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /home/wencheng/Documents/FuzzingObject/exiv2/src/actions.cpp:2368:9
    #4 0x5400f2 in Action::setModeAndPrintStructure(Exiv2::PrintStructureOption, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /home/wencheng/Documents/FuzzingObject/exiv2/src/actions.cpp:237:16
    #5 0x5400f2 in Action::Print::run(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /home/wencheng/Documents/FuzzingObject/exiv2/src/actions.cpp:256
    #6 0x4f42f5 in main /home/wencheng/Documents/FuzzingObject/exiv2/src/exiv2.cpp:172:23
    #7 0x7f3984e1982f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
    #8 0x41f0a8 in _start (/home/wencheng/Documents/FuzzingObject/exiv2/build/bin/exiv2+0x41f0a8)

==9819==AddressSanitizer CHECK failed: /build/llvm-toolchain-3.8-_PD09B/llvm-toolchain-3.8-3.8/projects/compiler-rt/lib/asan/asan_report.cc:354 "((0 && "Address is not in memory and not in shadow?")) != (0)" (0x0, 0x0)
    #0 0x4c87dd in __asan::AsanCheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) (/home/wencheng/Documents/FuzzingObject/exiv2/build/bin/exiv2+0x4c87dd)
    #1 0x4cf403 in __sanitizer::CheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) (/home/wencheng/Documents/FuzzingObject/exiv2/build/bin/exiv2+0x4cf403)
    #2 0x4c3f9b in __asan::DescribeAddress(unsigned long, unsigned long, char const*) (/home/wencheng/Documents/FuzzingObject/exiv2/build/bin/exiv2+0x4c3f9b)
    #3 0x4c4480 in __asan::ReportGenericError(unsigned long, unsigned long, unsigned long, unsigned long, bool, unsigned long, unsigned int, bool) [clone .part.18] (/home/wencheng/Documents/FuzzingObject/exiv2/build/bin/exiv2+0x4c4480)
    #4 0x4a9346 in __asan_memset (/home/wencheng/Documents/FuzzingObject/exiv2/build/bin/exiv2+0x4a9346)
    #5 0x7f3986594f9c in Exiv2::DataBuf::DataBuf(long) /home/wencheng/Documents/FuzzingObject/exiv2/src/types.cpp:141:42
    #6 0x7f39864b354c in Exiv2::Jp2Image::printStructure(std::ostream&, Exiv2::PrintStructureOption, int) /home/wencheng/Documents/FuzzingObject/exiv2/src/jp2image.cpp:506:37
    #7 0x53fa0d in (anonymous namespace)::printStructure(std::ostream&, Exiv2::PrintStructureOption, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /home/wencheng/Documents/FuzzingObject/exiv2/src/actions.cpp:2368:9
    #8 0x5400f2 in Action::setModeAndPrintStructure(Exiv2::PrintStructureOption, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /home/wencheng/Documents/FuzzingObject/exiv2/src/actions.cpp:237:16
    #9 0x5400f2 in Action::Print::run(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /home/wencheng/Documents/FuzzingObject/exiv2/src/actions.cpp:256
    #10 0x4f42f5 in main /home/wencheng/Documents/FuzzingObject/exiv2/src/exiv2.cpp:172:23
    #11 0x7f3984e1982f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
    #12 0x41f0a8 in _start (/home/wencheng/Documents/FuzzingObject/exiv2/build/bin/exiv2+0x41f0a8)

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions