Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

segmentation fault in LibRaw::parse_tiff_ifd #335

Closed
lxumei opened this issue Aug 20, 2020 · 5 comments
Closed

segmentation fault in LibRaw::parse_tiff_ifd #335

lxumei opened this issue Aug 20, 2020 · 5 comments

Comments

@lxumei
Copy link

lxumei commented Aug 20, 2020

Reproduce steps:

  1. compile provided test.c
  2. run command:./test poc

Stack trace:

#0  0x00007ffff7afdcc7 in LibRaw::parse_tiff_ifd (this=this@entry=0x7ffffff43250, base=<optimized out>, base@entry=0x0)
    at src/metadata/tiff.cpp:617
#1  0x00007ffff7ae7d96 in LibRaw::parse_tiff (this=this@entry=0x7ffffff43250, base=base@entry=0x0) at src/metadata/tiff.cpp:1486
#2  0x00007ffff7a8248e in LibRaw::identify (this=this@entry=0x7ffffff43250) at src/metadata/identify.cpp:494
#3  0x00007ffff7b43f9e in LibRaw::open_datastream (this=0x7ffffff43250, stream=0x55555576a200) at src/utils/open.cpp:390
#4  0x00007ffff7b4c90d in LibRaw::open_buffer (this=0x7ffffff43250, buffer=0x555555769130, size=0xaa) at src/utils/open.cpp:153
#5  0x000055555555534b in LLVMFuzzerTestOneInput (data=0x555555769130 "II*", size=0xaa) at runlibraw.c:35
#6  0x0000555555554f0a in main (argc=argc@entry=0x2, argv=argv@entry=0x7fffffffe3c8) at runlibraw.c:100
#7  0x00007ffff6f91b97 in __libc_start_main (main=0x555555554e00 <main(int, char**)>, argc=0x2, argv=0x7fffffffe3c8,
    init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe3b8) at ../csu/libc-start.c:310
#8  0x000055555555502a in _start ()

Poc:
poc.tar.gz

@LibRaw
Copy link
Owner

LibRaw commented Aug 20, 2020

This is compiler error, code is correct: https://github.com/LibRaw/LibRaw/blob/master/src/metadata/tiff.cpp#L617

(xtrans is [6][6] array and c varies from 0 to 35)

@LibRaw LibRaw closed this as completed Aug 20, 2020
@lxumei
Copy link
Author

lxumei commented Aug 24, 2020 via email

@LibRaw
Copy link
Owner

LibRaw commented Aug 24, 2020

Although (accidentally) closed, it is fixed by this patch: 78d323e

@AdrianBunk
Copy link

AdrianBunk commented Oct 29, 2021

This is compiler error, code is correct: https://github.com/LibRaw/LibRaw/blob/master/src/metadata/tiff.cpp#L617

(xtrans is [6][6] array and c varies from 0 to 35)

This is a libraw error.

In C this is undefined behaviour, and the compiler is allowed to do anything for undefined behaviour in code.

Annex J.2 of the C99 standard gives the following example for this undefined behaviour:
An array subscript is out of range, even if an object is apparently accessible with the given subscript (as in the lvalue expression a[1][7] given the declaration int a[4][5])

@LibRaw
Copy link
Owner

LibRaw commented Oct 29, 2021

This is not C code, but C++ code, C99-reference is not relevant here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants