Skip to content

Several bugs found by fuzzing #176

Closed
@linhlhq

Description

@linhlhq

Hi,
After fuzzing libredwg, I found the following bugs on the latest commit on master.
Command: dwg2dxf $PoC
1.Crafted input will lead to Memory allocation failed in dwg_decode_SPLINE_private (src/dwg.spec:1639)
PoC: https://github.com/linhlhq/research/blob/master/PoCs/libreDWG/id:000000%2Csig:06%2Csrc:000000%2Cop:flip1%2Cpos:36317
ASAN says:

==6231==ERROR: AddressSanitizer failed to allocate 0xd54f86000 (57260138496) bytes of LargeMmapAllocator (error code: 12)
==6231==Process memory map follows:
	0x00007fff7000-0x00008fff7000
	0x00008fff7000-0x02008fff7000
	0x02008fff7000-0x10007fff8000
	0x55f7ba14f000-0x55f7bb643000	/home/user/linhlhq/libredwg/obj-afl/programs/dwg2dxf
	0x55f7bb843000-0x55f7bb85b000	/home/user/linhlhq/libredwg/obj-afl/programs/dwg2dxf
	0x55f7bb85b000-0x55f7bb93f000	/home/user/linhlhq/libredwg/obj-afl/programs/dwg2dxf
	0x55f7bb93f000-0x55f7bb943000
	.....
	0x7fd78077d000-0x7fd780794000	/lib/x86_64-linux-gnu/libgcc_s.so.1
	0x7fd780794000-0x7fd780993000	/lib/x86_64-linux-gnu/libgcc_s.so.1
	0x7fd780993000-0x7fd780994000	/lib/x86_64-linux-gnu/libgcc_s.so.1
	0x7fd780994000-0x7fd780995000	/lib/x86_64-linux-gnu/libgcc_s.so.1
	0x7fd780995000-0x7fd7809af000	/lib/x86_64-linux-gnu/libpthread-2.27.so
	0x7fd7809af000-0x7fd780bae000	/lib/x86_64-linux-gnu/libpthread-2.27.so
	0x7fd780bae000-0x7fd780baf000	/lib/x86_64-linux-gnu/libpthread-2.27.so
	0x7fd780baf000-0x7fd780bb0000	/lib/x86_64-linux-gnu/libpthread-2.27.so
	0x7fd780bb0000-0x7fd780bb4000
	0x7fd780bb4000-0x7fd780bbb000	/lib/x86_64-linux-gnu/librt-2.27.so
	0x7fd780bbb000-0x7fd780dba000	/lib/x86_64-linux-gnu/librt-2.27.so
	0x7fd780dba000-0x7fd780dbb000	/lib/x86_64-linux-gnu/librt-2.27.so
	0x7fd780dbb000-0x7fd780dbc000	/lib/x86_64-linux-gnu/librt-2.27.so
	0x7fd780dbc000-0x7fd780dbf000	/lib/x86_64-linux-gnu/libdl-2.27.so
	0x7fd780dbf000-0x7fd780fbe000	/lib/x86_64-linux-gnu/libdl-2.27.so
	0x7fd780fbe000-0x7fd780fbf000	/lib/x86_64-linux-gnu/libdl-2.27.so
	0x7fd780fbf000-0x7fd780fc0000	/lib/x86_64-linux-gnu/libdl-2.27.so
	0x7fd780fc0000-0x7fd7811a7000	/lib/x86_64-linux-gnu/libc-2.27.so
	0x7fd7811a7000-0x7fd7813a7000	/lib/x86_64-linux-gnu/libc-2.27.so
	0x7fd7813a7000-0x7fd7813ab000	/lib/x86_64-linux-gnu/libc-2.27.so
	0x7fd7813ab000-0x7fd7813ad000	/lib/x86_64-linux-gnu/libc-2.27.so
	0x7fd7813ad000-0x7fd7813b1000
	0x7fd7813b1000-0x7fd78154e000	/lib/x86_64-linux-gnu/libm-2.27.so
	0x7fd78154e000-0x7fd78174d000	/lib/x86_64-linux-gnu/libm-2.27.so
	0x7fd78174d000-0x7fd78174e000	/lib/x86_64-linux-gnu/libm-2.27.so
	0x7fd78174e000-0x7fd78174f000	/lib/x86_64-linux-gnu/libm-2.27.so
	0x7fd78174f000-0x7fd78189f000	/usr/lib/x86_64-linux-gnu/libasan.so.4.0.0
	0x7fd78189f000-0x7fd781a9f000	/usr/lib/x86_64-linux-gnu/libasan.so.4.0.0
	0x7fd781a9f000-0x7fd781aa2000	/usr/lib/x86_64-linux-gnu/libasan.so.4.0.0
	0x7fd781aa2000-0x7fd781aa5000	/usr/lib/x86_64-linux-gnu/libasan.so.4.0.0
	0x7fd781aa5000-0x7fd78270a000
	0x7fd78270a000-0x7fd782731000	/lib/x86_64-linux-gnu/ld-2.27.so
	0x7fd78279d000-0x7fd782927000
	0x7fd782927000-0x7fd782931000
	0x7fd782931000-0x7fd782932000	/lib/x86_64-linux-gnu/ld-2.27.so
	0x7fd782932000-0x7fd782933000	/lib/x86_64-linux-gnu/ld-2.27.so
	0x7fd782933000-0x7fd782934000
	0x7fffa34fe000-0x7fffa351f000	[stack]
	0x7fffa35bc000-0x7fffa35bf000	[vvar]
	0x7fffa35bf000-0x7fffa35c1000	[vdso]
	0xffffffffff600000-0xffffffffff601000	[vsyscall]
==6231==End of process memory map.
==6231==AddressSanitizer CHECK failed: ../../../../src/libsanitizer/sanitizer_common/sanitizer_common.cc:118 "((0 && "unable to mmap")) != (0)" (0x0, 0x0)
    #0 0x7fd781838c02  (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xe9c02)
    #1 0x7fd781857595 in __sanitizer::CheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x108595)
    #2 0x7fd781842492  (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xf3492)
    #3 0x7fd78184e8a5  (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xff8a5)
    #4 0x7fd78177b8f1  (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x2c8f1)
    #5 0x7fd78177604b  (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x2704b)
    #6 0x7fd78182dd00 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded00)
    #7 0x55f7ba79bec8 in dwg_decode_SPLINE_private ../../src/dwg.spec:1639
    #8 0x55f7ba7a4e19 in dwg_decode_SPLINE ../../src/dwg.spec:1585
    #9 0x55f7bab4b89b in dwg_decode_add_object ../../src/decode.c:4738
    #10 0x55f7bab5ef28 in decode_R13_R2000 ../../src/decode.c:1216
    #11 0x55f7bab9161a in dwg_decode ../../src/decode.c:239
    #12 0x55f7ba533f7a in dwg_read_file ../../src/dwg.c:206
    #13 0x55f7ba53232d in main ../../programs/dwg2dxf.c:255
    #14 0x7fd780fe1b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #15 0x55f7ba5332e9 in _start (/home/user/linhlhq/libredwg/obj-afl/programs/dwg2dxf+0x3e42e9)

Thanks,
Linhlhq from Infiniti Team, VinCSS (a member of Vingroup) # #

Metadata

Metadata

Assignees

Labels

bugSomething isn't workingfuzzingIntentional illegal input

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions