Closed
Description
Hi,
After fuzzing libredwg, I found the following bugs on the latest commit on master.
Command: dwg2dxf $PoC
1.Crafted input will lead to Memory allocation failed in dwg_decode_SPLINE_private (src/dwg.spec:1639)
PoC: https://github.com/linhlhq/research/blob/master/PoCs/libreDWG/id:000000%2Csig:06%2Csrc:000000%2Cop:flip1%2Cpos:36317
ASAN says:
==6231==ERROR: AddressSanitizer failed to allocate 0xd54f86000 (57260138496) bytes of LargeMmapAllocator (error code: 12)
==6231==Process memory map follows:
0x00007fff7000-0x00008fff7000
0x00008fff7000-0x02008fff7000
0x02008fff7000-0x10007fff8000
0x55f7ba14f000-0x55f7bb643000 /home/user/linhlhq/libredwg/obj-afl/programs/dwg2dxf
0x55f7bb843000-0x55f7bb85b000 /home/user/linhlhq/libredwg/obj-afl/programs/dwg2dxf
0x55f7bb85b000-0x55f7bb93f000 /home/user/linhlhq/libredwg/obj-afl/programs/dwg2dxf
0x55f7bb93f000-0x55f7bb943000
.....
0x7fd78077d000-0x7fd780794000 /lib/x86_64-linux-gnu/libgcc_s.so.1
0x7fd780794000-0x7fd780993000 /lib/x86_64-linux-gnu/libgcc_s.so.1
0x7fd780993000-0x7fd780994000 /lib/x86_64-linux-gnu/libgcc_s.so.1
0x7fd780994000-0x7fd780995000 /lib/x86_64-linux-gnu/libgcc_s.so.1
0x7fd780995000-0x7fd7809af000 /lib/x86_64-linux-gnu/libpthread-2.27.so
0x7fd7809af000-0x7fd780bae000 /lib/x86_64-linux-gnu/libpthread-2.27.so
0x7fd780bae000-0x7fd780baf000 /lib/x86_64-linux-gnu/libpthread-2.27.so
0x7fd780baf000-0x7fd780bb0000 /lib/x86_64-linux-gnu/libpthread-2.27.so
0x7fd780bb0000-0x7fd780bb4000
0x7fd780bb4000-0x7fd780bbb000 /lib/x86_64-linux-gnu/librt-2.27.so
0x7fd780bbb000-0x7fd780dba000 /lib/x86_64-linux-gnu/librt-2.27.so
0x7fd780dba000-0x7fd780dbb000 /lib/x86_64-linux-gnu/librt-2.27.so
0x7fd780dbb000-0x7fd780dbc000 /lib/x86_64-linux-gnu/librt-2.27.so
0x7fd780dbc000-0x7fd780dbf000 /lib/x86_64-linux-gnu/libdl-2.27.so
0x7fd780dbf000-0x7fd780fbe000 /lib/x86_64-linux-gnu/libdl-2.27.so
0x7fd780fbe000-0x7fd780fbf000 /lib/x86_64-linux-gnu/libdl-2.27.so
0x7fd780fbf000-0x7fd780fc0000 /lib/x86_64-linux-gnu/libdl-2.27.so
0x7fd780fc0000-0x7fd7811a7000 /lib/x86_64-linux-gnu/libc-2.27.so
0x7fd7811a7000-0x7fd7813a7000 /lib/x86_64-linux-gnu/libc-2.27.so
0x7fd7813a7000-0x7fd7813ab000 /lib/x86_64-linux-gnu/libc-2.27.so
0x7fd7813ab000-0x7fd7813ad000 /lib/x86_64-linux-gnu/libc-2.27.so
0x7fd7813ad000-0x7fd7813b1000
0x7fd7813b1000-0x7fd78154e000 /lib/x86_64-linux-gnu/libm-2.27.so
0x7fd78154e000-0x7fd78174d000 /lib/x86_64-linux-gnu/libm-2.27.so
0x7fd78174d000-0x7fd78174e000 /lib/x86_64-linux-gnu/libm-2.27.so
0x7fd78174e000-0x7fd78174f000 /lib/x86_64-linux-gnu/libm-2.27.so
0x7fd78174f000-0x7fd78189f000 /usr/lib/x86_64-linux-gnu/libasan.so.4.0.0
0x7fd78189f000-0x7fd781a9f000 /usr/lib/x86_64-linux-gnu/libasan.so.4.0.0
0x7fd781a9f000-0x7fd781aa2000 /usr/lib/x86_64-linux-gnu/libasan.so.4.0.0
0x7fd781aa2000-0x7fd781aa5000 /usr/lib/x86_64-linux-gnu/libasan.so.4.0.0
0x7fd781aa5000-0x7fd78270a000
0x7fd78270a000-0x7fd782731000 /lib/x86_64-linux-gnu/ld-2.27.so
0x7fd78279d000-0x7fd782927000
0x7fd782927000-0x7fd782931000
0x7fd782931000-0x7fd782932000 /lib/x86_64-linux-gnu/ld-2.27.so
0x7fd782932000-0x7fd782933000 /lib/x86_64-linux-gnu/ld-2.27.so
0x7fd782933000-0x7fd782934000
0x7fffa34fe000-0x7fffa351f000 [stack]
0x7fffa35bc000-0x7fffa35bf000 [vvar]
0x7fffa35bf000-0x7fffa35c1000 [vdso]
0xffffffffff600000-0xffffffffff601000 [vsyscall]
==6231==End of process memory map.
==6231==AddressSanitizer CHECK failed: ../../../../src/libsanitizer/sanitizer_common/sanitizer_common.cc:118 "((0 && "unable to mmap")) != (0)" (0x0, 0x0)
#0 0x7fd781838c02 (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xe9c02)
#1 0x7fd781857595 in __sanitizer::CheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x108595)
#2 0x7fd781842492 (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xf3492)
#3 0x7fd78184e8a5 (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xff8a5)
#4 0x7fd78177b8f1 (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x2c8f1)
#5 0x7fd78177604b (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x2704b)
#6 0x7fd78182dd00 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded00)
#7 0x55f7ba79bec8 in dwg_decode_SPLINE_private ../../src/dwg.spec:1639
#8 0x55f7ba7a4e19 in dwg_decode_SPLINE ../../src/dwg.spec:1585
#9 0x55f7bab4b89b in dwg_decode_add_object ../../src/decode.c:4738
#10 0x55f7bab5ef28 in decode_R13_R2000 ../../src/decode.c:1216
#11 0x55f7bab9161a in dwg_decode ../../src/decode.c:239
#12 0x55f7ba533f7a in dwg_read_file ../../src/dwg.c:206
#13 0x55f7ba53232d in main ../../programs/dwg2dxf.c:255
#14 0x7fd780fe1b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
#15 0x55f7ba5332e9 in _start (/home/user/linhlhq/libredwg/obj-afl/programs/dwg2dxf+0x3e42e9)
Thanks,
Linhlhq from Infiniti Team, VinCSS (a member of Vingroup) # #