Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

heap-buffer-overflow in iwgif_record_pixel #11

Closed
bestshow opened this issue Apr 3, 2017 · 1 comment

Comments

Projects
None yet
2 participants
@bestshow
Copy link

commented Apr 3, 2017

on ImageWorsener 1.3.0

#imagew $FILE out.png

heap-buffer-overflow on address 0x611000000248 at pc 0x00000058820b bp 0x7ffe06f63620 sp 0x7ffe06f63618
READ of size 8 at 0x611000000248 thread T0
#0 0x58820a in iwgif_record_pixel /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-gif.c:223:5
#1 0x587765 in lzw_emit_code /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-gif.c:312:3
#2 0x5871cc in lzw_process_code /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-gif.c:384:3
#3 0x586dd0 in lzw_process_bytes /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-gif.c:433:9
#4 0x5840d0 in iwgif_read_image /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-gif.c:669:7
#5 0x582413 in iwgif_read_main /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-gif.c:724:9
#6 0x581bdd in iw_read_gif_file /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-gif.c:773:6
#7 0x566c04 in iw_read_file_by_fmt /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-allfmts.c:61:12
#8 0x519fbe in iwcmd_run /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-cmd.c:1191:6
#9 0x516623 in iwcmd_main /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-cmd.c:3018:7
#10 0x5164f1 in main /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-cmd.c:3067:9
#11 0x7f254dcbcb34 in __libc_start_main (/lib64/libc.so.6+0x21b34)
#12 0x41bbeb in _start (/home/haojun/Downloads/testopensourcecode/imageworsener-master/imagew+0x41bbeb)

0x611000000248 is located 0 bytes to the right of 200-byte region [0x611000000180,0x611000000248)
allocated by thread T0 here:
#0 0x4e0ad6 in malloc /home/haojun/Downloads/llvm-clang/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:66
#1 0x529b7b in my_mallocfn /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-cmd.c:794:9
#2 0x5aa33a in iw_malloc_ex /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-util.c:48:8
#3 0x5aa3b0 in iw_malloc /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-util.c:60:9
#4 0x5858fa in iwgif_make_row_pointers /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-gif.c:519:34
#5 0x583fac in iwgif_read_image /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-gif.c:656:6
#6 0x582413 in iwgif_read_main /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-gif.c:724:9
#7 0x581bdd in iw_read_gif_file /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-gif.c:773:6
#8 0x566c04 in iw_read_file_by_fmt /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-allfmts.c:61:12
#9 0x519fbe in iwcmd_run /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-cmd.c:1191:6
#10 0x516623 in iwcmd_main /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-cmd.c:3018:7
#11 0x5164f1 in main /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-cmd.c:3067:9
#12 0x7f254dcbcb34 in __libc_start_main (/lib64/libc.so.6+0x21b34)

heap-buffer-overflow /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-gif.c:223:5 in iwgif_record_pixel
Shadow bytes around the buggy address:
0x0c227fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c227fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c227fff8010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c227fff8020: 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c227fff8030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c227fff8040: 00 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa
0x0c227fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c227fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c227fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c227fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c227fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==37564==ABORTING

testcase:
https://github.com/bestshow/p0cs/blob/master/1111-heap-buffer-overslow-imagew-gif_223_5

Author: ADLab of Venustech

@jsummers

This comment has been minimized.

Copy link
Owner

commented Apr 4, 2017

Should be fixed by commit dc74009

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.