Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

heap-buffer-overflow in iwmiffr_convert_row32 #12

Closed
bestshow opened this issue Apr 3, 2017 · 1 comment

Comments

Projects
None yet
2 participants
@bestshow
Copy link

commented Apr 3, 2017

on ImageWorsener 1.3.0

#imagew $FILE out.png

heap-buffer-overflow on address 0x602000000073 at pc 0x00000058daae bp 0x7ffc81974d20 sp 0x7ffc81974d18
READ of size 1 at 0x602000000073 thread T0
#0 0x58daad in iwmiffr_convert_row32 /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-miff.c:407:18
#1 0x58a1c5 in iwmiff_read_pixels /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-miff.c:511:4
#2 0x5891d8 in iw_read_miff_file /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-miff.c:574:6
#3 0x566be8 in iw_read_file_by_fmt /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-allfmts.c:56:12
#4 0x519fbe in iwcmd_run /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-cmd.c:1191:6
#5 0x516623 in iwcmd_main /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-cmd.c:3018:7
#6 0x5164f1 in main /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-cmd.c:3067:9
#7 0x7fdcb1095b34 in __libc_start_main (/lib64/libc.so.6+0x21b34)
#8 0x41bbeb in _start (/home/haojun/Downloads/testopensourcecode/imageworsener-master/imagew+0x41bbeb)

0x602000000073 is located 2 bytes to the right of 1-byte region [0x602000000070,0x602000000071)
allocated by thread T0 here:
#0 0x4e0c8d in calloc /home/haojun/Downloads/llvm-clang/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:74
#1 0x529b69 in my_mallocfn /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-cmd.c:792:9
#2 0x5aa33a in iw_malloc_ex /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-util.c:48:8
#3 0x5aa3e3 in iw_mallocz /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-util.c:65:9
#4 0x589d67 in iwmiff_read_pixels /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-miff.c:493:11
#5 0x5891d8 in iw_read_miff_file /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-miff.c:574:6
#6 0x566be8 in iw_read_file_by_fmt /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-allfmts.c:56:12
#7 0x519fbe in iwcmd_run /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-cmd.c:1191:6
#8 0x516623 in iwcmd_main /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-cmd.c:3018:7
#9 0x5164f1 in main /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-cmd.c:3067:9
#10 0x7fdcb1095b34 in __libc_start_main (/lib64/libc.so.6+0x21b34)

heap-buffer-overflow /home/haojun/Downloads/testopensourcecode/imageworsener-master/src/imagew-miff.c:407:18 in iwmiffr_convert_row32
Shadow bytes around the buggy address:
0x0c047fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c047fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c047fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c047fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c047fff8000: fa fa fd fa fa fa 00 03 fa fa 00 03 fa fa[01]fa
0x0c047fff8010: fa fa 01 fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==37702==ABORTING

testcase:
https://github.com/bestshow/p0cs/blob/master/1049-heap-buffer-overflow-imagew-miff

Author: ADLab of Venustech

@jsummers

This comment has been minimized.

Copy link
Owner

commented Apr 5, 2017

Should be fixed by commit f9c12fa

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.