New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Out of bounds write in master libjxl reported by oss-fuzz #360
Comments
|
I can't seem to reproduce this one. Some fuzzerbugs were fixed recently, could you check if the bug is still there in the current most recent git version? |
|
Looks like it was last test yesterday: I'll look a bit more. |
|
Yes, libjxl git master was cloned around mid-day on the 25th. |
|
Can you check if you linked the right reproducer? This one has the following result, which looks like it fails quite early already, earlier than what could lead to that stack trace... |
|
Jon it looks like you are using CRASH_ON_ERROR, which we don't have enabled in release mode and don't expect users to have. The linked file is from a different fuzzer than our djxl_fuzzer, so it is probably easier to reproduce with djxl or decode_oneshot. I managed to do that with an asan build following the instructions in our doc but building decode_oneshot instead of djxl_fuzzer. |
|
@jonsneyers I checked and it's the right reproducer. I did a little digging and it's a 86 x 72 pixel image, with 1 colour channel and 2 extra channels. This is a case (I think?) that djxl does not handle, so it rejects the image before attempting decode. libvips supports any number of alphas, so it tries to decode it as GAA, and this triggers the failure. You can reproduce with the libvips decoder like this: Of course perhaps this is such a strange case that it's not worth fixing. Should libvips reject JXL with |
|
Yup, passes cleanly now. Nice job! |
Hello, oss-fuzz is reporting an out of bounds write in libjxl master:
Reproducer:
http://www.rollthepotato.net/~john/.clusterfuzz-testcase-minimized-5454144264601600.jxl
The text was updated successfully, but these errors were encountered: