Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SEGV /src/scale.c:211 in scale_without_resampling() #71

Open
13579and2468 opened this issue Feb 3, 2023 · 0 comments
Open

SEGV /src/scale.c:211 in scale_without_resampling() #71

13579and2468 opened this issue Feb 3, 2023 · 0 comments

Comments

@13579and2468
Copy link

I find an SEGV when fuzzing img2sixel

version

$ ./builddir/converters/img2sixel --version
img2sixel 1.10.3

configured with:
  libcurl: no
  libpng: no
  libjpeg: yes
  gdk-pixbuf2: no
  GD: no

Copyright (C) 2014-2018 Hayaki Saito <saitoha@me.com>.

Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software is furnished to do so,
subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

$ git log --oneline -1
490ec15 (HEAD -> master, origin/master, origin/HEAD) Fix double free in src/encoder.c when parsing bgcolor

normal run

$ ./libsixel/builddir/converters/img2sixel -w 5px  -r nearest poc.png
fish: Job 1, './libsixel/builddir/converters…' terminated by signal SIGSEGV (Address boundary error)

asan report

$ ../libsixel/build-asan/converters/img2sixel -w 5px  -r nearest poc.png
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3943815==ERROR: AddressSanitizer: SEGV on unknown address 0x632fffff6d6e (pc 0x7f92f18ae9b8 bp 0x000080002b90 sp 0x7fff41aebed0 T0)
==3943815==The signal is caused by a READ memory access.
    #0 0x7f92f18ae9b7 in scale_without_resampling ../src/scale.c:211
    #1 0x7f92f18ae9b7 in sixel_helper_scale_image ../src/scale.c:345
    #2 0x7f92f1850734 in sixel_frame_resize ../src/frame.c:560
    #3 0x7f92f1846cb0 in sixel_encoder_do_resize ../src/encoder.c:618
    #4 0x7f92f1847cf4 in sixel_encoder_encode_frame ../src/encoder.c:919
    #5 0x7f92f18a08d6 in load_with_builtin ../src/loader.c:924
    #6 0x7f92f18a7530 in sixel_helper_load_image_file ../src/loader.c:1379
    #7 0x7f92f184df65 in sixel_encoder_encode ../src/encoder.c:1696
    #8 0x55f7357d4f8f in main ../converters/img2sixel.c:439
    #9 0x7f92f1639082 in __libc_start_main ../csu/libc-start.c:308
    #10 0x55f7357d526d in _start (/home/a13579/fuzz_libsixel/libsixel/build-asan/converters/img2sixel+0x426d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ../src/scale.c:211 in scale_without_resampling
==3943815==ABORTING

poc.png

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant