Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

A heapoverflow bug of png2swf. #50

Open
ghost opened this issue Nov 10, 2017 · 0 comments
Open

A heapoverflow bug of png2swf. #50

ghost opened this issue Nov 10, 2017 · 0 comments

Comments

@ghost
Copy link

ghost commented Nov 10, 2017

A heapoverflow bug of png2swf.
poc: https://drive.google.com/open?id=10RJHlWpMJ0LVWyEqPpvODhH7tyKZbOsR
asan: https://drive.google.com/open?id=1XJI_XKtLFv7gRDPYKSvmAC5RI5sHL6_h

png_read_header
parameter a is a char type, and header->bpp is an int type
when a is 0x80, the header->app will become 0xffffff80 by the evaluate operation

a = data[8]; // should be 8

when using bpp, the pos will become a really big number, which caused the heap overflow

pos+=(header.width*header.bpp+7)/8;

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

0 participants