Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

stack-buffer-overflow-ngiflib-c-543 #4

Closed
Edward-L opened this issue May 30, 2018 · 0 comments
Closed

stack-buffer-overflow-ngiflib-c-543 #4

Edward-L opened this issue May 30, 2018 · 0 comments

Comments

@Edward-L
Copy link

asan report

=================================================================
==226949==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff5e0ae0ff at pc 0x404e89 bp 0x7fff5e0aaed0 sp 0x7fff5e0aaec8
WRITE of size 1 at 0x7fff5e0ae0ff thread T0
    #0 0x404e88 in DecodeGifImg /opt/lxf/ngiflib-master/ngiflib.c:543
    #1 0x406515 in LoadGif /opt/lxf/ngiflib-master/ngiflib.c:789
    #2 0x40184e in main /opt/lxf/ngiflib-master/gif2tga.c:95
    #3 0x7f11dbd4bf44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21f44)
    #4 0x4011a8 (/opt/lxf/ngiflib-master/gif2tga_asan+0x4011a8)

Address 0x7fff5e0ae0ff is located in stack of thread T0 at offset 12703 in frame
    #0 0x40378d in DecodeGifImg /opt/lxf/ngiflib-master/ngiflib.c:387

  This frame has 4 object(s):
    [32, 8224) 'ab_prfx'
    [8256, 8544) 'context'
    [8576, 12672) 'ab_suffx'
    [12704, 16800) 'ab_stack' <== Memory access at offset 12703 underflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /opt/lxf/ngiflib-master/ngiflib.c:543 DecodeGifImg
Shadow bytes around the buggy address:
  0x10006bc0dbc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10006bc0dbd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10006bc0dbe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10006bc0dbf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10006bc0dc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10006bc0dc10: 00 00 00 00 00 00 00 00 00 00 00 00 f2 f2 f2[f2]
  0x10006bc0dc20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10006bc0dc30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10006bc0dc40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10006bc0dc50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10006bc0dc60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Contiguous container OOB:fc
  ASan internal:           fe
==226949==ABORTING

poc:
poc

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant