Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

heap-buffer-overflow-ngiflib-c-808 #6

Closed
Edward-L opened this issue May 30, 2018 · 1 comment
Closed

heap-buffer-overflow-ngiflib-c-808 #6

Edward-L opened this issue May 30, 2018 · 1 comment

Comments

@Edward-L
Copy link

asan report

=================================================================
==18451==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60300000f00f at pc 0x402b71 bp 0x7ffd69d08800 sp 0x7ffd69d087f8
READ of size 1 at 0x60300000f00f thread T0
    #0 0x402b70 in GifIndexToTrueColor /opt/lxf/ngiflib-master/ngiflib.c:808
    #1 0x4049d5 in WritePixel /opt/lxf/ngiflib-master/ngiflib.c:124
    #2 0x4049d5 in DecodeGifImg /opt/lxf/ngiflib-master/ngiflib.c:531
    #3 0x406515 in LoadGif /opt/lxf/ngiflib-master/ngiflib.c:789
    #4 0x40184e in main /opt/lxf/ngiflib-master/gif2tga.c:95
    #5 0x7f4bbfbbef44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21f44)
    #6 0x4011a8 (/opt/lxf/ngiflib-master/gif2tga_asan+0x4011a8)

0x60300000f00f is located 23 bytes to the right of 24-byte region [0x60300000efe0,0x60300000eff8)
allocated by thread T0 here:
    #0 0x7f4bbffba862 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54862)
    #1 0x405614 in LoadGif /opt/lxf/ngiflib-master/ngiflib.c:634

SUMMARY: AddressSanitizer: heap-buffer-overflow /opt/lxf/ngiflib-master/ngiflib.c:808 GifIndexToTrueColor
Shadow bytes around the buggy address:
  0x0c067fff9db0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff9dc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff9dd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff9de0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff9df0: fa fa fa fa fa fa fa fa fa fa fa fa 00 00 00 fa
=>0x0c067fff9e00: fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff9e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff9e20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff9e30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff9e40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff9e50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Contiguous container OOB:fc
  ASan internal:           fe
==18451==ABORTING

poc:poc

@miniupnp
Copy link
Owner

miniupnp commented Jun 1, 2018

it was same as #4 : fixed by be4c7df

@miniupnp miniupnp closed this as completed Jun 1, 2018
miniupnp added a commit that referenced this issue Jun 1, 2018
Signed-off-by: Thomas Bernard <miniupnp@free.fr>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants