Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ASan stack-buffer-overflow src/quant.c:1390 in sixel_quant_apply_palette #68

Closed
fgeek opened this Issue Jul 18, 2018 · 1 comment

Comments

Projects
None yet
2 participants
@fgeek
Copy link

fgeek commented Jul 18, 2018

libsixel-stack-buffer-overflow-quant.c-1390-sixel_quant_apply_palette.png.zip (SHA1: 56193b1ec3d33cc6633c9a27cf0835f88d04b748)
Tested commit: 5db717d
Credit: Henri Salo
Tools: american fuzzy lop 2.52b, afl-utils
Thanks to Kapsi internet-käyttäjät ry for providing valuable fuzzing resources.

./bin/img2sixel -o test libsixel-stack-buffer-overflow-quant.c-1390-sixel_quant_apply_palette.png
=================================================================
==14215==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffe68b3919e at pc 0x7fa061ccdb1d bp 0x7ffe68b39080 sp 0x7ffe68b39078
READ of size 2 at 0x7ffe68b3919e thread T0
    #0 0x7fa061ccdb1c in sixel_quant_apply_palette /home/hsalo/src/libsixel/src/quant.c:1390
    #1 0x7fa061cd0ca3 in sixel_dither_apply_palette /home/hsalo/src/libsixel/src/dither.c:786
    #2 0x7fa061cc0181 in sixel_encode_dither /home/hsalo/src/libsixel/src/tosixel.c:787
    #3 0x7fa061cc0181 in sixel_encode /home/hsalo/src/libsixel/src/tosixel.c:1488
    #4 0x7fa061d7c6a9 in sixel_encoder_output_without_macro /home/hsalo/src/libsixel/src/encoder.c:819
    #5 0x7fa061d7f6b8 in sixel_encoder_encode_frame /home/hsalo/src/libsixel/src/encoder.c:1049
    #6 0x7fa061d5dcea in load_with_builtin /home/hsalo/src/libsixel/src/loader.c:913
    #7 0x7fa061d6b7f8 in sixel_helper_load_image_file /home/hsalo/src/libsixel/src/loader.c:1352
    #8 0x7fa061d8c7de in sixel_encoder_encode /home/hsalo/src/libsixel/src/encoder.c:1734
    #9 0x564ccc870bab in main /home/hsalo/src/libsixel/converters/img2sixel.c:457
    #10 0x7fa060f132e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0)
    #11 0x564ccc870de9 in _start (/home/hsalo/builds/libsixel/5db717dfef6fa327cd4025e7352550f63d20699c/bin/img2sixel+0x2de9)

Address 0x7ffe68b3919e is located in stack of thread T0 at offset 94 in frame
    #0 0x7fa061ccabdf in sixel_quant_apply_palette /home/hsalo/src/libsixel/src/quant.c:1257

  This frame has 3 object(s):
    [32, 36) 'copy'
    [96, 608) 'migration_map' <== Memory access at offset 94 underflows this variable
    [640, 1664) 'new_palette'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /home/hsalo/src/libsixel/src/quant.c:1390 in sixel_quant_apply_palette
Shadow bytes around the buggy address:
  0x10004d15f1e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10004d15f1f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10004d15f200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10004d15f210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10004d15f220: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f4 f4 f4
=>0x10004d15f230: f2 f2 f2[f2]00 00 00 00 00 00 00 00 00 00 00 00
  0x10004d15f240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10004d15f250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10004d15f260: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10004d15f270: 00 00 00 00 f2 f2 f2 f2 00 00 00 00 00 00 00 00
  0x10004d15f280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==14215==ABORTING

@saitoha saitoha self-assigned this Jul 21, 2018

@saitoha saitoha added the bug label Jul 22, 2018

saitoha added a commit that referenced this issue Jul 22, 2018

@saitoha

This comment has been minimized.

Copy link
Owner

saitoha commented Jul 22, 2018

@fgeek thank you!

@saitoha saitoha closed this Jul 22, 2018

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.