Heap buffer overflow in function Model::vert

[fCorleone]

I used Clang 6.0 and AddressSanitizer to build tinyrenderer, this obj file with those tga file tga1,tga2,tga3 can cause heap buffer overflow in function Model::vert when executing this command:

./main $POC(obj file only)

This is the ASAN information:

=================================================================
==31108==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6230000000f4 at pc 0x0000004df14d bp 0x7ffceaa92750 sp 0x7ffceaa91f00
READ of size 12 at 0x6230000000f4 thread T0
    #0 0x4df14c in __asan_memcpy /home/fouzhe/llvm/llvm/projects/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cc:23
    #1 0x52faed in Model::vert(int, int) /home/fouzhe/my_fuzz/tinyrenderer_test/tinyrenderer/model.cpp:68:12
    #2 0x543047 in Shader::vertex(int, int) /home/fouzhe/my_fuzz/tinyrenderer_test/tinyrenderer/main.cpp:28:64
    #3 0x54146b in main /home/fouzhe/my_fuzz/tinyrenderer_test/tinyrenderer/main.cpp:82:24
    #4 0x7f0574f4582f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #5 0x41c098 in _start (/home/fouzhe/my_fuzz/tinyrenderer_test/tinyrenderer/main+0x41c098)

0x6230000000f4 is located 12 bytes to the left of 6144-byte region [0x623000000100,0x623000001900)
allocated by thread T0 here:
    #0 0x517d58 in operator new(unsigned long) /home/fouzhe/llvm/llvm/projects/compiler-rt/lib/asan/asan_new_delete.cc:92
    #1 0x535305 in __gnu_cxx::new_allocator<vec<3ul, float> >::allocate(unsigned long, void const*) /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/ext/new_allocator.h:104:27
    #2 0x5352ab in __gnu_cxx::__alloc_traits<std::allocator<vec<3ul, float> > >::allocate(std::allocator<vec<3ul, float> >&, unsigned long) /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/ext/alloc_traits.h:182:18
    #3 0x534ed2 in std::_Vector_base<vec<3ul, float>, std::allocator<vec<3ul, float> > >::_M_allocate(unsigned long) /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/bits/stl_vector.h:170:20
    #4 0x5340c6 in std::vector<vec<3ul, float>, std::allocator<vec<3ul, float> > >::_M_insert_aux(__gnu_cxx::__normal_iterator<vec<3ul, float>*, std::vector<vec<3ul, float>, std::allocator<vec<3ul, float> > > >, vec<3ul, float> const&) /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/bits/vector.tcc:353:30
    #5 0x5318a8 in std::vector<vec<3ul, float>, std::allocator<vec<3ul, float> > >::push_back(vec<3ul, float> const&) /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/bits/stl_vector.h:925:4
    #6 0x52ded8 in Model::Model(char const*) /home/fouzhe/my_fuzz/tinyrenderer_test/tinyrenderer/model.cpp:19:20
    #7 0x54133c in main /home/fouzhe/my_fuzz/tinyrenderer_test/tinyrenderer/main.cpp:78:21
    #8 0x7f0574f4582f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/fouzhe/llvm/llvm/projects/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cc:23 in __asan_memcpy
Shadow bytes around the buggy address:
  0x0c467fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c467fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c467fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c467fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c467fff8000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c467fff8010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]fa
  0x0c467fff8020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c467fff8030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c467fff8040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c467fff8050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c467fff8060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==31108==ABORTING

[ssloy]

The obj file is corrupted. Check the line 1216, there is a zero index, but wavefront tga starts counting with 1, not 0.

https://github.com/fouzhe/security/blob/master/tinyrenderer/heap-buffer-overflow_Model::vert.obj#L1216