Skip to content

heap-overflow in HierarchicalBitmapRequester::FetchRegion #71

Closed
@sleicasper

Description

There is a heap-overflow in HierarchicalBitmapRequester::FetchRegion in hierarchicalbitmaprequester.cpp.

reproduce steps:

  1. unzip poc.zip
  2. compile libjpeg with address sanitizer enabled
  3. run jpeg ./poc /dev/null

poc
poc.zip

stack trace

==2002399==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62d000008910 at pc 0x7ffb1603d490 bp 0x7ffe4780ec40 sp 0x7ffe4780e3e8
READ of size 32 at 0x62d000008910 thread T0
    #0 0x7ffb1603d48f in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:790
    #1 0x5605adc723a9 in HierarchicalBitmapRequester::FetchRegion(int, Line const* const*, int*) /home/casper/targets/struct/libjpeg_th/asan/BUILD/control/hierarchicalbitmaprequester.cpp:378
    #2 0x5605adc7633a in HierarchicalBitmapRequester::ReconstructRegion(RectAngle<int> const&, RectangleRequest const*) /home/casper/targets/struct/libjpeg_th/asan/BUILD/control/hierarchicalbitmaprequester.cpp:732
    #3 0x5605ad9819b5 in Image::ReconstructRegion(BitMapHook*, RectangleRequest const*) /home/casper/targets/struct/libjpeg_th/asan/BUILD/codestream/image.cpp:1111
    #4 0x5605ad96a1e1 in JPEG::InternalDisplayRectangle(JPG_TagItem*) /home/casper/targets/struct/libjpeg_th/asan/BUILD/interface/jpeg.cpp:721
    #5 0x5605ad969ed1 in JPEG::DisplayRectangle(JPG_TagItem*) /home/casper/targets/struct/libjpeg_th/asan/BUILD/interface/jpeg.cpp:699
    #6 0x5605ad94d2d0 in Reconstruct(char const*, char const*, int, char const*, bool) /home/casper/targets/struct/libjpeg_th/asan/BUILD/cmd/reconstruct.cpp:320
    #7 0x5605ad939ea9 in main /home/casper/targets/struct/libjpeg_th/asan/BUILD/cmd/main.cpp:747
    #8 0x7ffb15a880b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x240b2)
    #9 0x5605ad9369ad in _start (/home/casper/targets/struct/libjpeg_th/asan/fuzzrun/jpeg+0x459ad)

0x62d000008910 is located 0 bytes to the right of 34064-byte region [0x62d000000400,0x62d000008910)
allocated by thread T0 here:
    #0 0x7ffb160af808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
    #1 0x5605ad95ff5c in Environ::CoreAllocMem(unsigned int, unsigned int) (/home/casper/targets/struct/libjpeg_th/asan/fuzzrun/jpeg+0x6ef5c)
    #2 0x5605ad95eac4 in Environ::AllocMem(unsigned long) /home/casper/targets/struct/libjpeg_th/asan/BUILD/tools/environment.cpp:815
    #3 0x5605adc67941 in LineLineAdapter::AllocateLine(unsigned char) /home/casper/targets/struct/libjpeg_th/asan/BUILD/control/linelineadapter.cpp:160
    #4 0x5605adc674c5 in LineLineAdapter::GetNextLine(unsigned char) /home/casper/targets/struct/libjpeg_th/asan/BUILD/control/linelineadapter.cpp:130
    #5 0x5605adc72cb0 in HierarchicalBitmapRequester::Pull8Lines(unsigned char) /home/casper/targets/struct/libjpeg_th/asan/BUILD/control/hierarchicalbitmaprequester.cpp:437
    #6 0x5605adc761fd in HierarchicalBitmapRequester::ReconstructRegion(RectAngle<int> const&, RectangleRequest const*) /home/casper/targets/struct/libjpeg_th/asan/BUILD/control/hierarchicalbitmaprequester.cpp:729
    #7 0x5605ad9819b5 in Image::ReconstructRegion(BitMapHook*, RectangleRequest const*) /home/casper/targets/struct/libjpeg_th/asan/BUILD/codestream/image.cpp:1111
    #8 0x5605ad96a1e1 in JPEG::InternalDisplayRectangle(JPG_TagItem*) /home/casper/targets/struct/libjpeg_th/asan/BUILD/interface/jpeg.cpp:721
    #9 0x5605ad969ed1 in JPEG::DisplayRectangle(JPG_TagItem*) /home/casper/targets/struct/libjpeg_th/asan/BUILD/interface/jpeg.cpp:699
    #10 0x5605ad94d2d0 in Reconstruct(char const*, char const*, int, char const*, bool) /home/casper/targets/struct/libjpeg_th/asan/BUILD/cmd/reconstruct.cpp:320
    #11 0x5605ad939ea9 in main /home/casper/targets/struct/libjpeg_th/asan/BUILD/cmd/main.cpp:747
    #12 0x7ffb15a880b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x240b2)

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:790 in __interceptor_memcpy
Shadow bytes around the buggy address:
  0x0c5a7fff90d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5a7fff90e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5a7fff90f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5a7fff9100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5a7fff9110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c5a7fff9120: 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5a7fff9130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5a7fff9140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5a7fff9150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5a7fff9160: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5a7fff9170: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==2002399==ABORTING

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions