Skip to content

zzyyrr/divide-by-zero-in-libjpeg-9d

main
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
 
 

divide-by-zero-in-libjpeg-9d

Divide-by-zero in libjpeg-9d

There is a divide-by-zero error in libjpeg-9d.

How to reproduce: cjpeg id_000000,sig_08,src_001010,op_havoc,rep_8

The information from gdb: (gdb) bt #0 0x000000000040bfb5 in alloc_sarray (cinfo=0x7fffffffdc70, pool_id=1, samplesperrow=0, numrows=1) at ../jmemmgr.c:407 #1 0x000000000040329f in start_input_gif (cinfo=0x7fffffffdc70, sinfo=0x624f78) at ../rdgif.c:509 #2 0x0000000000400d34 in main (argc=2, argv=0x7fffffffdfd8) at ../cjpeg.c:626

The debug information: zyr@zyr-virtual-machine:~/CVE/crashs/cjpeg/c1$ gdb /home/zyr/CVE/latest-programs/cjpeg GNU gdb (Ubuntu 9.1-0ubuntu1) 9.1 Copyright (C) 2020 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: http://www.gnu.org/software/gdb/bugs/. Find the GDB manual and other documentation resources online at: http://www.gnu.org/software/gdb/documentation/.

For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from /home/zyr/CVE/latest-programs/cjpeg... (gdb) set args ./id_000000,sig_08,src_001010,op_havoc,rep_8 (gdb) b 626 Breakpoint 1 at 0x400d23: file ../cjpeg.c, line 626. (gdb) r Starting program: /home/zyr/CVE/latest-programs/cjpeg ./id_000000,sig_08,src_001010,op_havoc,rep_8

Breakpoint 1, main (argc=2, argv=0x7fffffffdfd8) at ../cjpeg.c:626 626 ../cjpeg.c: No such file or directory. (gdb) n 623 in ../cjpeg.c (gdb) n 626 in ../cjpeg.c (gdb) s start_input_gif (cinfo=0x7fffffffdc70, sinfo=0x624f78) at ../rdgif.c:391 391 ../rdgif.c: No such file or directory. (gdb) b 509 Breakpoint 2 at 0x403287: file ../rdgif.c, line 509. (gdb) c Continuing. Bogus char 0x0a in GIF file, ignoring

Breakpoint 2, start_input_gif (cinfo=0x7fffffffdc70, sinfo=0x624f78) at ../rdgif.c:509 509 in ../rdgif.c (gdb) s alloc_sarray (cinfo=0x7fffffffdc70, pool_id=1, samplesperrow=0, numrows=1) at ../jmemmgr.c:399 399 ../jmemmgr.c: No such file or directory. (gdb) n 407 in ../jmemmgr.c (gdb) display samplesperrow 1: samplesperrow = 0 (gdb) n 399 in ../jmemmgr.c 1: samplesperrow = 0 (gdb) n 408 in ../jmemmgr.c 1: samplesperrow = 0 (gdb) n 407 in ../jmemmgr.c 1: samplesperrow = 0 (gdb) n

Program received signal SIGFPE, Arithmetic exception. 0x000000000040bfb5 in alloc_sarray (cinfo=0x7fffffffdc70, pool_id=1, samplesperrow=0, numrows=1) at ../jmemmgr.c:407 407 in ../jmemmgr.c 1: samplesperrow = 0 (gdb) n

Program terminated with signal SIGFPE, Arithmetic exception. The program no longer exists.

About

Divide-by-zero in libjpeg-9d

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published