GNOME Bugzilla – Bug 795248
crash on reading malformed ppm files
Last modified: 2018-04-15 05:51:41 UTC
An outbound write in gegl could result to crash at least. It maybe exploited to execute code. the debug information as follows: ======== (gdb) run ./gegl-outbound-write-1 The program being debugged has been started already. Start it from the beginning? (y or n) y Starting program: /src/aflbuild/installed/bin/gegl ./gegl-outbound-write-1 [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". (gegl:303): GEGL-WARNING **: Failed to set operation type gegl:text, using a passthrough op instead (gegl:303): GEGL-WARNING **: Failed to set operation type gegl:text, using a passthrough op instead ** (gegl:303): WARNING **: No display handler operation found for gegl:display [New Thread 0x7fffef432700 (LWP 304)] Thread 1 "gegl" received signal SIGSEGV, Segmentation fault. __memcpy_sse2_unaligned () at ../sysdeps/x86_64/multiarch/memcpy-sse2-unaligned.S:37 37 ../sysdeps/x86_64/multiarch/memcpy-sse2-unaligned.S: No such file or directory. (gdb) exploitable Description: Access violation on destination operand Short description: DestAv (8/22) Hash: d7482cdb03f2cb0b586cd5cf74b1cb43.f4d790321ded280ed3837c295823fc52 Exploitability Classification: EXPLOITABLE Explanation: The target crashed on an access violation at an address matching the destination operand of the instruction. This likely indicates a write access violation, which means the attacker may control the write address and/or value. Other tags: AccessViolation (21/22) (gdb) bt
+ Trace 238556
the poc please ref to : https://github.com/xiaoqx/pocs/blob/master/gegl/gegl-outbound-write-1
For crashes which result from a fuzzed input file, the problem is likely in the file reader for this operation itself - please attach files/test-cases directly to bug reports instead of linking to external repositories.
Using a more valid ppm would also cause the same crash, thus rejecting the strange fuzzed form would be insufficient. --------------- P6 725583137 4 255 --------------- commit 66003c7fee310f203c9947864429e03e652e02e7 (HEAD -> master) Author: Øyvind Kolås <pippin@gimp.org> Date: Sat Apr 14 14:26:37 2018 +0200 ppm-load: limit max permitted buffer allocation to 2GB Fixing bug #795248
Actual commit hash, changed - since other changes had happend in the repo. commit c83b05d565a1e3392c9606a4ecaa560eb9a4ee29 Author: Øyvind Kolås <pippin@gimp.org> Date: Sat Apr 14 14:26:37 2018 +0200 ppm-load: limit max permitted buffer allocation to 2GB Fixing bug #795248