GNOME Bugzilla – Bug 747605
crash in libpixbufloader-bmp
Last modified: 2015-12-05 21:11:01 UTC
I have the following file on my hard drive: https://drive.google.com/file/d/0B20Uwp8Hs1oCTzFrMndWMjNtTHM/view?usp=sharing I go to drive.google.com in Chromium browser and try to upload the file. In the "Open Files" dialog I go the directory that contains the file. At this point browser crashes. gdk_pixbuf tries to allocate 0x001000000300 bytes when trying to open this 300 byte file: ==10500==WARNING: AddressSanitizer failed to allocate 0x001000000300 bytes ==10500==AddressSanitizer's allocator is terminating the process instead of returning 0 ==10500==If you don't like this behavior set allocator_may_return_null=1 ==10500==AddressSanitizer CHECK failed: /work/chromium/src/third_party/llvm/compiler-rt/lib/sanitizer_common/sanitizer_allocator.cc:149 "((0)) != (0)" (0x0, 0x0) #0 0x7f69571dbef4 (/opt/google/chrome-asan/chrome+0x20f5ef4) #1 0x7f69571df731 (/opt/google/chrome-asan/chrome+0x20f9731) #2 0x7f69571de174 (/opt/google/chrome-asan/chrome+0x20f8174) #3 0x7f69571d3cb5 (/opt/google/chrome-asan/chrome+0x20edcb5) #4 0x7f694d9a69cc (/usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0+0x69cc) #5 0x7f6903496811 (/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-bmp.so+0x2811) #6 0x7f694d9aca44 (/usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0+0xca44) #7 0x7f694d9ad2b7 (/usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0+0xd2b7) #8 0x7f694d9aae29 (/usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0+0xae29) #9 0x7f696065c8ee (/opt/google/chrome-asan/chrome+0xb5768ee) #10 0x7f69546703b7 (/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0+0x103b7) #11 0x7f6954681d3c (/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0+0x21d3c) #12 0x7f6954689a28 (/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0+0x29a28) #13 0x7f695468a211 (/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0+0x2a211) #14 0x7f69546703b7 (/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0+0x103b7) #15 0x7f6954681d3c (/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0+0x21d3c) #16 0x7f6954689a28 (/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0+0x29a28) #17 0x7f695468a211 (/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0+0x2a211) #18 0x7f69546703b7 (/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0+0x103b7) #19 0x7f6954681d3c (/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0+0x21d3c) #20 0x7f6954689a28 (/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0+0x29a28) #21 0x7f695468a211 (/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0+0x2a211) #22 0x7f694e16b0e6 (/usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0+0xd60e6) #23 0x7f694e16e3ef (/usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0+0xd93ef) #24 0x7f69546705e6 (/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0+0x105e6) #25 0x7f6954689087 (/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0+0x29087) #26 0x7f6954689ce1 (/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0+0x29ce1) #27 0x7f694e2b635d (/usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0+0x22135d) #28 0x7f694e2ba907 (/usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0+0x225907) #29 0x7f694e1c2814 (/usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0+0x12d814) #30 0x7f69546703b7 (/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0+0x103b7) #31 0x7f6954681afa (/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0+0x21afa) #32 0x7f69546896f8 (/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0+0x296f8) #33 0x7f6954689ce1 (/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0+0x29ce1) #34 0x7f694e2d2723 (/usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0+0x23d723) #35 0x7f694e1c0fc3 (/usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0+0x12bfc3) #36 0x7f694e1c137a (/usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0+0x12c37a) #37 0x7f6960670442 (/opt/google/chrome-asan/chrome+0xb58a442) #38 0x7f694de3c1eb (/usr/lib/x86_64-linux-gnu/libgdk-x11-2.0.so.0+0x591eb) #39 0x7f695419ee03 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x48e03) #40 0x7f695419f047 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x49047) #41 0x7f695419f0eb (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x490eb) #42 0x7f695813976f (/opt/google/chrome-asan/chrome+0x305376f) #43 0x7f69580c866a (/opt/google/chrome-asan/chrome+0x2fe266a) #44 0x7f695798a7b6 (/opt/google/chrome-asan/chrome+0x28a47b6) #45 0x7f695f4a7b1e (/opt/google/chrome-asan/chrome+0xa3c1b1e) #46 0x7f695efae6d5 (/opt/google/chrome-asan/chrome+0x9ec86d5) #47 0x7f695efada83 (/opt/google/chrome-asan/chrome+0x9ec7a83) #48 0x7f6958013818 (/opt/google/chrome-asan/chrome+0x2f2d818) #49 0x7f695801108a (/opt/google/chrome-asan/chrome+0x2f2b08a) #50 0x7f69571f1ef6 (/opt/google/chrome-asan/chrome+0x210bef6) #51 0x7f694cf7eec4 (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4) #52 0x7f69571708a4 (/opt/google/chrome-asan/chrome+0x208a8a4) Here is a symbolized stack trace: Program received signal SIGTRAP, Trace/breakpoint trap. base::debug::(anonymous namespace)::DebugBreak () at ../../base/debug/debugger_posix.cc:228 228 } (gdb) bt #0 base::debug::(anonymous namespace)::DebugBreak () at ../../base/debug/debugger_posix.cc:228
+ Trace 234953
Thanks for reporting this. Any chance to install debug packages / provide symbols for the following lines?:
+ Trace 234957
I don't know how to do it. But I think it should be pretty easy to reproduce by loading the file.
Can you attach the problematic image ?
I guess I did not attach a repro because my browser crashed every time I tried to attach the image. I think I tried to upload reproduced for this issue: https://github.com/golang/go/issues/10399 (you can see that it also crashes trying to allocate 0x1000000300 bytes). So try repro for that issue, there is a link.
Created attachment 316698 [details] Problematic BMP file Attaching the bitmap linked to in the bug report. It has a bit depth of 65524 specified.
This crash is caused by a lack of validation on the bit depth of a bitmap file / bad integer conversion. 65524 is reinterpreted as -12 (headerpair::depth, a guint, is assigned directly to bmp_progressive_state::Type, a gint, at io-bmp.c:331). This causes the check for (Type <= 8) to pass and attempt to load a palette by calling DecodeColormap. DecodeColormap attempts to allocate (1 << 65524) * 3 bytes of memory, which is a platform dependant value, potentially big enough to cause the original crash. There is a very related bug for BMP files with overspecified color depth to do heap overflow which I will create a separate report for, as it is not caused by this signed integer conversion.