After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 775229 - buffer over-reads in gdk_pixbuf_from_pixdata
buffer over-reads in gdk_pixbuf_from_pixdata
Status: RESOLVED OBSOLETE
Product: gdk-pixbuf
Classification: Platform
Component: loaders
git master
Other Linux
: Normal normal
: ---
Assigned To: gdk-pixbuf-maint
gdk-pixbuf-maint
Depends on:
Blocks:
 
 
Reported: 2016-11-28 13:29 UTC by Tobias Mueller
Modified: 2018-05-22 13:20 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
crashing file, password "crash" (614 bytes, application/pgp-encrypted)
2016-11-28 13:29 UTC, Tobias Mueller
  Details
patch (6.34 KB, patch)
2016-11-28 13:31 UTC, Tobias Mueller
none Details | Review
tests: Add test for bug 775229 (2.40 KB, patch)
2016-12-13 15:54 UTC, Bastien Nocera
none Details | Review

Description Tobias Mueller 2016-11-28 13:29:16 UTC
Created attachment 340902 [details]
crashing file, password "crash"

GNU gdb (Ubuntu 7.11.1-0ubuntu1~16.04) 7.11.1
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /tmp/gdkpb/libexec/installed-tests/gdk-pixbuf/pixbuf-read...done.
Starting program: /tmp/gdkpb/libexec/installed-tests/gdk-pixbuf/pixbuf-read /tmp/gdk-findings/compute32_fuzz1/crashes/id:000017,sig:11,src:003716+003462,op:splice,rep:128
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
/tmp/gdk-findings/compute32_fuzz1/crashes/id:000017,sig:11,src:003716+003462,op:splice,rep:128		=================================================================
==6883==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61d00001b680 at pc 0x7ffff6ef6935 bp 0x7fffffffd7a0 sp 0x7fffffffcf48
READ of size 1060864 at 0x61d00001b680 thread T0
    #0 0x7ffff6ef6934 in __asan_memcpy (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x8c934)
    #1 0x7ffff6bd0276 in gdk_pixbuf_from_pixdata /home/muelli/vcs/gdk-pixbuf/gdk-pixbuf/gdk-pixdata.c:550
    #2 0x7ffff6be66a5 in try_load /home/muelli/vcs/gdk-pixbuf/gdk-pixbuf/io-pixdata.c:85
    #3 0x7ffff6be704e in pixdata_image_load_increment /home/muelli/vcs/gdk-pixbuf/gdk-pixbuf/io-pixdata.c:156
    #4 0x7ffff6bbe0b6 in gdk_pixbuf_loader_load_module /home/muelli/vcs/gdk-pixbuf/gdk-pixbuf/gdk-pixbuf-loader.c:443
    #5 0x7ffff6bbfb16 in gdk_pixbuf_loader_close /home/muelli/vcs/gdk-pixbuf/gdk-pixbuf/gdk-pixbuf-loader.c:808
    #6 0x400e74 in test_loader /home/muelli/vcs/gdk-pixbuf/tests/pixbuf-read.c:35
    #7 0x40121c in main /home/muelli/vcs/gdk-pixbuf/tests/pixbuf-read.c:75
    #8 0x7ffff555f82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #9 0x400d08 in _start (/tmp/gdkpb/libexec/installed-tests/gdk-pixbuf/pixbuf-read+0x400d08)

0x61d00001b680 is located 0 bytes to the right of 2048-byte region [0x61d00001ae80,0x61d00001b680)
allocated by thread T0 here:
    #0 0x7ffff6f02961 in realloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98961)
    #1 0x7ffff68817e7 in g_realloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4f7e7)

SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 __asan_memcpy
Shadow bytes around the buggy address:
  0x0c3a7fffb680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a7fffb690: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a7fffb6a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a7fffb6b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a7fffb6c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c3a7fffb6d0:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a7fffb6e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a7fffb6f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a7fffb700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a7fffb710: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3a7fffb720: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==6883==ABORTING

Program received signal SIGABRT, Aborted.
0x00007ffff5574428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
54	../sysdeps/unix/sysv/linux/raise.c: No such file or directory.

Thread 1 (Thread 0x7ffff7fc3880 (LWP 6883))

  • #0 __GI_raise
    at ../sysdeps/unix/sysv/linux/raise.c line 54
  • #1 __GI_abort
    at abort.c line 89
  • #2 ??
    from /usr/lib/x86_64-linux-gnu/libasan.so.2
  • #3 ??
    from /usr/lib/x86_64-linux-gnu/libasan.so.2
  • #4 ??
    from /usr/lib/x86_64-linux-gnu/libasan.so.2
  • #5 __asan_report_error
    from /usr/lib/x86_64-linux-gnu/libasan.so.2
  • #6 __asan_memcpy
    from /usr/lib/x86_64-linux-gnu/libasan.so.2
  • #7 gdk_pixbuf_from_pixdata
    at gdk-pixdata.c line 550
  • #8 try_load
    at io-pixdata.c line 85
  • #9 pixdata_image_load_increment
    at io-pixdata.c line 156
  • #10 gdk_pixbuf_loader_load_module
    at gdk-pixbuf-loader.c line 443
  • #11 gdk_pixbuf_loader_close
    at gdk-pixbuf-loader.c line 808
  • #12 test_loader
    at pixbuf-read.c line 35
  • #13 main
    at pixbuf-read.c line 75
  • #7 gdk_pixbuf_from_pixdata
    at gdk-pixdata.c line 550
  • #8 try_load
    at io-pixdata.c line 85
  • #9 pixdata_image_load_increment
    at io-pixdata.c line 156
  • #7 gdk_pixbuf_from_pixdata
    at gdk-pixdata.c line 550
$10 = (const GdkPixdata *) 0x60700000b5d8
(gdb) p *pixdata
$11 = {magic = 1197763408, length = 80, pixdata_type = 822149377, rowstride = 256, width = 48, height = 4144, pixel_data = 0x61d00001ae98 "\b\002"}
(gdb) p *pixdata->pixel_data
$12 = 8 '\b'
(gdb) p pixdata->pixel_data
$13 = (guint8 *) 0x61d00001ae98 "\b\002"
(gdb)
Comment 1 Tobias Mueller 2016-11-28 13:31:28 UTC
Created attachment 340903 [details] [review]
patch

note that I don't know whether the length field is indeed appropriate to check for.
Comment 2 Bastien Nocera 2016-12-13 15:54:36 UTC
Created attachment 341888 [details] [review]
tests: Add test for bug 775229
Comment 3 Bastien Nocera 2016-12-13 16:44:34 UTC
Also seems to work correctly with the fix from bug 775693.
Comment 4 GNOME Infrastructure Team 2018-05-22 13:20:29 UTC
-- GitLab Migration Automatic Message --

This bug has been migrated to GNOME's GitLab instance and has been closed from further activity.

You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.gnome.org/GNOME/gdk-pixbuf/issues/57.