GNOME Bugzilla – Bug 775229
buffer over-reads in gdk_pixbuf_from_pixdata
Last modified: 2018-05-22 13:20:29 UTC
Created attachment 340902 [details] crashing file, password "crash" GNU gdb (Ubuntu 7.11.1-0ubuntu1~16.04) 7.11.1 Copyright (C) 2016 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from /tmp/gdkpb/libexec/installed-tests/gdk-pixbuf/pixbuf-read...done. Starting program: /tmp/gdkpb/libexec/installed-tests/gdk-pixbuf/pixbuf-read /tmp/gdk-findings/compute32_fuzz1/crashes/id:000017,sig:11,src:003716+003462,op:splice,rep:128 [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". /tmp/gdk-findings/compute32_fuzz1/crashes/id:000017,sig:11,src:003716+003462,op:splice,rep:128 ================================================================= ==6883==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61d00001b680 at pc 0x7ffff6ef6935 bp 0x7fffffffd7a0 sp 0x7fffffffcf48 READ of size 1060864 at 0x61d00001b680 thread T0 #0 0x7ffff6ef6934 in __asan_memcpy (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x8c934) #1 0x7ffff6bd0276 in gdk_pixbuf_from_pixdata /home/muelli/vcs/gdk-pixbuf/gdk-pixbuf/gdk-pixdata.c:550 #2 0x7ffff6be66a5 in try_load /home/muelli/vcs/gdk-pixbuf/gdk-pixbuf/io-pixdata.c:85 #3 0x7ffff6be704e in pixdata_image_load_increment /home/muelli/vcs/gdk-pixbuf/gdk-pixbuf/io-pixdata.c:156 #4 0x7ffff6bbe0b6 in gdk_pixbuf_loader_load_module /home/muelli/vcs/gdk-pixbuf/gdk-pixbuf/gdk-pixbuf-loader.c:443 #5 0x7ffff6bbfb16 in gdk_pixbuf_loader_close /home/muelli/vcs/gdk-pixbuf/gdk-pixbuf/gdk-pixbuf-loader.c:808 #6 0x400e74 in test_loader /home/muelli/vcs/gdk-pixbuf/tests/pixbuf-read.c:35 #7 0x40121c in main /home/muelli/vcs/gdk-pixbuf/tests/pixbuf-read.c:75 #8 0x7ffff555f82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) #9 0x400d08 in _start (/tmp/gdkpb/libexec/installed-tests/gdk-pixbuf/pixbuf-read+0x400d08) 0x61d00001b680 is located 0 bytes to the right of 2048-byte region [0x61d00001ae80,0x61d00001b680) allocated by thread T0 here: #0 0x7ffff6f02961 in realloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98961) #1 0x7ffff68817e7 in g_realloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4f7e7) SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 __asan_memcpy Shadow bytes around the buggy address: 0x0c3a7fffb680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3a7fffb690: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3a7fffb6a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3a7fffb6b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3a7fffb6c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c3a7fffb6d0:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c3a7fffb6e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c3a7fffb6f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c3a7fffb700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c3a7fffb710: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c3a7fffb720: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe ==6883==ABORTING Program received signal SIGABRT, Aborted. 0x00007ffff5574428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54 54 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
+ Trace 236889
Thread 1 (Thread 0x7ffff7fc3880 (LWP 6883))
$10 = (const GdkPixdata *) 0x60700000b5d8 (gdb) p *pixdata $11 = {magic = 1197763408, length = 80, pixdata_type = 822149377, rowstride = 256, width = 48, height = 4144, pixel_data = 0x61d00001ae98 "\b\002"} (gdb) p *pixdata->pixel_data $12 = 8 '\b' (gdb) p pixdata->pixel_data $13 = (guint8 *) 0x61d00001ae98 "\b\002" (gdb)
Created attachment 340903 [details] [review] patch note that I don't know whether the length field is indeed appropriate to check for.
Created attachment 341888 [details] [review] tests: Add test for bug 775229
Also seems to work correctly with the fix from bug 775693.
-- GitLab Migration Automatic Message -- This bug has been migrated to GNOME's GitLab instance and has been closed from further activity. You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.gnome.org/GNOME/gdk-pixbuf/issues/57.