[<prev] [next>] [day] [month] [year] [list]
Message-ID: <2093176.kk87qeuY9I@arcadia>
Date: Tue, 22 Nov 2016 17:52:54 +0100
From: Agostino Sarubbo <ago@...too.org>
To: oss-security@...ts.openwall.com
Subject: metapixel: heap-based buffer overflow in open_gif_file (rwgif.c)
Description:
metapixel is a program for generating photomosaics.
A fuzzing on metapixel-imagesize revealed an overflow. The latest upstream
release was about ten years ago, so I didn’t made any report. The bug does not
resides in any shared object which aren’t provided by the package. If you have
a web application which relies on the metapixel-imagesize binary, then you are
affected. Since the “READ of size 1” it may don’t warrant a CVE at all, but
some distros and packagers would have the bug fixed in their repository, so
I’m sharing it.
The complete ASan output:
# metapixel-imagesize $FILE
==24883==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x60200000eff9 at pc 0x00000050edcf bp 0x7ffce3891f90 sp 0x7ffce3891f88
READ of size 1 at 0x60200000eff9 thread T0
#0 0x50edce in open_gif_file /tmp/portage/media-gfx/metapixel-1.0.2-
r1/work/metapixel-1.0.2/rwimg/rwgif.c:132:60
#1 0x50a4cd in open_image_reading /tmp/portage/media-gfx/metapixel-1.0.2-
r1/work/metapixel-1.0.2/rwimg/readimage.c:88:9
#2 0x50a18b in main /tmp/portage/media-gfx/metapixel-1.0.2-
r1/work/metapixel-1.0.2/imagesize.c:37:14
#3 0x7fcc5c3a861f in __libc_start_main /var/tmp/portage/sys-
libs/glibc-2.22-r4/work/glibc-2.22/csu/libc-start.c:289
#4 0x41a1d8 in _init (/usr/bin/metapixel-imagesize+0x41a1d8)
0x60200000eff9 is located 3 bytes to the right of 6-byte region
[0x60200000eff0,0x60200000eff6)
allocated by thread T0 here:
#0 0x4d3195 in calloc /tmp/portage/sys-devel/llvm-3.9.0-
r1/work/llvm-3.9.0.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:72
#1 0x7fcc5d267392 in GifMakeMapObject /tmp/portage/media-
libs/giflib-5.1.4/work/giflib-5.1.4/lib/gifalloc.c:55
SUMMARY: AddressSanitizer: heap-buffer-overflow /tmp/portage/media-
gfx/metapixel-1.0.2-r1/work/metapixel-1.0.2/rwimg/rwgif.c:132:60 in
open_gif_file
Shadow bytes around the buggy address:
0x0c047fff9da0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9db0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9dc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9dd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9de0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c047fff9df0: fa fa fa fa fa fa fa fa fa fa 00 fa fa fa 06[fa]
0x0c047fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9e20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9e30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9e40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==24883==ABORTING
Affected version:
1.0.2
Fixed version:
N/A
Commit fix:
N/A
Credit:
This bug was discovered by Agostino Sarubbo of Gentoo.
Reproducer:
https://github.com/asarubbo/poc/blob/master/00058-metapipxel-heapoverflow-open_gif_file
Timeline:
2016-11-22: bug discovered
2016-11-22: blog post about the issue
Note:
This bug was found with American Fuzzy Lop.
Permalink:
https://blogs.gentoo.org/ago/2016/11/22/metapixel-heap-based-buffer-overflow-in-open_gif_file-rwgif-c
--
Agostino Sarubbo
Gentoo Linux Developer
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
