Bug 1649199
Summary: | There is a heap-buffer-overflow at fromsixel.c:311(function:image_buffer_resize) in libsixel latest version that will cause serious impact. | ||||||
---|---|---|---|---|---|---|---|
Product: | [Other] Security Response | Reporter: | shuitao gan <ganshuitao> | ||||
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||
Status: | CLOSED NOTABUG | QA Contact: | |||||
Severity: | urgent | Docs Contact: | |||||
Priority: | unspecified | ||||||
Version: | unspecified | ||||||
Target Milestone: | --- | ||||||
Target Release: | --- | ||||||
Hardware: | All | ||||||
OS: | All | ||||||
Whiteboard: | |||||||
Fixed In Version: | Doc Type: | If docs needed, set a value | |||||
Doc Text: | Story Points: | --- | |||||
Clone Of: | Environment: | ||||||
Last Closed: | 2018-11-13 14:44:57 UTC | Type: | Bug | ||||
Regression: | --- | Mount Type: | --- | ||||
Documentation: | --- | CRM: | |||||
Verified Versions: | Category: | --- | |||||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
Cloudforms Team: | --- | Target Upstream Version: | |||||
Embargoed: | |||||||
Attachments: |
|
Hello, Red Hat does not ship libsixel in any of our supported products. Please, report these issues upstream at: https://github.com/saitoha/libsixel/issues Thanks! |
Created attachment 1505140 [details] ./img2sixel POC2 version: libsixel latest version(v1.8.2) Summary: There is a heap-buffer-overflow at fromsixel.c:311(function:image_buffer_resize) in libsixel latest version that will cause serious impact. Description: The asan debug is as follows: $./img2sixel POC2 ================================================================= ==624==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000a7b1 at pc 0x7fcd853aa04c bp 0x7ffd2dcd54d0 sp 0x7ffd2dcd4c78 WRITE of size 67108863 at 0x60200000a7b1 thread T0 #0 0x7fcd853aa04b in __asan_memset (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x8d04b) #1 0x7fcd8508bf10 in memset /usr/include/x86_64-linux-gnu/bits/string3.h:90 #2 0x7fcd8508bf10 in image_buffer_resize /home/company/real_sanitize/libsixel-master/src/fromsixel.c:311 #3 0x7fcd8508d5d4 in sixel_decode_raw_impl /home/company/real_sanitize/libsixel-master/src/fromsixel.c:565 #4 0x7fcd8508e8b1 in sixel_decode_raw /home/company/real_sanitize/libsixel-master/src/fromsixel.c:881 #5 0x7fcd850c042c in load_sixel /home/company/real_sanitize/libsixel-master/src/loader.c:613 #6 0x7fcd850c042c in load_with_builtin /home/company/real_sanitize/libsixel-master/src/loader.c:782 #7 0x7fcd850c43d9 in sixel_helper_load_image_file /home/company/real_sanitize/libsixel-master/src/loader.c:1352 #8 0x7fcd850cf283 in sixel_encoder_encode /home/company/real_sanitize/libsixel-master/src/encoder.c:1737 #9 0x4017f8 in main /home/company/real_sanitize/libsixel-master/converters/img2sixel.c:457 #10 0x7fcd84a88a3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x20a3f) #11 0x401918 in _start (/home/company/real_sanitize/poc_check/libsixel/img2sixel+0x401918) 0x60200000a7b1 is located 0 bytes to the right of 1-byte region [0x60200000a7b0,0x60200000a7b1) allocated by thread T0 here: #0 0x7fcd853b59aa in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x989aa) #1 0x7fcd8508be1f in image_buffer_resize /home/company/real_sanitize/libsixel-master/src/fromsixel.c:292 SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 __asan_memset Shadow bytes around the buggy address: 0x0c047fff94a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c047fff94b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c047fff94c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c047fff94d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c047fff94e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x0c047fff94f0: fa fa fa fa fa fa[01]fa fa fa 01 fa fa fa fd fd 0x0c047fff9500: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd 0x0c047fff9510: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd 0x0c047fff9520: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd 0x0c047fff9530: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd 0x0c047fff9540: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe ==624==ABORTING =================================================================