Bug 1649201
| Summary: | There is a heap-buffer-overflow at writer.c:140(function:write_png_to_file) in libsixel latest version that will cause serious impact. | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | shuitao gan <ganshuitao> | ||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||
| Status: | CLOSED NOTABUG | QA Contact: | |||||
| Severity: | urgent | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | unspecified | ||||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | All | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2018-11-13 14:45:27 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
Hello, Red Hat does not ship libsixel in any of our supported products. Please, report these issues upstream at: https://github.com/saitoha/libsixel/issues Thanks! |
Created attachment 1505142 [details] ./sixel2png POC4 version: libsixel latest version(v1.8.2) Summary: There is a heap-buffer-overflow at writer.c:140(function:write_png_to_file) in libsixel latest version that will cause serious impact. Description: The asan debug is as follows: $./sixel2png POC4 ================================================================= ================================================================= ==1707==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000aa6d at pc 0x7f4347a45e4d bp 0x7ffdba4a2560 sp 0x7ffdba4a2550 READ of size 1 at 0x60200000aa6d thread T0 #0 0x7f4347a45e4c in write_png_to_file /home/company/real_sanitize/libsixel-master/src/writer.c:140 #1 0x7f4347a45e4c in sixel_helper_write_image_file /home/company/real_sanitize/libsixel-master/src/writer.c:322 #2 0x7f4347a45113 in sixel_decoder_decode /home/company/real_sanitize/libsixel-master/src/decoder.c:318 #3 0x401152 in main /home/company/real_sanitize/libsixel-master/converters/sixel2png.c:226 #4 0x7f43473fda3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x20a3f) #5 0x4013d8 in _start (/home/company/real_sanitize/poc_check/libsixel/sixel2png+0x4013d8) 0x60200000aa6d is located 3 bytes to the left of 16-byte region [0x60200000aa70,0x60200000aa80) freed by thread T0 here: #0 0x7f4347d2a6aa in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x986aa) #1 0x7f4344ec702f (/usr/lib/x86_64-linux-gnu/libtasn1.so.6+0xb02f) previously allocated by thread T0 here: #0 0x7f4347d2a9aa in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x989aa) #1 0x7f4344ec6968 (/usr/lib/x86_64-linux-gnu/libtasn1.so.6+0xa968) SUMMARY: AddressSanitizer: heap-buffer-overflow /home/company/real_sanitize/libsixel-master/src/writer.c:140 write_png_to_file Shadow bytes around the buggy address: 0x0c047fff94f0: fa fa 01 fa fa fa fd fa fa fa 02 fa fa fa fd fd 0x0c047fff9500: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd 0x0c047fff9510: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd 0x0c047fff9520: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd 0x0c047fff9530: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd =>0x0c047fff9540: fa fa fd fd fa fa fd fd fa fa fd fd fa[fa]fd fd 0x0c047fff9550: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd 0x0c047fff9560: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd 0x0c047fff9570: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd 0x0c047fff9580: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd 0x0c047fff9590: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe ==1707==ABORTING