Bug 1649199 - There is a heap-buffer-overflow at fromsixel.c:311(function:image_buffer_resize) in libsixel latest version that will cause serious impact.
Summary: There is a heap-buffer-overflow at fromsixel.c:311(function:image_buffer_resi...
Status: CLOSED NOTABUG
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
(Show other bugs)
Version: unspecified
Hardware: All All
unspecified
urgent
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Keywords:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-11-13 06:15 UTC by shuitao gan
Modified: 2018-11-13 14:44 UTC (History)
0 users

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2018-11-13 14:44:57 UTC
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
./img2sixel POC2 (12.15 KB, application/octet-stream)
2018-11-13 06:15 UTC, shuitao gan
no flags Details

Description shuitao gan 2018-11-13 06:15:52 UTC
Created attachment 1505140 [details]
./img2sixel   POC2

version: libsixel latest version(v1.8.2)

Summary: 

There is a heap-buffer-overflow at fromsixel.c:311(function:image_buffer_resize) in libsixel latest version that will cause 
serious impact.


Description:

The asan debug is as follows:

$./img2sixel   POC2
=================================================================
==624==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000a7b1 at pc 0x7fcd853aa04c bp 0x7ffd2dcd54d0 sp 
0x7ffd2dcd4c78
WRITE of size 67108863 at 0x60200000a7b1 thread T0
    #0 0x7fcd853aa04b in __asan_memset (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x8d04b)
    #1 0x7fcd8508bf10 in memset /usr/include/x86_64-linux-gnu/bits/string3.h:90
    #2 0x7fcd8508bf10 in image_buffer_resize /home/company/real_sanitize/libsixel-master/src/fromsixel.c:311
    #3 0x7fcd8508d5d4 in sixel_decode_raw_impl /home/company/real_sanitize/libsixel-master/src/fromsixel.c:565
    #4 0x7fcd8508e8b1 in sixel_decode_raw /home/company/real_sanitize/libsixel-master/src/fromsixel.c:881
    #5 0x7fcd850c042c in load_sixel /home/company/real_sanitize/libsixel-master/src/loader.c:613
    #6 0x7fcd850c042c in load_with_builtin /home/company/real_sanitize/libsixel-master/src/loader.c:782
    #7 0x7fcd850c43d9 in sixel_helper_load_image_file /home/company/real_sanitize/libsixel-master/src/loader.c:1352
    #8 0x7fcd850cf283 in sixel_encoder_encode /home/company/real_sanitize/libsixel-master/src/encoder.c:1737
    #9 0x4017f8 in main /home/company/real_sanitize/libsixel-master/converters/img2sixel.c:457
    #10 0x7fcd84a88a3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x20a3f)
    #11 0x401918 in _start (/home/company/real_sanitize/poc_check/libsixel/img2sixel+0x401918)

0x60200000a7b1 is located 0 bytes to the right of 1-byte region [0x60200000a7b0,0x60200000a7b1)
allocated by thread T0 here:
    #0 0x7fcd853b59aa in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x989aa)
    #1 0x7fcd8508be1f in image_buffer_resize /home/company/real_sanitize/libsixel-master/src/fromsixel.c:292

SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 __asan_memset
Shadow bytes around the buggy address:
  0x0c047fff94a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff94b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff94c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff94d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff94e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c047fff94f0: fa fa fa fa fa fa[01]fa fa fa 01 fa fa fa fd fd
  0x0c047fff9500: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c047fff9510: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c047fff9520: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c047fff9530: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c047fff9540: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==624==ABORTING

=================================================================

Comment 1 Andrej Nemec 2018-11-13 14:44:57 UTC
Hello,

Red Hat does not ship libsixel in any of our supported products. Please, report these issues upstream at:

https://github.com/saitoha/libsixel/issues

Thanks!


Note You need to log in before you can comment on or make changes to this bug.