Created attachment 1505143 [details] ./sixel2png POC5 version: libsixel latest version(v1.8.2) Summary: There is a heap-buffer-overflow at stb_image_write.h:933(function: stbi_write_png_to_me) in libsixel latest version that will cause serious impact. Description: The asan debug is as follows: $./sixel2png POC5 ================================================================= ================================================================= ==1771==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x63300001b584 at pc 0x7fe34fe54522 bp 0x7ffd56043f50 sp 0x7ffd56043f40 READ of size 1 at 0x63300001b584 thread T0 #0 0x7fe34fe54521 in stbi_write_png_to_mem /home/company/real_sanitize/libsixel-master/src/stb_image_write.h:933 #1 0x7fe34fe4d4ca in write_png_to_file /home/company/real_sanitize/libsixel-master/src/writer.c:262 #2 0x7fe34fe4d4ca in sixel_helper_write_image_file /home/company/real_sanitize/libsixel-master/src/writer.c:322 #3 0x7fe34fe4d113 in sixel_decoder_decode /home/company/real_sanitize/libsixel-master/src/decoder.c:318 #4 0x401152 in main /home/company/real_sanitize/libsixel-master/converters/sixel2png.c:226 #5 0x7fe34f805a3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x20a3f) #6 0x4013d8 in _start (/home/company/real_sanitize/poc_check/libsixel/sixel2png+0x4013d8) 0x63300001b584 is located 0 bytes to the right of 109956-byte region [0x633000000800,0x63300001b584) allocated by thread T0 here: #0 0x7fe3501329aa in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x989aa) #1 0x7fe34fe4d5e4 in write_png_to_file /home/company/real_sanitize/libsixel-master/src/writer.c:132 #2 0x7fe34fe4d5e4 in sixel_helper_write_image_file /home/company/real_sanitize/libsixel-master/src/writer.c:322 #3 0x7fe34fe6b30f (/home/company/real_sanitize/libsixel-master/install_asan/lib/libsixel.so.1+0x9e30f) SUMMARY: AddressSanitizer: heap-buffer-overflow /home/company/real_sanitize/libsixel-master/src/stb_image_write.h:933 stbi_write_png_to_mem Shadow bytes around the buggy address: 0x0c667fffb660: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c667fffb670: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c667fffb680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c667fffb690: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c667fffb6a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c667fffb6b0:[04]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c667fffb6c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c667fffb6d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c667fffb6e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c667fffb6f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c667fffb700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe ==1771==ABORTING
Hello, Red Hat does not ship libsixel in any of our supported products. Please, report these issues upstream at: https://github.com/saitoha/libsixel/issues Thanks!