Fix 3 security problems found by fuzzer#23
Fix 3 security problems found by fuzzer#23everestsummer wants to merge 6 commits intolecram:masterfrom
Conversation
…ng out of bounds read access.
…s, causing oob read.
|
crash-3.zip |
|
` 0x61c00000c0c1 is located 65 bytes inside of 1800-byte region [0x61c00000c080,0x61c00000c788) previously allocated by thread T0 here: SUMMARY: AddressSanitizer: heap-use-after-free /home/niko/gitrepo/gifdec/gifdec.c:409:66 in read_image_data |
|
@everestsummer CVE-2022-43359 assigned |
|
cc @lecram |
|
|
||
| do { | ||
| read(gif->fd, &size, 1); | ||
| if (!first_try && size == seek_pos) //To prevent infinite loop |
The following sample generated by fuzzer may cause a SIGSEGV in gifdec.
The root cause is variable "key" may be a larger value than count of entries, causing program accesses out-of-bounds heap buffer.
Program received signal SIGSEGV, Segmentation fault.
0x0000555555558280 in read_image_data (interlace=64, gif=0x55555555d2a0) at gifdec.c:395
395 entry = table->entries[entry.prefix];
(gdb) bt
#0 0x0000555555558280 in read_image_data (interlace=64, gif=0x55555555d2a0) at gifdec.c:395
#1 read_image (gif=0x55555555d2a0) at gifdec.c:441
#2 gd_get_frame (gif=gif@entry=0x55555555d2a0) at gifdec.c:500
#3 0x00005555555554b4 in main (argc=, argv=0x7fffffffe1a8) at example2.c:38
crash-1.zip