Menu ▾ ▴

#308 DJVU::GSetImpl@GContainer.h:1143-12___heap-use-after-free

djvulibre
open
nobody
None
5
2019-10-09
2019-10-09
pwd
No

djvu

version

djvu Commit-6630c7

description

DjVu is a web-centric format for distributing documents and images. DjVu was created at AT&T Labs-Research and later sold to LizardTech Inc. DjVuLibre is a GPL implementation of DjVu maintained by the original inventors of DjVu.

https://sourceforge.net/p/djvu/djvulibre-git/ci/master/tree/

others

please send email to  teamseri0us360@gmail.com if you have any questions.

DJVU::GSetImpl@GContainer.h:1143-12___heap-use-after-free

description

An issue was discovered in djvu Commit-6630c7, There is a/an heap-use-after-free in function DJVU::GSetImpl at GContainer.h:1143-12

commandline

ddjvu --format=pbm @@

source

1139 GSetImpl<K>::get(const K &key) const
1140 { 
1141   unsigned int hashcode = hash(key);
1142   for (SNode *s=(SNode*)hashnode(hashcode); s; s=(SNode*)(s->hprev))
>1143     if (s->ha \*bug=>*\ shcode == hashcode && s->key == key) return s;
1144   return 0;
1145 }
1146 
1147 #if GCONTAINER_BOUNDS_CHECK
1148 template<class K> GCONT HNode *

bug report

ddjvu: Cannot decode document.
=================================================================
==22443==ERROR: AddressSanitizer: heap-use-after-free on address 0x606000006038 at pc 0x7f339fde6be5 bp 0x7f339b463ef0 sp 0x7f339b463ee8
READ of size 4 at 0x606000006038 thread T1
    #0 0x7f339fde6be4 in DJVU::GSetImpl<DJVU::GUTF8String>::get(DJVU::GUTF8String const&) const /src/djvu/libdjvu/./GContainer.h:1143:12
    #1 0x7f339fde6be4 in DJVU::GSetImpl<DJVU::GUTF8String>::contains(DJVU::GUTF8String const&) const /src/djvu/libdjvu/./GContainer.h:1121
    #2 0x7f339fde6be4 in DJVU::GMapTemplate<DJVU::GUTF8String, DJVU::GUTF8String, DJVU::GUTF8String>::contains(DJVU::GUTF8String const&) const /src/djvu/libdjvu/./GContainer.h:1250
    #3 0x7f339fde6be4 in DJVU::GUTF8String::fromEscaped(DJVU::GMap<DJVU::GUTF8String, DJVU::GUTF8String>) const /src/djvu/libdjvu/GString.cpp:1529
    #4 0x7f339fde70cd in DJVU::GUTF8String::fromEscaped() const /src/djvu/libdjvu/GString.cpp:1558:10
    #5 0x7f339fcaa772 in DJVU::DjVuMessageLite::LookUpID(DJVU::GUTF8String const&, DJVU::GUTF8String&, DJVU::GUTF8String&) const /src/djvu/libdjvu/DjVuMessageLite.cpp:329:24
    #6 0x7f339fca8219 in DJVU::DjVuMessageLite::LookUpSingle(DJVU::GUTF8String const&) const /src/djvu/libdjvu/DjVuMessageLite.cpp:245:3
    #7 0x7f339fca74f2 in DJVU::DjVuMessageLite::LookUp(DJVU::GUTF8String const&) const /src/djvu/libdjvu/DjVuMessageLite.cpp:217:17
    #8 0x7f339fefec66 in DJVU::DjVuMessageLite::LookUpUTF8(DJVU::GUTF8String const&) /src/djvu/libdjvu/./DjVuMessageLite.h:179:12
    #9 0x7f339fefec66 in msg_prep_error(DJVU::GUTF8String, char const*, char const*, int) /src/djvu/libdjvu/ddjvuapi.cpp:455
    #10 0x7f339ff05114 in DJVU::ddjvu_document_s::notify_error(DJVU::DjVuPort const*, DJVU::GUTF8String const&) /src/djvu/libdjvu/ddjvuapi.cpp:823:38
    #11 0x7f339fcd43dd in DJVU::DjVuPortcaster::notify_error(DJVU::DjVuPort const*, DJVU::GUTF8String const&) /src/djvu/libdjvu/DjVuPort.cpp:535:10
    #12 0x7f339fbd794d in DJVU::DjVuDocument::static_init_thread(void*) /src/djvu/libdjvu/DjVuDocument.cpp:299:9
    #13 0x7f339fdfe4fc in DJVU::GThread::start(void*) /src/djvu/libdjvu/GThreads.cpp:392:11
    #14 0x7f339f5c26b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
    #15 0x7f339e64b41c in clone /build/glibc-LK5gWL/glibc-2.23/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:109

0x606000006038 is located 24 bytes inside of 64-byte region [0x606000006020,0x606000006060)
freed by thread T0 here:
    #0 0x4ec3a0 in operator delete(void*) (/src/aflbuild/installed/bin/ddjvu+0x4ec3a0)
    #1 0x7f339fd4a6b1 in DJVU::GSetBase::empty() /src/djvu/libdjvu/GContainer.cpp:796:7
    #2 0x7f339fd4a6b1 in DJVU::GSetBase::~GSetBase() /src/djvu/libdjvu/GContainer.cpp:656

previously allocated by thread T0 here:
    #0 0x4ebda0 in operator new(unsigned long) (/src/aflbuild/installed/bin/ddjvu+0x4ebda0)
    #1 0x7f339fb5fc04 in DJVU::GMapImpl<DJVU::GUTF8String, DJVU::GUTF8String>::get_or_create(DJVU::GUTF8String const&) /src/djvu/libdjvu/./GContainer.h:1208:23

Thread T1 created by T0 here:
    #0 0x42cbe9 in pthread_create (/src/aflbuild/installed/bin/ddjvu+0x42cbe9)
    #1 0x7f339fdfec0a in DJVU::GThread::create(void (*)(void*), void*) /src/djvu/libdjvu/GThreads.cpp:440:13
    #2 0x7f339fbd56a4 in DJVU::DjVuDocument::start_init(DJVU::GURL const&, DJVU::GP<DJVU::DjVuPort>, DJVU::DjVuFileCache*) /src/djvu/libdjvu/DjVuDocument.cpp:208:4
    #3 0x7f339ff0d492 in ddjvu_document_create_by_filename_imp(DJVU::ddjvu_context_s*, char const*, int, int) /src/djvu/libdjvu/ddjvuapi.cpp:1027:7
    #4 0x4f6c47 in main /src/djvu/tools/ddjvu.cpp:1205:16

SUMMARY: AddressSanitizer: heap-use-after-free /src/djvu/libdjvu/./GContainer.h:1143:12 in DJVU::GSetImpl<DJVU::GUTF8String>::get(DJVU::GUTF8String const&) const
Shadow bytes around the buggy address:
  0x0c0c7fff8bb0: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd
  0x0c0c7fff8bc0: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c0c7fff8bd0: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
  0x0c0c7fff8be0: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
  0x0c0c7fff8bf0: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c0c7fff8c00: fa fa fa fa fd fd fd[fd]fd fd fd fd fa fa fa fa
  0x0c0c7fff8c10: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd
  0x0c0c7fff8c20: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c0c7fff8c30: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
  0x0c0c7fff8c40: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd
  0x0c0c7fff8c50: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==22443==ABORTING

others

from fuzz project pwd-djvu-ddjvu-00
crash name pwd-djvu-ddjvu-00-00000019-20191003.djvu
Auto-generated by pyspider at 2019-10-03 12:39:41

please send email to  teamseri0us360@gmail.com if you have any questions.
1 Attachments
DJVU__GSetImpl@GContainer.h_1143-12___heap-use-after-free

Discussion

Log in to post a comment.