#330 Integer overflow in function `render` in `tools/ddjvu` when input craft djvu file

[chen ivan]

To Reproduce

./ddjvu ./poc.djvu

Debug Info

# ./ddjvu ./poc.djvu
=================================================================
==25519==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7ffff206583e at pc 0x000000437a6e bp 0x7fffffffe0f0 sp 0x7fffffffd8b8
READ of size 117023 at 0x7ffff206583e thread T0
    #0 0x437a6d in fwrite /local/mnt/workspace/tmp/final/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1141:16
    #1 0x4ce10a in render(ddjvu_page_s*, int) /src/djvulibre-ddjvu/tools/ddjvu.cpp:435:15
    #2 0x4d3743 in dopage(int) /src/djvulibre-ddjvu/tools/ddjvu.cpp:759:3
    #3 0x4d4717 in parse_pagespec(char const*, int, void (*)(int)) /src/djvulibre-ddjvu/tools/ddjvu.cpp:825:11
    #4 0x4df19b in main /src/djvulibre-ddjvu/tools/ddjvu.cpp:1214:3
    #5 0x7ffff651a83f in __libc_start_main /build/glibc-e6zv40/glibc-2.23/csu/../csu/libc-start.c:291
    #6 0x41eff8 in _start (/mnt/disk/out/djvulibre-ddjvu/ddjvu_asan+0x41eff8)

0x7ffff206583e is located 0 bytes to the right of 213659710-byte region [0x7fffe54a2800,0x7ffff206583e)
allocated by thread T0 here:
    #0 0x498e4d in malloc /local/mnt/workspace/tmp/final/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3
    #1 0x4cd9d7 in render(ddjvu_page_s*, int) /src/djvulibre-ddjvu/tools/ddjvu.cpp:397:25
    #2 0x4d3743 in dopage(int) /src/djvulibre-ddjvu/tools/ddjvu.cpp:759:3
    #3 0x4d4717 in parse_pagespec(char const*, int, void (*)(int)) /src/djvulibre-ddjvu/tools/ddjvu.cpp:825:11
    #4 0x4df19b in main /src/djvulibre-ddjvu/tools/ddjvu.cpp:1214:3
    #5 0x7ffff651a83f in __libc_start_main /build/glibc-e6zv40/glibc-2.23/csu/../csu/libc-start.c:291

SUMMARY: AddressSanitizer: heap-buffer-overflow /local/mnt/workspace/tmp/final/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1141:16 in fwrite
Shadow bytes around the buggy address:
  0x10007e404ab0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007e404ac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007e404ad0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007e404ae0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007e404af0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10007e404b00: 00 00 00 00 00 00 00[06]fa fa fa fa fa fa fa fa
  0x10007e404b10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x10007e404b20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x10007e404b30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x10007e404b40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x10007e404b50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==25519==ABORTING

rowsize * rrect.h will cause integer overflow：

[----------------------------------registers-----------------------------------]
RAX: 0x7ffff7f93000 --> 0x0
RBX: 0x3e36d
RCX: 0x14bcf
RDX: 0x1d2
RSI: 0x1
RDI: 0xcbc303e
^^^^^^^^^^^^^^
RBP: 0x7fffffffe320 --> 0x7fffffffe360 --> 0x7fffffffe3d0 --> 0x7fffffffe420 --> 0x6d9620 (<__libc_csu_init>:   push   r15)
RSP: 0x7fffffffe240 --> 0x1
RIP: 0x42ac55 (<_Z6renderP12ddjvu_page_si+4885>:        call   0x4061a0 <malloc@plt>)
R8 : 0x7ffff68bebc8 --> 0x7ffff68bebb8 --> 0x12c0b70 --> 0x6245e0 (<_ZN4DJVU6DArrayINS_11GUTF8StringEE6insertEPviiPKvi>:        push   rbp)
R9 : 0x0
R10: 0x7ffff68beb78 --> 0x12c6280 --> 0x120ffffff
R11: 0x7ffff68beb78 --> 0x12c6280 --> 0x120ffffff
R12: 0xffff
R13: 0x0
R14: 0xff
R15: 0x1
EFLAGS: 0xa03 (CARRY parity adjust zero sign trap INTERRUPT direction OVERFLOW)
[-------------------------------------code-------------------------------------]
   0x42ac4c <_Z6renderP12ddjvu_page_si+4876>:   mov    r14b,0xff
   0x42ac4f <_Z6renderP12ddjvu_page_si+4879>:   mov    edi,DWORD PTR [rbp-0x64]
   0x42ac52 <_Z6renderP12ddjvu_page_si+4882>:   imul   edi,ebx
=> 0x42ac55 <_Z6renderP12ddjvu_page_si+4885>:   call   0x4061a0 <malloc@plt>
   0x42ac5a <_Z6renderP12ddjvu_page_si+4890>:   test   rax,rax
   0x42ac5d <_Z6renderP12ddjvu_page_si+4893>:   je     0x42e99c <_Z6renderP12ddjvu_page_si+20572>
   0x42ac63 <_Z6renderP12ddjvu_page_si+4899>:   mov    r12,rax
   0x42ac66 <_Z6renderP12ddjvu_page_si+4902>:   call   0x428f10 <_Z5ticksv>
Guessed arguments:
arg[0]: 0xcbc303e
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffe240 --> 0x1
0008| 0x7fffffffe248 --> 0x7fffffffe7d9 ("test.djvu")
0016| 0x7fffffffe250 --> 0x40efffe000000000
0024| 0x7fffffffe258 --> 0x3fe8a3de6ea1296b
0032| 0x7fffffffe260 --> 0x12c5310 --> 0x1
0040| 0x7fffffffe268 --> 0x0
0048| 0x7fffffffe270 --> 0x12c2730 --> 0x6e57d8 --> 0x4927c0 (<_ZN4DJVU12ddjvu_page_sD2Ev>:     push   rbp)
0056| 0x7fffffffe278 --> 0x0
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
0x000000000042ac55      397       if (! (image = (char*)malloc(rowsize * rrect.h)))
gdb-peda$

rrect.h: 0x14c76 rowsize: 0x3e36d
>>> hex(0x14c76*0x3e36d)
'0x50cbc303e'

Environment:

• version : djvulibre master (ee314b880c926e884be77d53ee459d9850c9c7f0)
• OS: Ubuntu 16.04
• clang version: 11

Credit: 1vanChen of NSFOCUS Security Team