#344 Divide By Zero in djvulibre-3.5.28/libdjvu/IW44EncodeCodec.cpp

[ZFeiXQ]

Command：c44 POC
Result：
gdb information：floating point exception
Program received signal SIGFPE, Arithmetic exception.
0x00005555555afe13 in DJVU::IWBitmap::Encode::init (this=0x5555555fb1f0, bm=..., gmask=...) at IW44EncodeCodec.cpp:1431
1431 bconv[i] = max(0,min(255,i*255/g)) - 128;
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
──────────────────────────────────────────────────────────────────────────────────────────────────[ REGISTERS ]──────────────────────────────────────────────────────────────────────────────────────────────────
RAX 0x0
RBX 0x0
RCX 0x0
RDX 0x0
RDI 0x0
RSI 0x7fffffffdfc0 ◂— 0x0
R8 0xff
R9 0x0
R10 0x1
R11 0x246
R12 0x0
R13 0x7fffffffe110 ◂— 0x0
R14 0x0
R15 0x18
RBP 0x5555555fb2f0 —▸ 0x5555555e1ab8 —▸ 0x55555557aa50 (DJVU::GBitmap::~GBitmap()) ◂— endbr64
RSP 0x7fffffffdf70 —▸ 0x7fffffffe170 —▸ 0x5555555faf50 —▸ 0x5555555e1880 —▸ 0x55555556f0e0 (DJVU::MemoryMapByteStream::~MemoryMapByteStream()) ◂— ...
RIP 0x5555555afe13 ◂— idiv r14d
───────────────────────────────────────────────────────────────────────────────────────────────────[ DISASM ]────────────────────────────────────────────────────────────────────────────────────────────────────
► 0x5555555afe13 idiv r14d
↓
0x5555555afe13 idiv r14d

────────────────────────────────────────────────────────────────────────────────────────────────[ SOURCE (CODE) ]────────────────────────────────────────────────────────────────────────────────────────────────
In file: /home/zxq/CVE_testing/source/djvulibre-3.5.28/libdjvu/IW44EncodeCodec.cpp
1426 signed char buffer;
1427 GPBuffer<signed char=""> gbuffer(buffer,w</signed>h);
1428 // Prepare gray level conversion table
1429 signed char bconv[256];
1430 for (i=0; i<256; i++)
► 1431 bconv[i] = max(0,min(255,i255/g)) - 128;
1432 // Perform decomposition
1433 // Prepare mask information
1434 const signed char msk8 = 0;
1435 int mskrowsize = 0;
1436 GBitmap *mask=gmask;
────────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]────────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsp 0x7fffffffdf70 —▸ 0x7fffffffe170 —▸ 0x5555555faf50 —▸ 0x5555555e1880 —▸ 0x55555556f0e0 (DJVU::MemoryMapByteStream::~MemoryMapByteStream()) ◂— ...
01:0008│ 0x7fffffffdf78 ◂— 0x2f8559fd8e9bfc00
02:0010│ 0x7fffffffdf80 —▸ 0x5555555fb1f0 —▸ 0x5555555e25b8 —▸ 0x5555555afb40 (DJVU::IWBitmap::Encode::~Encode()) ◂— endbr64
03:0018│ 0x7fffffffdf88 ◂— 0x0
04:0020│ 0x7fffffffdf90 —▸ 0x7fffffffdfb0 —▸ 0x7fffffffdfa8 ◂— 0x0
05:0028│ 0x7fffffffdf98 —▸ 0x7fffffffe050 —▸ 0x5555555e1b00 (DJVU::GCont::TrivTraits<1>::traits()::theTraits) ◂— 0x1
06:0030│ 0x7fffffffdfa0 —▸ 0x55555557f820 ◂— endbr64
07:0038│ 0x7fffffffdfa8 ◂— 0x0
──────────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]──────────────────────────────────────────────────────────────────────────────────────────────────
► f 0 0x5555555afe13
f 1 0x5555555b00a4
f 2 0x55555556ba02 main+1986
f 3 0x7ffff79f00b3 __libc_start_main+243
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> pg
Undefined command: "pg". Try "help".
pwndbg> p g
$1 = 0

[Petr Gajdos]

CVE-2021-46312

[Petr Gajdos]

We could do similar check as in IW44Image.cpp (see bug #345):

Index: djvulibre-3.5.28/libdjvu/IW44EncodeCodec.cpp
===================================================================
--- djvulibre-3.5.28.orig/libdjvu/IW44EncodeCodec.cpp
+++ djvulibre-3.5.28/libdjvu/IW44EncodeCodec.cpp
@@ -1424,7 +1424,12 @@ IWBitmap::Encode::init(const GBitmap &bm
   int h = bm.rows();
   int g = bm.get_grays()-1;
   signed char *buffer;

-  GPBuffer<signed char> gbuffer(buffer,w*h);
+  size_t sz = w * h;
+  if (sz == 0 || g <= 0) // w or h is zero or g is not positive
+    G_THROW("IWBitmap: zero size image (corrupted file?)");
+  if (sz / (size_t)w != (size_t)h) // multiplication overflow
+    G_THROW("IWBitmap: image size exceeds maximum (corrupted file?)");
+  GPBuffer<signed char> gbuffer(buffer,sz);
   // Prepare gray level conversion table
   signed char  bconv[256];
   for (i=0; i<256; i++)