malformed png triggers SIGABRT (glibc detected invalid next size (fast))
Advanced PNG optimization program
Status: Beta
Brought to you by:
cosmin
Menu
▾
▴
1 Attachments
#55 malformed png triggers SIGABRT (glibc detected invalid next size (fast))
ptiPNG version "Hg"
Using opnglib version @OPNGLIB_VERSION@
Using opngreduc
Using libpng version 1.4.12
Using zlib version 1.2.7-optipng
Using pnmio version 0.3
Using minitiff version 0.1
Using cexcept version 2.0.1-optipng
While fuzzing this build of optipng with American Fuzzy Lop, I discovered that this malformed png triggers a SIGABRT.
./optipng test09.png
(gdb) r test09.png
Starting program: /home/geeknik/png-tmp/optipng test09.png
Processing: test09.png
** Warning: Error reading BMP file
78x12336 pixels, BMP format
4 bits/pixel, 48 colors in palette
file size = 0 bytes
Reducing:
2 bits/pixel, 4 colors in palette
** Error: The previous warning(s) indicate recoverable errors
** Rerun this program using -fix
*** glibc detected *** /home/geeknik/png-tmp/optipng: free(): invalid next size (fast): 0x0000000000791070 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x75be6)[0x7ffff7845be6]
/lib/x86_64-linux-gnu/libc.so.6(cfree+0x6c)[0x7ffff784a98c]
/home/geeknik/png-tmp/optipng[0x427abe]
/home/geeknik/png-tmp/optipng[0x414d61]
/home/geeknik/png-tmp/optipng[0x402d8c]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xfd)[0x7ffff77eeead]
/home/geeknik/png-tmp/optipng[0x40c13d]
======= Memory map: ========
00400000-004d0000 r-xp 00000000 fe:00 1351596 /home/geeknik/png-tmp/optipng
006d0000-006d1000 rw-p 000d0000 fe:00 1351596 /home/geeknik/png-tmp/optipng
006d1000-007a7000 rw-p 00000000 00:00 0 [heap]
7ffff0000000-7ffff0021000 rw-p 00000000 00:00 0
7ffff0021000-7ffff4000000 ---p 00000000 00:00 0
7ffff75ba000-7ffff75cf000 r-xp 00000000 fe:00 1048580 /lib/x86_64-linux-gnu/libgcc_s.so.1
7ffff75cf000-7ffff77cf000 ---p 00015000 fe:00 1048580 /lib/x86_64-linux-gnu/libgcc_s.so.1
7ffff77cf000-7ffff77d0000 rw-p 00015000 fe:00 1048580 /lib/x86_64-linux-gnu/libgcc_s.so.1
7ffff77d0000-7ffff7951000 r-xp 00000000 fe:00 1169701 /lib/x86_64-linux-gnu/libc-2.13.so
7ffff7951000-7ffff7b51000 ---p 00181000 fe:00 1169701 /lib/x86_64-linux-gnu/libc-2.13.so
7ffff7b51000-7ffff7b55000 r--p 00181000 fe:00 1169701 /lib/x86_64-linux-gnu/libc-2.13.so
7ffff7b55000-7ffff7b56000 rw-p 00185000 fe:00 1169701 /lib/x86_64-linux-gnu/libc-2.13.so
7ffff7b56000-7ffff7b5b000 rw-p 00000000 00:00 0
7ffff7b5b000-7ffff7bdc000 r-xp 00000000 fe:00 1169695 /lib/x86_64-linux-gnu/libm-2.13.so
7ffff7bdc000-7ffff7ddb000 ---p 00081000 fe:00 1169695 /lib/x86_64-linux-gnu/libm-2.13.so
7ffff7ddb000-7ffff7ddc000 r--p 00080000 fe:00 1169695 /lib/x86_64-linux-gnu/libm-2.13.so
7ffff7ddc000-7ffff7ddd000 rw-p 00081000 fe:00 1169695 /lib/x86_64-linux-gnu/libm-2.13.so
7ffff7ddd000-7ffff7dfd000 r-xp 00000000 fe:00 1169713 /lib/x86_64-linux-gnu/ld-2.13.so
7ffff7fdd000-7ffff7fe0000 rw-p 00000000 00:00 0
7ffff7ff8000-7ffff7ffb000 rw-p 00000000 00:00 0
7ffff7ffb000-7ffff7ffc000 r-xp 00000000 00:00 0 [vdso]
7ffff7ffc000-7ffff7ffd000 r--p 0001f000 fe:00 1169713 /lib/x86_64-linux-gnu/ld-2.13.so
7ffff7ffd000-7ffff7ffe000 rw-p 00020000 fe:00 1169713 /lib/x86_64-linux-gnu/ld-2.13.so
7ffff7ffe000-7ffff7fff000 rw-p 00000000 00:00 0
7ffffffde000-7ffffffff000 rw-p 00000000 00:00 0 [stack]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]
Program received signal SIGABRT, Aborted.
0x00007ffff7802165 in *__GI_raise (sig=<optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
==12215== Command: /home/geeknik/png-tmp/optipng test09.png
==12215==
Processing: test09.png
==12215== Invalid write of size 1
==12215== at 0x4479B1: ??? (in /home/geeknik/png-tmp/optipng)
==12215== by 0x44B1CB: ??? (in /home/geeknik/png-tmp/optipng)
==12215== by 0x44693D: ??? (in /home/geeknik/png-tmp/optipng)
==12215== by 0x424D39: ??? (in /home/geeknik/png-tmp/optipng)
==12215== by 0x411C03: ??? (in /home/geeknik/png-tmp/optipng)
==12215== by 0x402D8B: ??? (in /home/geeknik/png-tmp/optipng)
==12215== by 0x50D2EAC: (below main) (libc-start.c:244)
==12215== Address 0x55afe58 is 0 bytes after a block of size 40 alloc'd
==12215== at 0x4C26B3F: malloc (vg_replace_malloc.c:299)
==12215== by 0x45D509: ??? (in /home/geeknik/png-tmp/optipng)
==12215== by 0x45A73A: ??? (in /home/geeknik/png-tmp/optipng)
==12215== by 0x449B7C: ??? (in /home/geeknik/png-tmp/optipng)
==12215== by 0x44693D: ??? (in /home/geeknik/png-tmp/optipng)
==12215== by 0x424D39: ??? (in /home/geeknik/png-tmp/optipng)
==12215== by 0x411C03: ??? (in /home/geeknik/png-tmp/optipng)
==12215== by 0x402D8B: ??? (in /home/geeknik/png-tmp/optipng)
==12215== by 0x50D2EAC: (below main) (libc-start.c:244)
==12215==
** Warning: Error reading BMP file
78x12336 pixels, BMP format
4 bits/pixel, 48 colors in palette
file size = 0 bytes
Reducing:
2 bits/pixel, 4 colors in palette
** Error: The previous warning(s) indicate recoverable errors
** Rerun this program using -fix
Status report:
1 file(s) have been processed.
1 erroneous file(s) have been encountered.
==12215==
==12215== HEAP SUMMARY:
==12215== in use at exit: 0 bytes in 0 blocks
==12215== total heap usage: 12,347 allocs, 12,347 frees, 623,032 bytes allocated
==12215==
==12215== All heap blocks were freed -- no leaks are possible
==12215==
==12215== For counts of detected and suppressed errors, rerun with: -v
==12215== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 2 from 2)
Thanks. I am marking this as security-sensitive. This is the same issue as in bug 57, and I will make a new release, sometime this week, possibly later today.
If it is possible for me to have your real name, I would like to give you credit as a co-discoverer.
Fixed in version 0.7.6.