Package: libexempi3 Version: 2.2.1-2 Usertags: afl Exempi crashes on the attached file:
$ exempi -x crash.jpeg processing file crash.jpeg dump_xmp for file crash.jpeg Segmentation fault Valgrind says it's an out-of-bounds read: ==9295== Invalid read of size 1 ==9295== at 0x412BA47: TIFF_Manager::DecodeString(void const*, unsigned int, std::string*) const (TIFF_Support.cpp:312) ==9295== by 0x411E551: ??? (ReconcileTIFF.cpp:1352) ==9295== by 0x41207C3: PhotoDataUtils::Import2WayExif(TIFF_Manager const&, TXMPMeta<std::string>*, int) (ReconcileTIFF.cpp:2027) ==9295== by 0x411D72E: ImportPhotoData(TIFF_Manager const&, IPTC_Manager const&, PSIR_Manager const&, int, TXMPMeta<std::string>*, unsigned int) (ReconcileLegacy.cpp:77) ==9295== by 0x40D5A96: JPEG_MetaHandler::ProcessXMP() (JPEG_Handler.cpp:694) ==9295== by 0x40C7640: XMPFiles::GetXMP(TXMPMeta<std::string>*, char const**, unsigned int*, XMP_PacketInfo*) (XMPFiles.cpp:1370) ==9295== by 0x40C3F5F: WXMPFiles_GetXMP_1 (WXMPFiles.cpp:238) ==9295== by 0x407F5EB: TXMPFiles<std::string>::GetXMP(TXMPMeta<std::string>*, std::string*, XMP_PacketInfo*) (TXMPFiles.incl_cpp:295) ==9295== by 0x407A5AE: xmp_files_get_new_xmp (exempi.cpp:322) ==9295== by 0x8049EA5: get_xmp_from_file(char const*, bool, bool) (main.cpp:239) ==9295== by 0x8049583: dump_xmp (main.cpp:251) ==9295== by 0x8049583: process_file (main.cpp:337) ==9295== by 0x8049583: main (main.cpp:191) ==9295== Address 0x4864efc is 3,137,596 bytes inside an unallocated block of size 4,100,392 in arena "client" This bug was found using American fuzzy lop: http://lcamtuf.coredump.cx/afl/ -- System Information: Debian Release: stretch/sid APT prefers unstable APT policy: (990, 'unstable'), (500, 'experimental') Architecture: i386 (x86_64) Foreign Architectures: amd64 Kernel: Linux 3.2.0-4-amd64 (SMP w/2 CPU cores) Locale: LANG=C, LC_CTYPE=pl_PL.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: sysvinit (via /sbin/init) Versions of packages libexempi3 depends on: ii libc6 2.19-18 ii libexpat1 2.1.0-6+b3 ii libgcc1 1:5.1.1-4 ii libstdc++6 5.1.1-4 ii multiarch-support 2.19-18 ii zlib1g 1:1.2.8.dfsg-2+b1 -- Jakub Wilk -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
