Package: dcraw Version: 9.27-1+b1 Severity: normal A stack-based buffer overflow bug exists in dcraw.
Running the attached poc file raises a stack-based buffer overflow error, which may allow a control flow hijack attack. Following gdb log shows the program resulting in segfault. jason@debian-amd64-stretch:~/report/debian-latest/dcraw$ gdb dcraw -q Reading symbols from dcraw...(no debugging symbols found)...done. (gdb) run poc_ovf Starting program: /usr/bin/dcraw poc_ovf [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Program received signal SIGSEGV, Segmentation fault. strlen () at ../sysdeps/x86_64/strlen.S:137 137 ../sysdeps/x86_64/strlen.S: No such file or directory. (gdb) bt 10 #0 strlen () at ../sysdeps/x86_64/strlen.S:137 #1 0x00007ffff72dfa84 in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7ffff73d3305 "*** %s ***: %s terminated\n") at ../sysdeps/posix/libc_fatal.c:109 #2 0x00007ffff73681f7 in __GI___fortify_fail (msg=msg@entry=0x7ffff73d32ed "stack smashing detected") at fortify_fail.c:30 #3 0x00007ffff73681c0 in __stack_chk_fail () at stack_chk_fail.c:28 #4 0x000055555557ea4e in ?? () #5 0xffffffffffffffff in ?? () #6 0xffffffffffffffff in ?? () #7 0xffffffffffffffff in ?? () #8 0xffffffffffffffff in ?? () #9 0xffffffffffffffff in ?? () (More stack frames follow...) Address sanitizer reports stack-buffer-overflow error in find_green() function as follow. jason@debian-amd64-stretch:~/report/source-latest/dcraw$ ./dcraw-9.27/dcraw poc_ovf ================================================================= ==5868==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fffffffc720 at pc 0x000000595ece bp 0x7fffffffa6b0 sp 0x7fffffffa6a8 WRITE of size 2 at 0x7fffffffc720 thread T0 #0 0x595ecd in find_green /home/jason/report/source-latest/dcraw/dcraw-9.27/dcraw.c:8147:19 #1 0x59e77b in identify /home/jason/report/source-latest/dcraw/dcraw-9.27/dcraw.c:8716:5 #2 0x5b94f9 in main /home/jason/report/source-latest/dcraw/dcraw-9.27/dcraw.c:10007:15 #3 0x7ffff6a4f2e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0) #4 0x41c049 in _start (/home/jason/report/source-latest/dcraw/dcraw-9.27/dcraw+0x41c049) Address 0x7fffffffc720 is located in stack of thread T0 at offset 8288 in frame #0 0x595a6f in find_green /home/jason/report/source-latest/dcraw/dcraw-9.27/dcraw.c:8133 This frame has 2 object(s): [32, 8288) 'img' <== Memory access at offset 8288 overflows this variable [8544, 8560) 'sum' HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext (longjmp and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow /home/jason/report/source-latest/dcraw/dcraw-9.27/dcraw.c:8147:19 in find_green Shadow bytes around the buggy address: 0x10007fff7890: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10007fff78a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10007fff78b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10007fff78c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10007fff78d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x10007fff78e0: 00 00 00 00[f2]f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 0x10007fff78f0: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 0x10007fff7900: f2 f2 f2 f2 00 00 f3 f3 00 00 00 00 00 00 00 00 0x10007fff7910: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10007fff7920: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10007fff7930: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): -- System Information: Debian Release: 9.1 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 4.9.0-3-amd64 (SMP w/1 CPU core) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages dcraw depends on: ii libc6 2.24-11+deb9u3 ii libjpeg62-turbo 1:1.5.1-2 ii liblcms2-2 2.8-4 dcraw recommends no packages. Versions of packages dcraw suggests: pn gphoto2 <none> ii netpbm 2:10.0-15.3+b2 -- no debconf information
poc_ovf
Description: Binary data