Heap-buffer-overflow while running jhead(v3.03, v3.04). I can not confirm if this bug is needed to patch. Deatil log as follow: (POC in attachment)
lbb@lbb .jhead/jhead ./input/id_m075
Nonfatal Error : './input/id_m075' Suspicious offset of first Exif IFD value
Nonfatal Error : './input/id_m075' Illegally sized Exif subdirectory (60138 entries)
Nonfatal Error : './input/id_m075' Extraneous 11 padding bytes before section 03
Nonfatal Error : './input/id_m075' Extraneous 10 padding bytes before section DB
Nonfatal Error : './input/id_m075' Extraneous 12 padding bytes before section 03
Nonfatal Error : './input/id_m075' Extraneous 164 padding bytes before section C4
Nonfatal Error : './input/id_m075' Extraneous 10 padding bytes before section EA
Nonfatal Error : './input/id_m075' Extraneous 10 padding bytes before section 03
Nonfatal Error : './input/id_m075' Extraneous 11 padding bytes before section 03
Nonfatal Error : './input/id_m075' Extraneous 10 padding bytes before section DB
=================================================================
==19742==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60700000ddc3 at pc 0x0000004e5c14 bp 0x7fff938f6490 sp 0x7fff938f6488
READ of size 1 at 0x60700000ddc3 thread T0
#0 0x4e5c13 in process_DQT /home/lbb/afl-experient/Tests/ASAN/jhead-3.04/jpgqguess.c:109:38
#1 0x4e2d9c in ReadJpegSections /home/lbb/afl-experient/Tests/ASAN/jhead-3.04/jpgfile.c:223:17
#2 0x4e39c7 in ReadJpegFile /home/lbb/afl-experient/Tests/ASAN/jhead-3.04/jpgfile.c:379:11
#3 0x4dea31 in ProcessFile /home/lbb/afl-experient/Tests/ASAN/jhead-3.04/jhead.c:905:10
#4 0x4dea31 in main /home/lbb/afl-experient/Tests/ASAN/jhead-3.04/jhead.c:1756
#5 0x7f3ea4c5f82f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/../csu/libc-start.c:291
#6 0x435e48 in _start (/home/lbb/afl-experient/Tests/ASAN/jhead-3.04/jhead+0x435e48)
0x60700000ddc3 is located 0 bytes to the right of 67-byte region [0x60700000dd80,0x60700000ddc3)
allocated by thread T0 here:
#0 0x4bcdf2 in __interceptor_malloc (/home/lbb/afl-experient/Tests/ASAN/jhead-3.04/jhead+0x4bcdf2)
#1 0x4e291c in ReadJpegSections /home/lbb/afl-experient/Tests/ASAN/jhead-3.04/jpgfile.c:173:25
#2 0x4e39c7 in ReadJpegFile /home/lbb/afl-experient/Tests/ASAN/jhead-3.04/jpgfile.c:379:11
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/lbb/afl-experient/Tests/ASAN/jhead-3.04/jpgqguess.c:109 process_DQT
Shadow bytes around the buggy address:
0x0c0e7fff9b60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0e7fff9b70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0e7fff9b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0e7fff9b90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0e7fff9ba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c0e7fff9bb0: 00 00 00 00 00 00 00 00[03]fa fa fa fa fa 00 00
0x0c0e7fff9bc0: 00 00 00 00 00 00 03 fa fa fa fa fa 00 00 00 00
0x0c0e7fff9bd0: 00 00 00 00 03 fa fa fa fa fa 00 00 00 00 00 00
0x0c0e7fff9be0: 00 00 03 fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c0e7fff9bf0: 03 fa fa fa fa fa fd fd fd fd fd fd fd fd fd fd
0x0c0e7fff9c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==19742==ABORTING
Heap-buffer- overflow while running jhead(v3.03, v3.04). I can not confirm if this bug is needed to patch. Deatil log as follow: (POC in attachment)
lbb@lbb .jhead/jhead ./input/id_m075
Nonfatal Error : './input/id_m075' Suspicious offset of first Exif IFD value ======= ======= ======= ======= ======= ======= ======= ======= == overflow on address 0x60700000ddc3 at pc 0x0000004e5c14 bp 0x7fff938f6490 sp 0x7fff938f6488 afl-experient/ Tests/ASAN/ jhead-3. 04/jpgqguess. c:109:38 afl-experient/ Tests/ASAN/ jhead-3. 04/jpgfile. c:223:17 afl-experient/ Tests/ASAN/ jhead-3. 04/jpgfile. c:379:11 afl-experient/ Tests/ASAN/ jhead-3. 04/jhead. c:905:10 afl-experient/ Tests/ASAN/ jhead-3. 04/jhead. c:1756 glibc-LK5gWL/ glibc-2. 23/csu/ ../csu/ libc-start. c:291 lbb/afl- experient/ Tests/ASAN/ jhead-3. 04/jhead+ 0x435e48)
Nonfatal Error : './input/id_m075' Illegally sized Exif subdirectory (60138 entries)
Nonfatal Error : './input/id_m075' Extraneous 11 padding bytes before section 03
Nonfatal Error : './input/id_m075' Extraneous 10 padding bytes before section DB
Nonfatal Error : './input/id_m075' Extraneous 12 padding bytes before section 03
Nonfatal Error : './input/id_m075' Extraneous 164 padding bytes before section C4
Nonfatal Error : './input/id_m075' Extraneous 10 padding bytes before section EA
Nonfatal Error : './input/id_m075' Extraneous 10 padding bytes before section 03
Nonfatal Error : './input/id_m075' Extraneous 11 padding bytes before section 03
Nonfatal Error : './input/id_m075' Extraneous 10 padding bytes before section DB
=======
==19742==ERROR: AddressSanitizer: heap-buffer-
READ of size 1 at 0x60700000ddc3 thread T0
#0 0x4e5c13 in process_DQT /home/lbb/
#1 0x4e2d9c in ReadJpegSections /home/lbb/
#2 0x4e39c7 in ReadJpegFile /home/lbb/
#3 0x4dea31 in ProcessFile /home/lbb/
#4 0x4dea31 in main /home/lbb/
#5 0x7f3ea4c5f82f in __libc_start_main /build/
#6 0x435e48 in _start (/home/
0x60700000ddc3 is located 0 bytes to the right of 67-byte region [0x60700000dd80 ,0x60700000ddc3 ) malloc (/home/ lbb/afl- experient/ Tests/ASAN/ jhead-3. 04/jhead+ 0x4bcdf2) afl-experient/ Tests/ASAN/ jhead-3. 04/jpgfile. c:173:25 afl-experient/ Tests/ASAN/ jhead-3. 04/jpgfile. c:379:11
allocated by thread T0 here:
#0 0x4bcdf2 in __interceptor_
#1 0x4e291c in ReadJpegSections /home/lbb/
#2 0x4e39c7 in ReadJpegFile /home/lbb/
SUMMARY: AddressSanitizer: heap-buffer- overflow /home/lbb/ afl-experient/ Tests/ASAN/ jhead-3. 04/jpgqguess. c:109 process_DQT
Shadow bytes around the buggy address:
0x0c0e7fff9b60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0e7fff9b70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0e7fff9b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0e7fff9b90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0e7fff9ba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c0e7fff9bb0: 00 00 00 00 00 00 00 00[03]fa fa fa fa fa 00 00
0x0c0e7fff9bc0: 00 00 00 00 00 00 03 fa fa fa fa fa 00 00 00 00
0x0c0e7fff9bd0: 00 00 00 00 03 fa fa fa fa fa 00 00 00 00 00 00
0x0c0e7fff9be0: 00 00 03 fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c0e7fff9bf0: 03 fa fa fa fa fa fd fd fd fd fd fd fd fd fd fd
0x0c0e7fff9c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==19742==ABORTING