ITADN

Improper validation of IPC Gfx::BitmapSequence decode requests

#10036Openrdevshp 创建于 2026-06-10
bughas reprocrash
R
rdevshpcommented
The repro produces a SIGSEGV: ``` decoding single-frame BitmapSequence decoded bitmap: buffer bytes 4096, bitmap bytes 2000000, decoded size 50000x10 touching last pixel from decoded IPC size AddressSanitizer:DEADLYSIGNAL ================================================================= ==886953==ERROR: AddressSanitizer: SEGV on unknown address 0x7f80d388547c (pc 0x55be20731d24 bp 0x7ffdb5fabac0 sp 0x7ffdb5faa820 T0) ==886953==The signal is caused by a WRITE memory access. #0 0x55be20731d24 in main /home/user/software_ws/findings/issues/ladybird/issues/016-2026-06-09-bitmapsequence-ipc-decode-accepts-undersized-shared-bitmap-backing-store/ipc_repro.cpp:76 #1 0x7f80cde35ca7 (/lib/x86_64-linux-gnu/libc.so.6+0x29ca7) (BuildId: c495b62edadd6c356265942ec1282d98058a7b41) #2 0x7f80cde35d64 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29d64) (BuildId: c495b62edadd6c356265942ec1282d98058a7b41) #3 0x55be2072e3d0 in _start (/home/user/software_ws/findings/issues/ladybird/issues/016-2026-06-09-bitmapsequence-ipc-decode-accepts-undersized-shared-bitmap-backing-store/bitmap_sequence_ipc_repro+0x2e3d0) (BuildId: 3752afe5439a3dabc1dc2cfa22228053f1df9ab2) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /home/user/software_ws/findings/issues/ladybird/issues/016-2026-06-09-bitmapsequence-ipc-decode-accepts-undersized-shared-bitmap-backing-store/ipc_repro.cpp:76 in main ==886953==ABORTING ``` [ipc_repro.cpp](https://github.com/user-attachments/files/28800065/ipc_repro.cpp) [compile_repro.sh](https://github.com/user-attachments/files/28800064/compile_repro.sh)
0 条评论