ASan heap-buffer-overflow in Gfx::Detail::ExifOrientedBitmap<Gfx::Bitmap>::set_pixel<unsigned int>(unsigned int, unsigned int, unsigned int)
bughas reprocrashhas backtrace
The following repro produces an ASan heap buffer overflow crash on Linux:
```
<!doctype html>
<meta charset="utf-8">
<img id="probe" alt="" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAMAAAABCAIAAACUgoPjAAAAGmVYSWZJSSoACAAAAAEAEgEDAAEAAAAFAAAAAAAAADnHFsoAAAAQSURBVHicY/jPwMAAwgz/ARD6Av4ErTHaAAAAAElFTkSuQmCC">
<script>
probe.onload = () => console.log("loaded");
probe.onerror = () => console.log("error");
</script>
```
Log:
```
187758.100 ImageDecoder(76658) Pool/0(76823): libpng warning: IDAT: Too much image data
=================================================================
==76658==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50200000309c at pc 0x7f59e0587495 bp 0x7f59cc4de580 sp 0x7f59cc4de578
WRITE of size 4 at 0x50200000309c thread T4
#0 0x7f59e0587494 in void Gfx::Detail::ExifOrientedBitmap<Gfx::Bitmap>::set_pixel<unsigned int>(unsigned int, unsigned int, unsigned int) /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibGfx/ImageFormats/ExifOrientedBitmap.h:39
#1 0x7f59e0587494 in Gfx::PNGLoadingContext::apply_exif_orientation() /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibGfx/ImageFormats/PNGLoader.cpp:263
#2 0x7f59e05af952 in Gfx::PNGLoadingContext::read_all_frames() /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibGfx/ImageFormats/PNGLoader.cpp:71
#3 0x7f59e059dd75 in Gfx::PNGImageDecoderPlugin::create(AK::Span<unsigned char const>) /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibGfx/ImageFormats/PNGLoader.cpp:81
#4 0x7f59e054d7a2 in probe_and_sniff_for_appropriate_plugin /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibGfx/ImageFormats/ImageDecoder.cpp:41
#5 0x7f59e054d7a2 in Gfx::ImageDecoder::try_create_for_raw_bytes(AK::Span<unsigned char const>, AK::Optional<AK::ByteString>) /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibGfx/ImageFormats/ImageDecoder.cpp:69
#6 0x55756aa465de in decode_image_to_details /home/user/software_ws/ladybird_ws/ladybird/Services/ImageDecoder/ConnectionFromClient.cpp:110
#7 0x55756aa465de in operator() /home/user/software_ws/ladybird_ws/ladybird/Services/ImageDecoder/ConnectionFromClient.cpp:186
#8 0x7f59dffb9ab0 in AK::Function<void ()>::operator()() const /home/user/software_ws/ladybird_ws/ladybird/AK/Function.h:147
#9 0x7f59dffb9ab0 in Threading::ThreadPool::worker_thread_func() /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibThreading/ThreadPool.cpp:44
#10 0x7f59dffba4d3 in operator() /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibThreading/ThreadPool.cpp:25
#11 0x7f59dffba4d3 in call /home/user/software_ws/ladybird_ws/ladybird/AK/Function.h:224
#12 0x7f59dffaf6e7 in AK::Function<long ()>::operator()() const /home/user/software_ws/ladybird_ws/ladybird/AK/Function.h:147
#13 0x7f59dffaf6e7 in operator() /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibThreading/Thread.cpp:101
#14 0x7f59e0a5b1d5 in asan_thread_start ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234
#15 0x7f59da69eb7a (/lib/x86_64-linux-gnu/libc.so.6+0x92b7a) (BuildId: c495b62edadd6c356265942ec1282d98058a7b41)
#16 0x7f59da71c7f7 (/lib/x86_64-linux-gnu/libc.so.6+0x1107f7) (BuildId: c495b62edadd6c356265942ec1282d98058a7b41)
0x50200000309c is located 0 bytes after 12-byte region [0x502000003090,0x50200000309c)
allocated by thread T4 here:
#0 0x7f59e0af4610 in calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
#1 0x7f59de69ab19 in kcalloc(unsigned long, unsigned long) /home/user/software_ws/ladybird_ws/ladybird/AK/kmalloc.h:34
#2 0x7f59de69ab19 in Gfx::Bitmap::allocate_backing_store(Gfx::BitmapFormat, Gfx::Size<int>, Gfx::Bitmap::InitializeBackingStore) /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibGfx/Bitmap.cpp:263
#3 0x7f59de6abde1 in Gfx::Bitmap::create(Gfx::BitmapFormat, Gfx::AlphaType, Gfx::Size<int>) /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibGfx/Bitmap.cpp:83
#4 0x7f59de6b4a98 in Gfx::Bitmap::create(Gfx::BitmapFormat, Gfx::Size<int>) /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibGfx/Bitmap.cpp:78
#5 0x7f59e05a4bf2 in _ZN3Gfx6Detail18ExifOrientedBitmapINS_6BitmapEE6createENS_4TIFF11OrientationENS_4SizeIiEENS_12BitmapFormatEQ6SameAsIT_S2_E /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibGfx/ImageFormats/ExifOrientedBitmap.h:24
#6 0x7f59e0584931 in Gfx::PNGLoadingContext::apply_exif_orientation() /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibGfx/ImageFormats/PNGLoader.cpp:258
#7 0x7f59e05af952 in Gfx::PNGLoadingContext::read_all_frames() /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibGfx/ImageFormats/PNGLoader.cpp:71
#8 0x7f59e059dd75 in Gfx::PNGImageDecoderPlugin::create(AK::Span<unsigned char const>) /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibGfx/ImageFormats/PNGLoader.cpp:81
#9 0x7f59e054d7a2 in probe_and_sniff_for_appropriate_plugin /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibGfx/ImageFormats/ImageDecoder.cpp:41
#10 0x7f59e054d7a2 in Gfx::ImageDecoder::try_create_for_raw_bytes(AK::Span<unsigned char const>, AK::Optional<AK::ByteString>) /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibGfx/ImageFormats/ImageDecoder.cpp:69
#11 0x55756aa465de in decode_image_to_details /home/user/software_ws/ladybird_ws/ladybird/Services/ImageDecoder/ConnectionFromClient.cpp:110
#12 0x55756aa465de in operator() /home/user/software_ws/ladybird_ws/ladybird/Services/ImageDecoder/ConnectionFromClient.cpp:186
#13 0x7f59dffb9ab0 in AK::Function<void ()>::operator()() const /home/user/software_ws/ladybird_ws/ladybird/AK/Function.h:147
#14 0x7f59dffb9ab0 in Threading::ThreadPool::worker_thread_func() /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibThreading/ThreadPool.cpp:44
#15 0x7f59dffba4d3 in operator() /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibThreading/ThreadPool.cpp:25
#16 0x7f59dffba4d3 in call /home/user/software_ws/ladybird_ws/ladybird/AK/Function.h:224
#17 0x7f59dffaf6e7 in AK::Function<long ()>::operator()() const /home/user/software_ws/ladybird_ws/ladybird/AK/Function.h:147
#18 0x7f59dffaf6e7 in operator() /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibThreading/Thread.cpp:101
#19 0x7f59e0a5b1d5 in asan_thread_start ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234
Thread T4 created by T0 here:
#0 0x7f59e0aecae1 in pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:245
#1 0x7f59dffae543 in Threading::Thread::start() /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibThreading/Thread.cpp:81
#2 0x7f59dffbb066 in Threading::ThreadPool::ThreadPool() /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibThreading/ThreadPool.cpp:28
#3 0x7f59dffbc940 in Threading::ThreadPool::the() /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibThreading/ThreadPool.cpp:16
#4 0x55756aa39253 in ImageDecoder::ConnectionFromClient::start_decode_image_job(long, Core::AnonymousBuffer, AK::Optional<Gfx::Size<int> >, AK::Optional<AK::ByteString>) /home/user/software_ws/ladybird_ws/ladybird/Services/ImageDecoder/ConnectionFromClient.cpp:184
#5 0x55756aa64d99 in ImageDecoder::ConnectionFromClient::decode_image(Core::AnonymousBuffer, AK::Optional<Gfx::Size<int> >, AK::Optional<AK::ByteString>, long) /home/user/software_ws/ladybird_ws/ladybird/Services/ImageDecoder/ConnectionFromClient.cpp:240
#6 0x55756ab24c47 in ImageDecoderServerStub::handle_decode_image(IPC::Message&) /home/user/software_ws/ladybird_ws/ladybird/Build/sanitizers/Services/ImageDecoder/ImageDecoderServerEndpoint.h:649
#7 0x55756ab264b9 in ImageDecoderServerStub::handle(AK::NonnullOwnPtr<IPC::Message>) /home/user/software_ws/ladybird_ws/ladybird/Build/sanitizers/Services/ImageDecoder/ImageDecoderServerEndpoint.h:625
#8 0x7f59dd7d97d1 in IPC::ConnectionBase::handle_messages() /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibIPC/Connection.cpp:75
#9 0x7f59dd7dfee2 in operator() /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibIPC/Connection.cpp:24
#10 0x7f59dd7dfee2 in call /home/user/software_ws/ladybird_ws/ladybird/AK/Function.h:224
#11 0x7f59dd89af76 in AK::Function<void ()>::operator()() const /home/user/software_ws/ladybird_ws/ladybird/AK/Function.h:147
#12 0x7f59dd89af76 in operator() /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibIPC/TransportSocket.cpp:251
#13 0x7f59dd89af76 in call /home/user/software_ws/ladybird_ws/ladybird/AK/Function.h:224
#14 0x7f59dcd13ce9 in AK::Function<void ()>::operator()() const /home/user/software_ws/ladybird_ws/ladybird/AK/Function.h:147
#15 0x7f59dcd13ce9 in Core::Notifier::event(Core::Event&) /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibCore/Notifier.cpp:63
#16 0x7f59dcd13ce9 in Core::Notifier::event(Core::Event&) /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibCore/Notifier.cpp:59
#17 0x7f59dcd91ab1 in Core::ThreadEventQueue::process() /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibCore/ThreadEventQueue.cpp:122
#18 0x7f59dcde2586 in Core::EventLoopImplementationUnix::pump(Core::EventLoopImplementation::PumpMode) /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibCore/EventLoopImplementationUnix.cpp:349
#19 0x7f59dcde2586 in Core::EventLoopImplementationUnix::exec() /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibCore/EventLoopImplementationUnix.cpp:340
#20 0x55756aa21b65 in ladybird_main(Main::Arguments) /home/user/software_ws/ladybird_ws/ladybird/Services/ImageDecoder/main.cpp:41
#21 0x55756ab29ade in main /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibMain/Main.cpp:50
#22 0x7f59da635ca7 (/lib/x86_64-linux-gnu/libc.so.6+0x29ca7) (BuildId: c495b62edadd6c356265942ec1282d98058a7b41)
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/user/software_ws/ladybird_ws/ladybird/Libraries/LibGfx/ImageFormats/ExifOrientedBitmap.h:39 in void Gfx::Detail::ExifOrientedBitmap<Gfx::Bitmap>::set_pixel<unsigned int>(unsigned int, unsigned int, unsigned int)
Shadow bytes around the buggy address:
0x502000002e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x502000002e80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x502000002f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x502000002f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x502000003000: fa fa 00 00 fa fa 00 04 fa fa fd fa fa fa 00 00
=>0x502000003080: fa fa 00[04]fa fa fa fa fa fa fa fa fa fa fa fa
0x502000003100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x502000003180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x502000003200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x502000003280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x502000003300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==76658==ABORTING
187758.188 WebContent(76670): (js log) "error"
-----------------------------------------------------
Suppressions used:
count bytes template
32 10496 FcPatternObjectInsertElt
-----------------------------------------------------
```
2 条评论