-
Recent Posts
Recent Comments
- strongcourage on Why I stopped fuzzing research
- Bob Friesenhahn on Why I stopped fuzzing research
- #gentoo dev: Why I stopped fuzzing research https://blogs.gentoo.or… | Dr. Roy Schestowitz (罗伊) on Why I stopped fuzzing research
- Ulya on Why I stopped fuzzing research
- ago on Install Gentoo in less than one minute
Archives
- July 2020
- April 2020
- March 2019
- October 2017
- September 2017
- August 2017
- July 2017
- June 2017
- May 2017
- April 2017
- March 2017
- February 2017
- January 2017
- December 2016
- November 2016
- October 2016
- September 2016
- August 2016
- July 2016
- February 2016
- July 2015
- August 2013
- June 2013
- May 2013
- January 2013
- December 2012
- November 2012
- October 2012
- August 2012
- July 2012
- June 2012
Categories
Meta
Monthly Archives: August 2016
potrace: memory allocation failure in bm_new (bitmap.h)
Description: potrace is a utility that transforms bitmaps into vector graphics. A crafted image, through a fuzz testing, causes the memory allocation to fail. Asan stacktrace: # potrace $FILE ==19351==ERROR: AddressSanitizer failed to allocate 0x200003000 (8589946880) bytes of LargeMmapAllocator (error … Continue reading
Posted in advisories, security
Leave a comment
potrace: invalid memory access in findnext (decompose.c)
Description: potrace is a utility that transforms bitmaps into vector graphics. A crafted image revealed, through a fuzz testing, the presence of a invalid memory access. The complete ASan output: # potrace $FILE potrace: warning: 48.crashes: premature end of file … Continue reading
Posted in advisories, security
Leave a comment
graphicsmagick: two heap-based buffer overflow in ReadTIFFImage (tiff.c)
Description: Graphicsmagick is an Image Processing System. A fuzzing revealed two minor issues in the TIFF parser. Both issues come out from different line in the tiff.c file but the problem seemcome from the same origin. The complete ASan output: … Continue reading
Posted in advisories, security
Leave a comment
libav: stack-based buffer overflow in aac_sync (aac_parser.c)
Description: Libav is an open source set of tools for audio and video processing. A crafted file causes a stack-based buffer overflow. The ASan report may be confused because it mentions get_bits, but the issue is in aac_sync. This issue … Continue reading
Posted in advisories, security
Leave a comment
potrace: multiple (three) NULL pointer dereference in bm_readbody_bmp (bitmap_io.c)
Description: potrace is a utility that transforms bitmaps into vector graphics. A crafted images (bmp) revealed, through a fuzz testing, the presence of three NULL pointer access. The complete ASan output: ASAN:SIGSEGV ================================================================= ==13806==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 … Continue reading
Posted in advisories, security
Leave a comment
potrace: divide-by-zero in bm_new (bitmap.h)
Description: potrace is a utility that transforms bitmaps into vector graphics. A crafted image (bmp) revealed, through a fuzz testing, the presence of a division by zero. The complete ASan output: # potrace $FILE.bmp ASAN:DEADLYSIGNAL ================================================================= ==25102==ERROR: AddressSanitizer: FPE on … Continue reading
Posted in advisories, security
Leave a comment
potrace: multiple(six) heap-based buffer overflow in bm_readbody_bmp (bitmap_io.c)
Description: potrace is a utility that transforms bitmaps into vector graphics. A crafted images (bmp) revealed, through a fuzz testing, the presence of SIX heap-based buffer overflow. To avoid to make the post much long, I splitted the ASan output … Continue reading
Posted in advisories, security
Leave a comment
WiRouterKeyRec: signed integer overflow in agpf_get_serial (agpf.c)
Description: WiRouterKeyRec is a recovery tool for wpa passphrase. A crafted AGPF config shows the presence of a signed integer overflow in agpf_check_agpf. The complete UBSan output: # WiRouterKeyRec –config crash.agpf -s Alice-48230959 WiRouter KeyRec 1.1.2 – (C) 2011 Salvatore … Continue reading
Posted in advisories, security
Leave a comment
WiRouterKeyRec: signed shift in agpf_check_agpf (agpf.c)
Description: WiRouterKeyRec is a recovery tool for wpa passphrase. A crafted AGPF config shows the presence of a signed shift in agpf_check_agpf The complete UBSan output: # WiRouterKeyRec –config crash.agpf -s Alice-48230959 WiRouter KeyRec 1.1.2 – (C) 2011 Salvatore Fresta … Continue reading
Posted in advisories, security
Leave a comment
libav: heap-based buffer overflow in ff_audio_resample (resample.c)
Description: Libav is an open source set of tools for audio and video processing. A crafted file can cause an overflow in the heap. This bug was discovered the last year, but I didn’t have time to do anything else. … Continue reading
Posted in advisories, security
2 Comments