{"id":1962,"date":"2017-08-09T19:58:38","date_gmt":"2017-08-09T17:58:38","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=1962"},"modified":"2017-08-17T22:00:40","modified_gmt":"2017-08-17T20:00:40","slug":"libfpx-null-pointer-dereference-in-olestreamwritevt_lpstr-olestrm-cpp","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2017\/08\/09\/libfpx-null-pointer-dereference-in-olestreamwritevt_lpstr-olestrm-cpp\/","title":{"rendered":"libfpx: NULL pointer dereference in OLEStream::WriteVT_LPSTR (olestrm.cpp)"},"content":{"rendered":"

Description<\/strong>:
\nlibfpx<\/a> is a library for manipulating FlashPIX images.<\/p>\n

I’m aware that the link to the upstream website does not work. I’m keeping it as well because in the future the upstream website could appear again.
\nLibfpx is not actively developed, I contacted the imagemagick project if they were available to patch security issues, but they said the they are only accepting patches and push new releases.
\nThis issue was found using the gm command line tool of graphicsmagick.<\/p>\n

The complete ASan output of the issue:<\/p>\n

# gm identify $FILE\r\n==11182==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fbac56ca5f6 bp 0x7ffc56dee420 sp 0x7ffc56dedba8 T0)\r\n==11182==The signal is caused by a READ memory access.\r\n==11182==Hint: address points to the zero page.\r\n    #0 0x7fbac56ca5f5 in strlen \/var\/tmp\/portage\/sys-libs\/glibc-2.23-r4\/work\/glibc-2.23\/string\/..\/sysdeps\/x86_64\/strlen.S:76\r\n    #1 0x43ea3c in __interceptor_strlen \/var\/tmp\/portage\/sys-libs\/compiler-rt-sanitizers-4.0.1\/work\/compiler-rt-4.0.1.src\/lib\/asan\/..\/sanitizer_common\/sanitizer_common_interceptors.inc:282\r\n    #2 0x7fbac1376493 in OLEStream::WriteVT_LPSTR(char*) \/var\/tmp\/portage\/media-libs\/libfpx-1.3.1_p6\/work\/libfpx-1.3.1-6\/ole\/olestrm.cpp:1472\r\n    #3 0x7fbac1372e06 in OLEPropertySection::Write() \/var\/tmp\/portage\/media-libs\/libfpx-1.3.1_p6\/work\/libfpx-1.3.1-6\/ole\/oleprops.cpp:477\r\n    #4 0x7fbac1373101 in OLEPropertySet::Commit() \/var\/tmp\/portage\/media-libs\/libfpx-1.3.1_p6\/work\/libfpx-1.3.1-6\/ole\/oleprops.cpp:131\r\n    #5 0x7fbac134da36 in PFlashPixFile::Commit() \/var\/tmp\/portage\/media-libs\/libfpx-1.3.1_p6\/work\/libfpx-1.3.1-6\/fpx\/fpxformt.cpp:581\r\n    #6 0x7fbac134da8f in PFlashPixFile::~PFlashPixFile() \/var\/tmp\/portage\/media-libs\/libfpx-1.3.1_p6\/work\/libfpx-1.3.1-6\/fpx\/fpxformt.cpp:276\r\n    #7 0x7fbac134db78 in PFlashPixFile::~PFlashPixFile() \/var\/tmp\/portage\/media-libs\/libfpx-1.3.1_p6\/work\/libfpx-1.3.1-6\/fpx\/fpxformt.cpp:306\r\n    #8 0x7fbac1379ed3 in PHierarchicalImage::~PHierarchicalImage() \/var\/tmp\/portage\/media-libs\/libfpx-1.3.1_p6\/work\/libfpx-1.3.1-6\/ri_image\/ph_image.cpp:168\r\n    #9 0x7fbac1349c38 in PFileFlashPixIO::~PFileFlashPixIO() \/var\/tmp\/portage\/media-libs\/libfpx-1.3.1_p6\/work\/libfpx-1.3.1-6\/fpx\/f_fpxio.cpp:277\r\n    #10 0x7fbac13536a5 in PFlashPixImageView::~PFlashPixImageView() \/var\/tmp\/portage\/media-libs\/libfpx-1.3.1_p6\/work\/libfpx-1.3.1-6\/fpx\/fpximgvw.cpp:519\r\n    #11 0x7fbac13536b8 in PFlashPixImageView::~PFlashPixImageView() \/var\/tmp\/portage\/media-libs\/libfpx-1.3.1_p6\/work\/libfpx-1.3.1-6\/fpx\/fpximgvw.cpp:532\r\n    #12 0x7fbac135529e in FPX_CloseImage \/var\/tmp\/portage\/media-libs\/libfpx-1.3.1_p6\/work\/libfpx-1.3.1-6\/fpx\/fpxlibio.cpp:766\r\n    #13 0x7fbac15c7bf4 in ReadFPXImage \/var\/tmp\/portage\/media-gfx\/graphicsmagick-1.3.26\/work\/GraphicsMagick-1.3.26\/coders\/fpx.c:344:14\r\n    #14 0x7fbac6e89e2b in ReadImage \/var\/tmp\/portage\/media-gfx\/graphicsmagick-1.3.26\/work\/GraphicsMagick-1.3.26\/magick\/constitute.c:1607:13\r\n    #15 0x7fbac6e86e8c in PingImage \/var\/tmp\/portage\/media-gfx\/graphicsmagick-1.3.26\/work\/GraphicsMagick-1.3.26\/magick\/constitute.c:1370:9\r\n    #16 0x7fbac6d52ae5 in IdentifyImageCommand \/var\/tmp\/portage\/media-gfx\/graphicsmagick-1.3.26\/work\/GraphicsMagick-1.3.26\/magick\/command.c:8379:17\r\n    #17 0x7fbac6d59065 in MagickCommand \/var\/tmp\/portage\/media-gfx\/graphicsmagick-1.3.26\/work\/GraphicsMagick-1.3.26\/magick\/command.c:8869:17\r\n    #18 0x7fbac6e047fb in GMCommandSingle \/var\/tmp\/portage\/media-gfx\/graphicsmagick-1.3.26\/work\/GraphicsMagick-1.3.26\/magick\/command.c:17396:10\r\n    #19 0x7fbac6e01931 in GMCommand \/var\/tmp\/portage\/media-gfx\/graphicsmagick-1.3.26\/work\/GraphicsMagick-1.3.26\/magick\/command.c:17449:16\r\n    #20 0x7fbac566c680 in __libc_start_main \/var\/tmp\/portage\/sys-libs\/glibc-2.23-r4\/work\/glibc-2.23\/csu\/..\/csu\/libc-start.c:289\r\n    #21 0x419cd8 in _init (\/usr\/bin\/gm+0x419cd8)\r\n\r\nAddressSanitizer can not provide additional info.\r\nSUMMARY: AddressSanitizer: SEGV \/var\/tmp\/portage\/sys-libs\/glibc-2.23-r4\/work\/glibc-2.23\/string\/..\/sysdeps\/x86_64\/strlen.S:76 in strlen\r\n==11182==ABORTING\r\n<\/font><\/pre>\n
Affected version:<\/strong>
\n1.3.1_p6<\/p>\n
Fixed version:<\/strong>
\nN\/A<\/p>\n
Commit fix:<\/strong>
\nN\/A<\/p>\n
Credit:<\/strong>
\nThis bug was discovered by Agostino Sarubbo of Gentoo.<\/p>\n
CVE:<\/strong>
\nCVE-2017-12923<\/p>\n
Reproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00312-libfpx-NULLptr-OLEStream_WriteVT_LPSTR<\/a><\/p>\n
Timeline:<\/strong>
\n2017-08-01: bug discovered
\n2017-08-09: blog post about the issue
\n2017-08-17: CVE assigned<\/p>\n
Note:<\/strong>
\nThis bug was found with American Fuzzy Lop<\/a>.
\nThis bug was identified with bare metal servers donated by Packet<\/a>. This work is also supported by the Core Infrastructure Initiative<\/a>.<\/p>\n
Permalink:<\/strong><\/p>\n
libfpx: NULL pointer dereference in OLEStream::WriteVT_LPSTR (olestrm.cpp)<\/a><\/p><\/blockquote>\n