{"id":1964,"date":"2017-08-09T19:42:36","date_gmt":"2017-08-09T17:42:36","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=1964"},"modified":"2017-08-17T22:01:39","modified_gmt":"2017-08-17T20:01:39","slug":"libfpx-null-pointer-dereference-in-wchar-c","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2017\/08\/09\/libfpx-null-pointer-dereference-in-wchar-c\/","title":{"rendered":"libfpx: NULL pointer dereference in wchar.c"},"content":{"rendered":"

Description<\/strong>:
\nlibfpx<\/a> is a library for manipulating FlashPIX images.<\/p>\n

I’m aware that the link to the upstream website does not work. I’m keeping it as well because in the future the upstream website could appear again.
\nLibfpx is not actively developed, I contacted the imagemagick project if they were available to patch security issues, but they said the they are only accepting patches and push new releases.
\nThis issue was found using the gm command line tool of graphicsmagick.<\/p>\n

The complete ASan output of the issue:<\/p>\n

# gm identify $FILE\r\n==11400==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fdead094f30 bp 0x608000000fa0 sp 0x7fff5867d3a8 T0)\r\n==11400==The signal is caused by a READ memory access.\r\n==11400==Hint: address points to the zero page.\r\n    #0 0x7fdead094f2f  \/var\/tmp\/portage\/media-libs\/libfpx-1.3.1_p6\/work\/libfpx-1.3.1-6\/oless\/wchar.c:140\r\n    #1 0x7fdead0765db in OLEStream::WriteVT_LPWSTR(unsigned short*) \/var\/tmp\/portage\/media-libs\/libfpx-1.3.1_p6\/work\/libfpx-1.3.1-6\/ole\/olestrm.cpp:1538\r\n    #2 0x7fdead072e06 in OLEPropertySection::Write() \/var\/tmp\/portage\/media-libs\/libfpx-1.3.1_p6\/work\/libfpx-1.3.1-6\/ole\/oleprops.cpp:477\r\n    #3 0x7fdead073101 in OLEPropertySet::Commit() \/var\/tmp\/portage\/media-libs\/libfpx-1.3.1_p6\/work\/libfpx-1.3.1-6\/ole\/oleprops.cpp:131\r\n    #4 0x7fdead049f16 in PFileFlashPixView::Commit() \/var\/tmp\/portage\/media-libs\/libfpx-1.3.1_p6\/work\/libfpx-1.3.1-6\/fpx\/f_fpxvw.cpp:583\r\n    #5 0x7fdead049fbf in PFileFlashPixView::~PFileFlashPixView() \/var\/tmp\/portage\/media-libs\/libfpx-1.3.1_p6\/work\/libfpx-1.3.1-6\/fpx\/f_fpxvw.cpp:444\r\n    #6 0x7fdead04a0c8 in PFileFlashPixView::~PFileFlashPixView() \/var\/tmp\/portage\/media-libs\/libfpx-1.3.1_p6\/work\/libfpx-1.3.1-6\/fpx\/f_fpxvw.cpp:487\r\n    #7 0x7fdead05365c in PFlashPixImageView::~PFlashPixImageView() \/var\/tmp\/portage\/media-libs\/libfpx-1.3.1_p6\/work\/libfpx-1.3.1-6\/fpx\/fpximgvw.cpp:524\r\n    #8 0x7fdead0536b8 in PFlashPixImageView::~PFlashPixImageView() \/var\/tmp\/portage\/media-libs\/libfpx-1.3.1_p6\/work\/libfpx-1.3.1-6\/fpx\/fpximgvw.cpp:532\r\n    #9 0x7fdead05529e in FPX_CloseImage \/var\/tmp\/portage\/media-libs\/libfpx-1.3.1_p6\/work\/libfpx-1.3.1-6\/fpx\/fpxlibio.cpp:766\r\n    #10 0x7fdead2c7bf4 in ReadFPXImage \/var\/tmp\/portage\/media-gfx\/graphicsmagick-1.3.26\/work\/GraphicsMagick-1.3.26\/coders\/fpx.c:344:14\r\n    #11 0x7fdeb2b5be2b in ReadImage \/var\/tmp\/portage\/media-gfx\/graphicsmagick-1.3.26\/work\/GraphicsMagick-1.3.26\/magick\/constitute.c:1607:13\r\n    #12 0x7fdeb2b58e8c in PingImage \/var\/tmp\/portage\/media-gfx\/graphicsmagick-1.3.26\/work\/GraphicsMagick-1.3.26\/magick\/constitute.c:1370:9\r\n    #13 0x7fdeb2a24ae5 in IdentifyImageCommand \/var\/tmp\/portage\/media-gfx\/graphicsmagick-1.3.26\/work\/GraphicsMagick-1.3.26\/magick\/command.c:8379:17\r\n    #14 0x7fdeb2a2b065 in MagickCommand \/var\/tmp\/portage\/media-gfx\/graphicsmagick-1.3.26\/work\/GraphicsMagick-1.3.26\/magick\/command.c:8869:17\r\n    #15 0x7fdeb2ad67fb in GMCommandSingle \/var\/tmp\/portage\/media-gfx\/graphicsmagick-1.3.26\/work\/GraphicsMagick-1.3.26\/magick\/command.c:17396:10\r\n    #16 0x7fdeb2ad3931 in GMCommand \/var\/tmp\/portage\/media-gfx\/graphicsmagick-1.3.26\/work\/GraphicsMagick-1.3.26\/magick\/command.c:17449:16\r\n    #17 0x7fdeb133e680 in __libc_start_main \/var\/tmp\/portage\/sys-libs\/glibc-2.23-r4\/work\/glibc-2.23\/csu\/..\/csu\/libc-start.c:289\r\n    #18 0x419cd8 in _init (\/usr\/bin\/gm+0x419cd8)\r\n\r\nAddressSanitizer can not provide additional info.\r\nSUMMARY: AddressSanitizer: SEGV \/var\/tmp\/portage\/media-libs\/libfpx-1.3.1_p6\/work\/libfpx-1.3.1-6\/oless\/wchar.c:140 \r\n==11400==ABORTING\r\n<\/font><\/pre>\n
Affected version:<\/strong>
\n1.3.1_p6<\/p>\n
Fixed version:<\/strong>
\nN\/A<\/p>\n
Commit fix:<\/strong>
\nN\/A<\/p>\n
Credit:<\/strong>
\nThis bug was discovered by Agostino Sarubbo of Gentoo.<\/p>\n
CVE:<\/strong>
\nCVE-2017-12922<\/p>\n
Reproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00310-libfpx-NULLptr-wchar_c<\/a><\/p>\n
Timeline:<\/strong>
\n2017-08-01: bug discovered
\n2017-08-09: blog post about the issue
\n2017-08-17: CVE assigned<\/p>\n
Note:<\/strong>
\nThis bug was found with American Fuzzy Lop<\/a>.
\nThis bug was identified with bare metal servers donated by Packet<\/a>. This work is also supported by the Core Infrastructure Initiative<\/a>.<\/p>\n
Permalink:<\/strong><\/p>\n
libfpx: NULL pointer dereference in wchar.c<\/a><\/p><\/blockquote>\n