Skip to content

AddressSanitizer: heap-buffer-overflow in vips__token_get #4104

Closed
@dloebl

Description

@dloebl

Found while fuzzing locally with #4103:

==256096==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200001d7bf at pc 0x7f3b7143e6aa bp 0x7ffd5b968450 sp 0x7ffd5b967bf8
READ of size 1 at 0x60200001d7bf thread T0
    #0 0x7f3b7143e6a9 in __interceptor_strspn ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:755
    #1 0x7f3b70ea7195 in vips__token_get (/home/dbl/root/lib/x86_64-linux-gnu/libvips.so.42+0x4a7195)
    #2 0x7f3b70ea7ba6 in vips__find_rightmost_brackets (/home/dbl/root/lib/x86_64-linux-gnu/libvips.so.42+0x4a7ba6)
    #3 0x7f3b70ea7dae in vips_filename_suffix_match (/home/dbl/root/lib/x86_64-linux-gnu/libvips.so.42+0x4a7dae)
    #4 0x7f3b70b65d48 in vips_foreign_find_save_target_sub (/home/dbl/root/lib/x86_64-linux-gnu/libvips.so.42+0x165d48)
    #5 0x7f3b70ea4f6b in vips_slist_map2 (/home/dbl/root/lib/x86_64-linux-gnu/libvips.so.42+0x4a4f6b)
    #6 0x7f3b70b66045 in vips_foreign_map (/home/dbl/root/lib/x86_64-linux-gnu/libvips.so.42+0x166045)
    #7 0x7f3b70b6907f in vips_foreign_find_save_target (/home/dbl/root/lib/x86_64-linux-gnu/libvips.so.42+0x16907f)
    #8 0x7f3b70e698bf in vips_image_write_to_file (/home/dbl/root/lib/x86_64-linux-gnu/libvips.so.42+0x4698bf)
    #9 0x7f3b70e5d826 in vips_object_get_argument_to_string (/home/dbl/root/lib/x86_64-linux-gnu/libvips.so.42+0x45d826)
    #10 0x7f3b70e8bd1f in vips_call_argv_output (/home/dbl/root/lib/x86_64-linux-gnu/libvips.so.42+0x48bd1f)
    #11 0x7f3b70e59622 in vips_argument_map (/home/dbl/root/lib/x86_64-linux-gnu/libvips.so.42+0x459622)
    #12 0x7f3b70e8fd1e in vips_call_argv (/home/dbl/root/lib/x86_64-linux-gnu/libvips.so.42+0x48fd1e)
    #13 0x5623f6eee296 in main (/home/dbl/root/bin/vips+0x5296)
    #14 0x7f3b70629d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #15 0x7f3b70629e3f in __libc_start_main_impl ../csu/libc-start.c:392
    #16 0x5623f6eeee54 in _start (/home/dbl/root/bin/vips+0x5e54)

To Reproduce

vips copy test/test-suite/images/sample.png out.jpg"[Q='75]"

Environment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions