vim 8.2.2348 is affected by null pointer dereference, allows local attackers to cause a denial of service (DoS) via the ex_buffer_all method.

**To Reproduce**

vim -u NONE -X -Z -e -s -S poc -c :qa!

**Debug Info**

Program received signal SIGSEGV, Segmentation fault.
\[----------------------------------registers-----------------------------------\]
RAX: 0x935c60 --\> 0x3f3
RBX: 0x1
RCX: 0x0
RDX: 0x3000 ('')
RSI: 0x62 ('b')
RDI: 0x0
RBP: 0x921600 --\> 0x3f7
RSP: 0x7fffffff81e0 --\> 0x7c ('|')
RIP: 0x412ec8 (<ex\_buffer\_all+168>: cmp DWORD PTR \[rcx+0x78\],0x1)
R8 : 0x0
R9 : 0x1
R10: 0x7ffff741d080 (<\_\_strncmp\_sse42+1328>: pslldq xmm2,0xb)
R11: 0x0
R12: 0x501
R13: 0x8f1ed0 --\> 0x6c62006162 ('ba')
R14: 0x0
R15: 0x90cbd0 --\> 0x3e9
EFLAGS: 0x10206 (carry PARITY adjust zero sign trap INTERRUPT direction overflow)
\[-------------------------------------code-------------------------------------\]
 0x412ebd <ex\_buffer\_all+157>: nop DWORD PTR \[rax\]
 0x412ec0 <ex\_buffer\_all+160>: mov rcx,QWORD PTR \[rbp+0x8\]
 0x412ec4 <ex\_buffer\_all+164>: mov r15,QWORD PTR \[rbp+0x18\]
=\> 0x412ec8 <ex\_buffer\_all+168>: cmp DWORD PTR \[rcx+0x78\],0x1
 0x412ecc <ex\_buffer\_all+172>: jg 0x412f40 <ex\_buffer\_all+288>
 0x412ece <ex\_buffer\_all+174>: test BYTE PTR \[rip+0x4d5cf7\],0x2 # 0x8e8bcc <cmdmod+4>
 0x412ed5 <ex\_buffer\_all+181>: jne 0x412ef0 <ex\_buffer\_all+208>
 0x412ed7 <ex\_buffer\_all+183>: movsxd rcx,DWORD PTR \[rbp+0xc8\]
\[------------------------------------stack-------------------------------------\]
0000| 0x7fffffff81e0 --\> 0x7c ('|')
0008| 0x7fffffff81e8 --\> 0x270f
0016| 0x7fffffff81f0 --\> 0x7f0100000000
0024| 0x7fffffff81f8 --\> 0x4d6709 (<del\_trailing\_spaces+9>: add rax,rbx)
0032| 0x7fffffff8200 --\> 0x8f1ed2 --\> 0xbb980000006c6200
0040| 0x7fffffff8208 --\> 0x0
0048| 0x7fffffff8210 --\> 0x501
0056| 0x7fffffff8218 --\> 0x8f1ed0 --\> 0x6c62006162 ('ba')
\[------------------------------------------------------------------------------\]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
ex\_buffer\_all (eap=<optimized out\>) at buffer.c:5161
5161 if ((wp\->w\_buffer\->b\_nwindows \> 1
gdb-peda$ 

stacktrace :

#0 ex\_buffer\_all (eap=<optimized out>) at buffer.c:5161
#1 0x00000000004684ba in do\_one\_cmd (cmdlinep=0x7fffffff8258, flags=0x7, cstack=0x7fffffff8438, fgetline=0x409430 <getnextac>, cookie=0x7fffffff8bf0) at ex\_docmd.c:2588
#2 do\_cmdline (cmdline=<optimized out>, cmdline@entry=0x0, fgetline=<optimized out>, cookie=<optimized out>, cookie@entry=0x7fffffff8bf0, flags=flags@entry=0x7) at ex\_docmd.c:1003
#3 0x00000000004089d5 in apply\_autocmds\_group (event=event@entry=EVENT\_BUFUNLOAD, fname=0x8f1e90 "/mnt/disk/out/vim\_bak/vim-fuzzer-out/\\261'\\377\\177", fname\_io=<optimized out>, force=<optimized out>,
 force@entry=0x0, group=group@entry=0xfffffffd, buf=buf@entry=0x92f650, eap=0x0) at autocmd.c:2109
#4 0x0000000000409287 in apply\_autocmds (event=EVENT\_BUFADD, event@entry=EVENT\_BUFUNLOAD, fname=0x62 <error: Cannot access memory at address 0x62>,
 fname\_io=0x3000 <error: Cannot access memory at address 0x3000>, force=force@entry=0x0, buf=0x1, buf@entry=0x92f650) at autocmd.c:1621
#5 0x000000000040ba68 in buf\_freeall (buf=0x92f650, flags=flags@entry=0x4) at buffer.c:803
#6 0x00000000004612b8 in do\_ecmd (fnum=<optimized out>, fnum@entry=0x0, ffname=<optimized out>, ffname@entry=0x8f1591 "", sfname=<optimized out>, sfname@entry=0x0, eap=<optimized out>,
 eap@entry=0x7fffffffaf50, newlnum=newlnum@entry=0x1, flags=<optimized out\>, oldwin=<optimized out\>) at ex\_cmds.c:2897
#7 0x000000000046d8ab in do\_exedit (eap=eap@entry=0x7fffffffaf50, old\_curwin=old\_curwin@entry=0x0) at ex\_docmd.c:6691
#8 0x000000000046fff7 in ex\_open (eap=0x7fffffffaf50) at ex\_docmd.c:6581
#9 0x00000000004684ba in do\_one\_cmd (cmdlinep=0x7fffffffaf28, flags=0x7, cstack=0x7fffffffb108, fgetline=0x5668a0 <getsourceline>, cookie=0x7fffffffb8a0) at ex\_docmd.c:2588
#10 do\_cmdline (cmdline=<optimized out>, cmdline@entry=0x903de0 "\\223?", fgetline=<optimized out>, cookie=<optimized out>, cookie@entry=0x7fffffffb8a0, flags=flags@entry=0x7) at ex\_docmd.c:1003
#11 0x0000000000566685 in do\_source (fname=<optimized out>, fname@entry=0x8f7e93 "tEBgHp/crashes/id:000002,sig:11,src:016627+022923,op:splice,rep:2", check\_other=<optimized out>, check\_other@entry=0x0,
 is\_vimrc=is\_vimrc@entry=0x0, ret\_sid=<optimized out\>, ret\_sid@entry=0x0) at scriptfile.c:1401
#12 0x0000000000565df9 in cmd\_source (fname=0x8f7e93 "tEBgHp/crashes/id:000002,sig:11,src:016627+022923,op:splice,rep:2", eap=<optimized out>) at scriptfile.c:971
#13 0x00000000004684ba in do\_one\_cmd (cmdlinep=0x7fffffffb998, flags=0xb, cstack=0x7fffffffbb78, fgetline=0x0, cookie=0x0) at ex\_docmd.c:2588
#14 do\_cmdline (cmdline=<optimized out>, fgetline=<optimized out>, fgetline@entry=0x0, cookie=<optimized out>, cookie@entry=0x0, flags=flags@entry=0xb) at ex\_docmd.c:1003
#15 0x0000000000468e1e in do\_cmdline\_cmd (cmd=0x0) at ex\_docmd.c:592
#16 0x0000000000627a6d in exe\_commands (parmp=<optimized out>) at main.c:3056
#17 vim\_main2 () at main.c:760
#18 0x0000000000626bd2 in main (argc=<optimized out>, argc@entry=0xb, argv=<optimized out>, argv@entry=0x7fffffffe4b8) at main.c:412
#19 0x00007ffff72f7840 in \_\_libc\_start\_main (main=0x6253a0 <main>, argc=0xb, argv=0x7fffffffe4b8, init=<optimized out>, fini=<optimized out>, rtld\_fini=<optimized out>, stack\_end=0x7fffffffe4a8)
 at ../csu/libc-start.c:291
#20 0x0000000000404269 in \_start ()

**Environment (please complete the following information):**

* Vim version : commit 9567efa
* OS: Ubuntu 16.04

**Additional context**

compile argument：

#!/bin/bash -eux
export CC="clang-11"
export CXX="clang-11++"
cd /src/vim/ && ./configure --with-features=huge --enable-gui=none && make

poc: 
poc.gz

Credit: 1vanChen of NSFOCUS Security Team

CVE-2021-3236: Lack of verification of wp->w_buffer causes null pointer references in ex_buffer_all() · Issue #7674 · vim/vim

An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to Pl_ASCII85Decoder::write parameter in libqpdf.

* version: 10.0.4
* commit: 78b9d6b
* How to reproduce: qpdf\_afl\_fuzzer ./poc

The log from ASAN:

 ==28751==ERROR: AddressSanitizer: heap-use-after-free on address 0x6070000076c5 at pc 0x0000008799bc bp 0x7fffffff6a30 sp 0x7fffffff6a28
 WRITE of size 1 at 0x6070000076c5 thread T0
 #0 0x8799bb in Pl_ASCII85Decoder::write(unsigned char*, unsigned long) /src/qpdf/libqpdf/Pl_ASCII85Decoder.cc:85:32
 #1 0x877725 in Pl_AES_PDF::flush(bool) /src/qpdf/libqpdf/Pl_AES_PDF.cc:241:16
 #2 0x877c75 in Pl_AES_PDF::finish() /src/qpdf/libqpdf/Pl_AES_PDF.cc
 #3 0x5996ab in QPDF::pipeStreamData(PointerHolder<QPDF::EncryptionParameters>, PointerHolder<InputSource>, QPDF&, int, int, long long, unsigned long, QPDFObjectHandle, bool, Pipeline*, bool, bool) /src/qpdf/libqpdf/QPDF.cc:2899:23
 #4 0x599c9d in QPDF::pipeStreamData(int, int, long long, unsigned long, QPDFObjectHandle, Pipeline*, bool, bool) /src/qpdf/libqpdf/QPDF.cc:2920:12
 #5 0x77e4c7 in QPDF::Pipe::pipeStreamData(QPDF*, int, int, long long, unsigned long, QPDFObjectHandle, Pipeline*, bool, bool) /src/qpdf/include/qpdf/QPDF.hh:718:19
 #6 0x76e02e in QPDF_Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool) /src/qpdf/libqpdf/QPDF_Stream.cc:700:8
 #7 0x637e27 in QPDFObjectHandle::pipeStreamData(Pipeline*, int, qpdf_stream_decode_level_e, bool, bool) /src/qpdf/libqpdf/QPDFObjectHandle.cc:1228:51
 #8 0x700fbf in QPDFWriter::unparseObject(QPDFObjectHandle, int, int, unsigned long, bool) /src/qpdf/libqpdf/QPDFWriter.cc:1826:24
 #9 0x71f286 in QPDFWriter::writeObject(QPDFObjectHandle, int) /src/qpdf/libqpdf/QPDFWriter.cc:2169:2
 #10 0x737528 in QPDFWriter::writeStandard() /src/qpdf/libqpdf/QPDFWriter.cc:3676:2
 #11 0x72aae7 in QPDFWriter::write() /src/qpdf/libqpdf/QPDFWriter.cc:2745:2
 #12 0x51bb07 in FuzzHelper::doWrite(PointerHolder<QPDFWriter>) /src/qpdf_afl_fuzzer.cc:68:12
 #13 0x51cb03 in FuzzHelper::testWrite() /src/qpdf_afl_fuzzer.cc:92:5
 #14 0x5219a6 in FuzzHelper::doChecks() /src/qpdf_afl_fuzzer.cc:194:5
 #15 0x5219a6 in FuzzHelper::run() /src/qpdf_afl_fuzzer.cc:210
 #16 0x5221b7 in main /src/qpdf_afl_fuzzer.cc:228:7
 #17 0x7ffff6a99bf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)
 #18 0x41eb89 in _start (/src/qpdf_afl_fuzzer+0x41eb89)
 
 0x6070000076c5 is located 21 bytes inside of 78-byte region [0x6070000076b0,0x6070000076fe)
 freed by thread T0 here:
 #0 0x517d68 in operator delete(void*) (/src/qpdf_afl_fuzzer+0x517d68)
 #1 0x7ffff7af21a9 in std::runtime_error::~runtime_error() (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xa81a9)
 #2 0x599c9d in QPDF::pipeStreamData(int, int, long long, unsigned long, QPDFObjectHandle, Pipeline*, bool, bool) /src/qpdf/libqpdf/QPDF.cc:2920:12
 #3 0x77e4c7 in QPDF::Pipe::pipeStreamData(QPDF*, int, int, long long, unsigned long, QPDFObjectHandle, Pipeline*, bool, bool) /src/qpdf/include/qpdf/QPDF.hh:718:19
 #4 0x76e02e in QPDF_Stream::pipeStreamData(Pipeline*, bool*, int, qpdf_stream_decode_level_e, bool, bool) /src/qpdf/libqpdf/QPDF_Stream.cc:700:8
 #5 0x637e27 in QPDFObjectHandle::pipeStreamData(Pipeline*, int, qpdf_stream_decode_level_e, bool, bool) /src/qpdf/libqpdf/QPDFObjectHandle.cc:1228:51
 #6 0x700fbf in QPDFWriter::unparseObject(QPDFObjectHandle, int, int, unsigned long, bool) /src/qpdf/libqpdf/QPDFWriter.cc:1826:24
 #7 0x71f286 in QPDFWriter::writeObject(QPDFObjectHandle, int) /src/qpdf/libqpdf/QPDFWriter.cc:2169:2
 #8 0x737528 in QPDFWriter::writeStandard() /src/qpdf/libqpdf/QPDFWriter.cc:3676:2
 #9 0x72aae7 in QPDFWriter::write() /src/qpdf/libqpdf/QPDFWriter.cc:2745:2
 #10 0x51bb07 in FuzzHelper::doWrite(PointerHolder<QPDFWriter>) /src/qpdf_afl_fuzzer.cc:68:12
 #11 0x5219a6 in FuzzHelper::doChecks() /src/qpdf_afl_fuzzer.cc:194:5
 #12 0x5219a6 in FuzzHelper::run() /src/qpdf_afl_fuzzer.cc:210
 #13 0x7ffff6a99bf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)
 
 previously allocated by thread T0 here:
 #0 0x516ff0 in operator new(unsigned long) (/src/qpdf_afl_fuzzer+0x516ff0)
 #1 0x7ffff7b1dc28 in std::string::_Rep::_S_create(unsigned long, unsigned long, std::allocator<char> const&) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xd3c28)
 #2 0x883ce8 in Pl_Flate::handleData(unsigned char*, unsigned long, int) /src/qpdf/libqpdf/Pl_Flate.cc:197:12
 #3 0x8833d5 in Pl_Flate::write(unsigned char*, unsigned long) /src/qpdf/libqpdf/Pl_Flate.cc:92:9
 #4 0x87a0a7 in Pl_ASCII85Decoder::flush() /src/qpdf/libqpdf/Pl_ASCII85Decoder.cc:122:16
 #5 0x87997b in Pl_ASCII85Decoder::write(unsigned char*, unsigned long) /src/qpdf/libqpdf/Pl_ASCII85Decoder.cc:88:4
 #6 0x877725 in Pl_AES_PDF::flush(bool) /src/qpdf/libqpdf/Pl_AES_PDF.cc:241:16
 
 SUMMARY: AddressSanitizer: heap-use-after-free /src/qpdf/libqpdf/Pl_ASCII85Decoder.cc:85:32 in Pl_ASCII85Decoder::write(unsigned char*, unsigned long)
 Shadow bytes around the buggy address:
 0x0c0e7fff8e80: fa fa fd fd fd fd fd fd fd fd fd fa fa fa fa fa
 0x0c0e7fff8e90: 00 00 00 00 00 00 00 00 01 fa fa fa fa fa fd fd
 0x0c0e7fff8ea0: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
 0x0c0e7fff8eb0: fd fd fd fd fd fd fa fa fa fa 00 00 00 00 00 00
 0x0c0e7fff8ec0: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 00
 =>0x0c0e7fff8ed0: 00 fa fa fa fa fa fd fd[fd]fd fd fd fd fd fd fd
 0x0c0e7fff8ee0: fa fa fa fa fd fd fd fd fd fd fd fd fd fa fa fa
 0x0c0e7fff8ef0: fa fa fd fd fd fd fd fd fd fd fd fa fa fa fa fa
 0x0c0e7fff8f00: 00 00 00 00 00 00 00 00 01 fa fa fa fa fa fa fa
 0x0c0e7fff8f10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 0x0c0e7fff8f20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 Shadow byte legend (one shadow byte represents 8 application bytes):
 Addressable: 00
 Partially addressable: 01 02 03 04 05 06 07
 Heap left redzone: fa
 Freed heap region: fd
 Stack left redzone: f1
 Stack mid redzone: f2
 Stack right redzone: f3
 Stack after return: f5
 Stack use after scope: f8
 Global redzone: f9
 Global init order: f6
 Poisoned by user: f7
 Container overflow: fc
 Array cookie: ac
 Intra object redzone: bb
 ASan internal: fe
 Left alloca redzone: ca
 Right alloca redzone: cb
 ==28751==ABORTING
 

The test program is a wrapper that I modified based on oss-fuzz wrapper:

// file name is qpdf\_afl\_fuzzer.c
#include <qpdf/QPDF.hh>
#include <qpdf/QPDFWriter.hh>
#include <qpdf/QUtil.hh>
#include <qpdf/BufferInputSource.hh>
#include <qpdf/Buffer.hh>
#include <qpdf/Pl\_Discard.hh>
#include <qpdf/QPDFPageDocumentHelper.hh>
#include <qpdf/QPDFPageObjectHelper.hh>
#include <qpdf/QPDFPageLabelDocumentHelper.hh>
#include <qpdf/QPDFOutlineDocumentHelper.hh>
#include <qpdf/QPDFAcroFormDocumentHelper.hh>
#include <cstdlib>

class DiscardContents: public QPDFObjectHandle::ParserCallbacks
{
 public:
 virtual ~DiscardContents() {}
 virtual void handleObject(QPDFObjectHandle) {}
 virtual void handleEOF() {}
};

class FuzzHelper
{
 public:
 FuzzHelper(char\* data);
 void run();

 private:
 PointerHolder<QPDF\> getQpdf();
 PointerHolder<QPDFWriter\> getWriter(PointerHolder<QPDF\>);
 void doWrite(PointerHolder<QPDFWriter\> w);
 void testWrite();
 void testPages();
 void testOutlines();
 void doChecks();
 char const\* input\_f;
 Pl\_Discard discard;
};

FuzzHelper::FuzzHelper(char\* \_input) :
 // We do not modify data, so it is safe to remove the const for Buffer
 input\_f(\_input)
{
}

PointerHolder<QPDF\>
FuzzHelper::getQpdf()
{
 PointerHolder<QPDF\> qpdf \= new QPDF();
 qpdf\->processFile(input\_f);
 return qpdf;
}

PointerHolder<QPDFWriter\>
FuzzHelper::getWriter(PointerHolder<QPDF\> qpdf)
{
 PointerHolder<QPDFWriter\> w \= new QPDFWriter(\*qpdf);
 w\->setOutputPipeline(&this\->discard);
 w\->setDecodeLevel(qpdf\_dl\_all);
 return w;
}

void
FuzzHelper::doWrite(PointerHolder<QPDFWriter\> w)
{
 try
 {
 w\->write();
 }
 catch (QPDFExc const& e)
 {
 std::cerr << e.what() << std::endl;
 }
 catch (std::runtime\_error const& e)
 {
 std::cerr << e.what() << std::endl;
 }
}

void
FuzzHelper::testWrite()
{
 // Write in various ways to exercise QPDFWriter

 PointerHolder<QPDF\> q;
 PointerHolder<QPDFWriter\> w;

 q \= getQpdf();
 w \= getWriter(q);
 w\->setDeterministicID(true);
 w\->setQDFMode(true);
 doWrite(w);

 q \= getQpdf();
 w \= getWriter(q);
 w\->setStaticID(true);
 w\->setLinearization(true);
 w\->setR6EncryptionParameters(
 "u", "o", true, true, true, true, true, true, qpdf\_r3p\_full, true);
 doWrite(w);

 q \= getQpdf();
 w \= getWriter(q);
 w\->setStaticID(true);
 w\->setObjectStreamMode(qpdf\_o\_disable);
 w\->setR3EncryptionParameters(
	"u", "o", true, true, qpdf\_r3p\_full, qpdf\_r3m\_all);
 doWrite(w);

 q \= getQpdf();
 w \= getWriter(q);
 w\->setDeterministicID(true);
 w\->setObjectStreamMode(qpdf\_o\_generate);
 w\->setLinearization(true);
 doWrite(w);
}

void
FuzzHelper::testPages()
{
 // Parse all content streams, and exercise some helpers that
 // operate on pages.
 PointerHolder<QPDF\> q \= getQpdf();
 QPDFPageDocumentHelper pdh(\*q);
 QPDFPageLabelDocumentHelper pldh(\*q);
 QPDFOutlineDocumentHelper odh(\*q);
 QPDFAcroFormDocumentHelper afdh(\*q);
 afdh.generateAppearancesIfNeeded();
 pdh.flattenAnnotations();
 std::vector<QPDFPageObjectHelper\> pages \= pdh.getAllPages();
 DiscardContents discard\_contents;
 int pageno \= 0;
 for (std::vector<QPDFPageObjectHelper\>::iterator iter \=
 pages.begin();
 iter != pages.end(); ++iter)
 {
 QPDFPageObjectHelper& page(\*iter);
 ++pageno;
 try
 {
 page.coalesceContentStreams();
 page.parsePageContents(&discard\_contents);
 page.getPageImages();
 pldh.getLabelForPage(pageno);
 QPDFObjectHandle page\_obj(page.getObjectHandle());
 page\_obj.getJSON(true).unparse();
 odh.getOutlinesForPage(page\_obj.getObjGen());

 std::vector<QPDFAnnotationObjectHelper\> annotations \=
 afdh.getWidgetAnnotationsForPage(page);
 for (std::vector<QPDFAnnotationObjectHelper\>::iterator annot\_iter \=
 annotations.begin();
 annot\_iter != annotations.end(); ++annot\_iter)
 {
 QPDFAnnotationObjectHelper& aoh \= \*annot\_iter;
 afdh.getFieldForAnnotation(aoh);
 }
 }
 catch (QPDFExc& e)
 {
 std::cerr << "page " << pageno << ": "
 << e.what() << std::endl;
 }
 }
}

void
FuzzHelper::testOutlines()
{
 PointerHolder<QPDF\> q \= getQpdf();
 std::list<std::vector<QPDFOutlineObjectHelper\> \> queue;
 QPDFOutlineDocumentHelper odh(\*q);
 queue.push\_back(odh.getTopLevelOutlines());
 while (! queue.empty())
 {
 std::vector<QPDFOutlineObjectHelper\>& outlines \= \*(queue.begin());
 for (std::vector<QPDFOutlineObjectHelper\>::iterator iter \=
 outlines.begin();
 iter != outlines.end(); ++iter)
 {
 QPDFOutlineObjectHelper& ol \= \*iter;
 ol.getDestPage();
 queue.push\_back(ol.getKids());
 }
 queue.pop\_front();
 }
}

void
FuzzHelper::doChecks()
{
 // Get as much coverage as possible in parts of the library that
 // might benefit from fuzzing.
 testWrite();
 testPages();
 testOutlines();
}

void
FuzzHelper::run()
{
 // The goal here is that you should be able to throw anything at
 // libqpdf and it will respond without any memory errors and never
 // do anything worse than throwing a QPDFExc or
 // std::runtime\_error. Throwing any other kind of exception,
 // segfaulting, or having a memory error (when built with
 // appropriate sanitizers) will all cause abnormal exit.
 try
 {
 doChecks();
 }
 catch (QPDFExc const& e)
 {
 std::cerr << "QPDFExc: " << e.what() << std::endl;
 }
 catch (std::runtime\_error const& e)
 {
 std::cerr << "runtime\_error: " << e.what() << std::endl;
 }
}

int main(int argc, char\*\* argv){
 if (argc < 2){
	 std::cerr << "Please input the processed file!\\n";
 }
 FuzzHelper f(argv\[1\]);
 f.run();
 return 0;
}

The PoC file is attached: 
poc.zip

CVE-2021-25786: Heap-use-after-free in `Pl_ASCII85Decoder::write` · Issue #492 · qpdf/qpdf

An issue was discovered in decode_frame in libavcodec/tiff.c in FFmpeg version 4.3, allows remote attackers to cause a denial of service (DoS).

**\[FFmpeg-devel\] \[PATCH 7/7\] avcodec/tiff: Disallow striped and tiled tiffs except for DNG****Michael Niedermayer** michael at niedermayer.cc 
_Fri Nov 6 01:11:10 EET 2020_

* Previous message (by thread): \[FFmpeg-devel\] \[PATCH 6/7\] avcodec/h264idct\_template: Fix integer overflow in ff\_h264\_chroma422\_dc\_dequant\_idct()
* Next message (by thread): \[FFmpeg-devel\] \[PATCH\] Moves yuv2yuvX\_sse3 to yasm, unrolls main loop and other small optimizations for ~20% speedup.
* **Messages sorted by:** \[ date \] \[ thread \] \[ subject \] \[ author \]

strips + tiles is not allowed in TIFF
DNG uses a separate codepath

Regression since da5b3d002862d1e105002a6dc1567e6551860896.

Fixes: NULL pointer dereference
Fixes: poc1

Found-by: 1vanChen of NSFOCUS Security Team
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc\>
---
 libavcodec/tiff.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
index 2e45464218..00f0c0ccf7 100644
--- a/libavcodec/tiff.c
+++ b/libavcodec/tiff.c
@@ -1923,14 +1923,17 @@ again:
 has\_strip\_bits = s->strippos || s->strips || s->stripoff || s->rps || s->sot || s->sstype || s->stripsize || s->stripsizesoff;
 
 if (has\_tile\_bits && has\_strip\_bits) {
- av\_log(avctx, AV\_LOG\_WARNING, "Tiled TIFF is not allowed to strip\\n");
+ int tiled\_dng = s->is\_tiled && is\_dng;
+ av\_log(avctx, tiled\_dng ? AV\_LOG\_WARNING : AV\_LOG\_ERROR, "Tiled TIFF is not allowed to strip\\n");
+ if (!tiled\_dng)
+ return AVERROR\_INVALIDDATA;
 }
 
 /\* now we have the data and may start decoding \*/
 if ((ret = init\_image(s, &frame)) < 0)
 return ret;
 
- if (!s->is\_tiled) {
+ if (!s->is\_tiled || has\_strip\_bits) {
 if (s->strips == 1 && !s->stripsize) {
 av\_log(avctx, AV\_LOG\_WARNING, "Image data size missing\\n");
 s->stripsize = avpkt->size - s->stripoff;
-- 
2.17.1

* Previous message (by thread): \[FFmpeg-devel\] \[PATCH 6/7\] avcodec/h264idct\_template: Fix integer overflow in ff\_h264\_chroma422\_dc\_dequant\_idct()
* Next message (by thread): \[FFmpeg-devel\] \[PATCH\] Moves yuv2yuvX\_sse3 to yasm, unrolls main loop and other small optimizations for ~20% speedup.
* **Messages sorted by:** \[ date \] \[ thread \] \[ subject \] \[ author \]

More information about the ffmpeg-devel mailing list

CVE-2020-36138: Disallow striped and tiled tiffs except for DNG

An issue was discovered in pcmt superMicro-CMS version 3.11, allows attackers to delete files via crafted image file in images.php.

New issue

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed

gift89a opened this issue

Jan 14, 2021

· 2 comments

Closed

**Arbitrary file deletion vulnerability #1**

gift89a opened this issue

Jan 14, 2021

· 2 comments

**Comments**

**Vulnerability exploitation conditions: Log in to the management background**

Vulnerable code: superMicro-CMS-main/admin/images.php line:151

\` if (array\_key\_exists('submit2', $\_POST)) { // Delete

 	$imagename = trim($_POST['delete']);
 	$delete = '../img/' . $imagename; //**$imagename, User controllable parameters**
 	// $disallowed = array('img-loading.gif', 'nav-icon.jpg');
 
 	if (strlen($imagename) < 1) {
 		$problem = TRUE;
 		$response = 'No image filename was entered.';
 	}
 
 	// Admin images moved to admin
 
 	if (($imagename == 'og.jpg') || ($imagename == 'bg_footer.gif') || ($imagename == 'bg_footer_monochrome.gif')) {
 		$problem = TRUE;
 		$response = "The default images can't be deleted. Maybe upload a new one (og.jpg must be 200 pixels square).";
 	}
 
 	if (!$problem) {
 		if (file_exists($delete)) {
 			unlink($delete); //**Unfiltered, can directly all files**
 			$response = 'Success. ' . $imagename . ' was deleted.';
 		} else {
 			$response = 'Image ' . $imagename . ' doesn\'t exist. Try another.';
 		}
 	}
 }`
 

Vulnerability POC：

Thanks for that too. Will do it.

Changes made. Thanks again.

2 participants

CVE-2021-25856: Arbitrary file deletion vulnerability · Issue #1 · pcmt/superMicro-CMS

An issue was discovered in pcmt superMicro-CMS version 3.11, allows authenticated attackers to execute arbitrary code via the font_type parameter to setup.php.

**Vulnerability conditions: log in to the management background**

Vulnerability file：superMicro-CMS-main\\admin\\setup.php

\` 
// Write/overwrite settings file 
$settings = '../inc/settings.php'; //settings file 
$settings\_text = "<?php //settings\_text,Many parameters are user-controllable

if(!defined('ACCESS')) { 
die('Direct access not permitted to settings.php.'); 
}

define('LOCATION', '{$site\_location}'); 
define('ADMIN', '{$admin}'); 
define('APACHE', {$apache}); 
define('WINDOWS', {$windows}); 
define('OPSYS', '{$opSystem}'); 
define('HOME\_LINK', '{$home\_link}'); 
define('NAME', '{$name}'); 
define('ALPHABETICAL', {$alphabetical}); 
define('SHOW\_ERRORS', {$show\_errors}); 
define('TRACK\_HITS', {$track\_hits}); 
define('PHP\_EXT', {$php\_ext}); 
define('EMAIL', '{$email}'); 
define('SITE\_NAME', '{$site\_name}'); 
define('OWN\_NAME', '{$own\_name}'); 
define('CONTACT\_TEXT', '{$contact\_text}'); 
define('CONTACT\_MENU', '{$contact\_menu}'); 
define('FONT\_TYPE', '{$font\_type}'); // This parameter is not filtered, I just start from here 
define('LANG\_ATTR', '{$lang\_attr}'); // This parameter also not filtered 
define('VERSION', '{$version}');

?>"; 
$fp2 = @fopen($settings, 'w+'); //open settings.php 
fwrite($fp2, $settings\_text); // save content to settings.php\`

$font_type = $_POST['font_type']; // This value is not visible on the page and can be submitted with burpsuite

Vulnerability POC：

1. log in to the management background
2. Click setup-->Submit setup

3\. BurpSuite modify “font\_type” value

4\. Access this shell

CVE-2021-25857: Admin setup option getshell · Issue #2 · pcmt/superMicro-CMS

Cross Site Scripting (XSS) vulnerability in Name Input Field in Contact Us form in Laborator Kalium before 3.0.4, allows remote attackers to execute arbitrary code.

CVE-2020-24075: Kalium Changelog - Laborator

Buffer Overflow vulnerability in XNView version 2.49.3, allows local attackers to execute arbitrary code via crafted TIFF file.

Dear user,

XnView 2.49.4 for Windows is available. Versions are available on the normal XnView Download page.

Please note that the XnView Download page offers packages with German/French Setup and German/French Online help.

Direct links to the English Standard version are:  
http://download.xnview.com/XnView-win.exe (English Setup, Multi language)  
http://download.xnview.com/XnView-win.zip (ZIP file, Multi language)

XnView Shell Extension 32bits:  
http://download.xnview.com/XnShellEx.exe  
http://download.xnview.com/XnShellEx.zip

XnView Shell Extension 64bits:  
http://download.xnview.com/XnShellEx64.exe  
http://download.xnview.com/XnShellEx64.zip

SHA256:  
XnView-win.exe: 030E3E45C51A349A3417B52AD6F6547267F1AA6E86BF03BB13E49341AB9FAEB8  
XnView-win.zip: 9E936FB7CD699019A2D1ADF795D6BB078A08686D95ACA0BEA482E0ECE5C72902  
XnView-win-full.exe: 31E13FE27894610D27167ABB0503C6B109E00169D6F3E291BE6661D27953E1C6  
XnView-win-full.zip: 646DE249CEB6E9C1736BC34217C36E720FD7E2FA25468B271A6DEC18707D4E3E  
XnView-win-small.exe: 57E5DF33083C3F440CFA7E44ABE4403724679EEC7A1E57018A5B81A1748557FB  
XnView-win-small.zip: 15DC199567011B41B616BB38DFF31771A9D3E65F1517FC2BEE2068DD69B479FE

\_\_\_\_ 2.49.4 Changelog

\* Ghostscript 9.53.x  
\* GPS & file date - viewtopic.php?f=56&t=40971  
\* TIFF Security vulnerability (Thanks to Michael Heinzl)  
\* NConvert: -levels2 - viewtopic.php?f=57&t=40490  
\* NConvert: -resize supports cm/mm/inches  
\* NConvert: -autodeskew fixed  
\* NConvert: -noholder to disable %$ chars - viewtopic.php?f=57&t=40820

\_\_\_\_ 2.49.3 Changelog

\* Convert 16 to 256 colors - viewtopic.php?f=36&t=39421  
\* Disable ESC to close tabs - viewtopic.php?f=35&t=17078  
\[General\] EscToCloseView=0  
\* Select file from search results & switching mode - viewtopic.php?f=34&t=40063  
\* Title empty when recurse - viewtopic.php?f=36&t=39979  
\* Resize - viewtopic.php?f=35&t=40248  
\* Slideshow: Order of files - viewtopic.php?f=56&t=40087  
\* Fortis Mag fix  
\* NConvert: -wmsize watermark percent size - viewtopic.php?f=57&t=38754  
\* NConvert: canvas size in inches/cm/mm - viewtopic.php?f=57&t=39361  
\* NConvert: replace\_color - viewtopic.php?f=57&t=39769  
\* NConvert: -temperature added

\_\_\_\_ 2.49.2 Changelog

\* Problem with Ghostscript 9.50  
\* PDF font problem - viewtopic.php?f=36&t=39662  
\* CR3 - viewtopic.php?f=35&t=39478  
\* .sld must use 'Recurse' setting - viewtopic.php?f=35&t=39330  
\* GIF loop - viewtopic.php?f=36&t=31689  
\* PAM CMYK

\_\_\_\_ 2.49.1 Changelog

\* TIFF 16bits greyscale

\_\_\_\_ 2.49 Changelog

\* SQLite 3.29.0  
\* NConvert: greater\_than/less\_than condition - viewtopic.php?f=57&t=39147  
\* PSD: Error when writing metadata - viewtopic.php?f=57&t=39137  
\* Export - Problem with RGBA - viewtopic.php?f=36&t=39044  
\* Capture - viewtopic.php?f=36&t=38934  
\* Left/Right F11 to open fullscreen on Left/Right monitor  
\* Create multi file & folder with '.' - viewtopic.php?f=36&t=39008  
\* # to comment line in .sld file  
\* Multipage create: Check if output filename exists  
\* Slideshow crash when using animated GIF - viewtopic.php?f=36&t=38902  
\* XIM format import added  
\* Change timestamp must not use 12h format - viewtopic.php?f=36&t=38702  
\* GIF not played correctly in Slideshow - viewtopic.php?f=34&t=38303  
\* CVE - https://github.com/apriorit/pentesting/ ... ugs/xnview  
\* NConvert: -unsharp  
\* NConvert: -exposure - viewtopic.php?f=57&t=39136  
\* NConvert: -colorize h l s  
\* NConvert: Remove EXIF orientation -exif\_rotation - viewtopic.php?f=57&t=38648  
\* \[Rename\]/TemplateStart, position of number in template - viewtopic.php?f=34&t=38568  
\* CVE-2019-12151  
\* ShellEx: 'Convert...' & input fields

\_\_\_\_ 2.48 Changelog

\* RGB inverted when printing 8bits cmap picture from browser  
\* WebP 32bits  
\* PDF Multipage create - viewtopic.php?f=35&t=38030

\_\_\_\_ 2.47 Changelog

XCF 2.10  
ICNS with JPEG2000 icon  
GIF loop & Quick slideshow - viewtopic.php?f=36&t=31689  
Problem with local charset for image description EXIF field  
\[Start\]/BugBlueLine=1 to remove the bug of blue line  
PDF output without font info - viewtopic.php?f=35&t=38030  
Space must not show tagbox if not enabled  
NConvert: -no\_auto\_rotate - viewtopic.php?f=57&t=38239  
NConvert: -autocrop with position  
NConvert: add -lower to lower case output filename  
NConvert: Bug when output filename contains a numeric enumerator - viewtopic.php?f=57&t=38014

\_\_\_\_ 2.46 Changelog

JPEG2000 YCC - viewtopic.php?f=35&t=37806  
Bad loading for ARW - viewtopic.php?f=36&t=37683  
TIFF with JPEG compression - viewtopic.php?f=35&t=37585  
Adjust dialog clipped - viewtopic.php?f=36&t=32011  
PDF version 1.4 output  
Sqlite 2.24.0  
RLE & ICO vulnerabilities Cody Sixteen from STM Solutions  
NConvert: stdout problem on windows - viewtopic.php?f=57&t=37810

\_\_\_\_ 2.45 Changelog

License written in HKCU  
Support HPI with transparency  
Shows dots under certain conditions - viewtopic.php?f=36&t=37447  
Resize - viewtopic.php?f=36&t=37451  
Blue bar - viewtopic.php?f=36&t=36278  
Resize dialog crash with ^^ - viewtopic.php?f=36&t=36644  
Parameters & External program - viewtopic.php?f=35&t=15465

\_\_\_\_ 2.44 Changelog

Monitor power off during slideshow  
Color profile not used Browser>Print - viewtopic.php?f=36&t=36833  
\-filelist doesn't work anymore  
Tile child window - viewtopic.php?f=56&t=36527  
Strange colors on grey image - viewtopic.php?f=35&t=36485  
UTF8 Exif Image Description

\_\_\_\_ 2.43 Changelog

Better HEIF support - http://www.xnview.com/download/plugins/heif\_x32.zip  
Unwanted file types shown in Viewer - viewtopic.php?f=36&t=35484  
FileListUseExt=1  
Alpha glitch - viewtopic.php?f=36&t=36454  
Folder browsing via command line - viewtopic.php?f=36&t=36434  
Lossless crop corruption - viewtopic.php?f=36&t=36378

\_\_\_\_ 2.42 Changelog

HEIF support - Extract http://www.xnview.com/download/plugins/heif\_x32.zip in Plugins folder

\_\_\_\_ 2.41 Changelog

Basic support for unicode filename  
2Gb limitation on 64bits OS - http://newsgroup.xnview.com/viewtopic.php?f=36&t=35165  
Displaying RGBA image without use alpha - http://newsgroup.xnview.com/viewtopic.php?f=36&t=35809  
Print TIFF with orientation flag in browser - http://newsgroup.xnview.com/viewtopic.php?f=36&t=36197  
GIF loop not saved in .sld - http://newsgroup.xnview.com/viewtopic.php?f=35&t=35991  
Clip support - http://newsgroup.xnview.com/viewtopic.php?f=34&t=28554  
Slideshow crash on RAW files - http://newsgroup.xnview.com/viewtopic.php?f=36&t=34632  
TIF > 2GB & multipage - http://newsgroup.xnview.com/viewtopic.php?f=79&t=35056  
RGBA printing  
Thumbnails upscaling - http://newsgroup.xnview.com/viewtopic.php?f=35&t=36090  
NConvert: -keepdocsize fixed  
NConvert: -shadow - http://newsgroup.xnview.com/viewtopic.php?f=57&t=36163  
NConvert: -align - http://newsgroup.xnview.com/viewtopic.php?f=57&t=36164

\_\_\_\_ 2.40 Changelog

CMYK image default color profile - http://newsgroup.xnview.com/viewtopic.php?f=35&t=31685  
http://newsgroup.xnview.com/viewtopic.php?f=35&t=28839  
RGBA resize (bilinear) - http://newsgroup.xnview.com/viewtopic.php?f=36&t=33425  
http://newsgroup.xnview.com/viewtopic.php?t=29238  
http://newsgroup.xnview.com/viewtopic.php?t=34493  
Ctrl+RMB to copy color - http://newsgroup.xnview.com/viewtopic.php?p=141793  
Capture rectangle on second monitor - http://newsgroup.xnview.com/viewtopic.php?f=56&t=32892  
Print 50+ via command line - http://newsgroup.xnview.com/viewtopic.php?f=35&t=35350  
Filelist to print - http://newsgroup.xnview.com/viewtopic.php?f=34&t=35378  
LIBPNG 1.6.29  
SQLite 3.18.0  
ZLIB 1.2.11  
LCMS 2.8  
BMP 2+10+10+10 - http://newsgroup.xnview.com/viewtopic.php?f=36&t=32577  
Category removed if delete file - http://newsgroup.xnview.com/viewtopic.p ... 2&start=15  
Category moved with Cut/Paste  
8BF & undo - http://newsgroup.xnview.com/viewtopic.php?f=36&t=34508  
'Purge Now' - http://newsgroup.xnview.com/viewtopic.php?f=34&t=32667  
OpenEXR updated - http://newsgroup.xnview.com/viewtopic.php?f=36&t=33039  
Resize gamma correction - http://newsgroup.xnview.com/viewtopic.php?f=34&t=33273  
Change timestamp & DST - http://newsgroup.xnview.com/viewtopic.php?f=36&t=33483  
Selection + Tab - http://newsgroup.xnview.com/viewtopic.php?f=36&t=33983  
GIF loop - http://newsgroup.xnview.com/viewtopic.php?f=35&t=34036  
PAM format - http://newsgroup.xnview.com/viewtopic.php?f=36&t=35132  
JPEG 2000 - http://newsgroup.xnview.com/viewtopic.php?f=36&t=35277  
Maximize on first monitor - http://newsgroup.xnview.com/viewtopic.php?f=36&t=32343  
Resize default size - http://newsgroup.xnview.com/viewtopic.php?f=34&t=33694  
PEF for thumbnail's folder - http://newsgroup.xnview.com/viewtopic.php?f=35&t=35363  
Cancel removed from Setup wizard - http://newsgroup.xnview.com/viewtopic.php?f=34&t=32958  
Previous/Next file & RecognizeByExt == false - http://newsgroup.xnview.com/viewtopic.php?f=36&t=33127  
Next/Previous & video - http://newsgroup.xnview.com/viewtopic.php?f=36&t=35182  
Better dialog for update - http://newsgroup.xnview.com/viewtopic.php?f=34&t=19950  
WebP plugin updated  
OpenJPEG2000 updated  
RIOT addon updated  
PNGOUT updated  
X3F with only embedded JPEG  
NConvert: text with -text\_rotation - http://newsgroup.xnview.com/viewtopic.php?f=57&t=35441  
NConvert: -text\_border added

\_\_\_\_ 2.39 Changelog

no IPTC fields in tooltip/info  
Thumbnail for blend file

\_\_\_\_ 2.38 Changelog

Sort by exif - http://newsgroup.xnview.com/viewtopic.php?f=36&t=32387  
Zooming instead file navigation - http://newsgroup.xnview.com/viewtopic.php?f=36&t=33917

\_\_\_\_ 2.37 Changelog

Better HiDPI support  
Change timestamp and video  
GPS direction - http://newsgroup.xnview.com/viewtopic.php?f=35&t=33587  
Right click (make selection) and delete - http://newsgroup.xnview.com/viewtopic.php?f=36&t=33700  
NConvert: Multipage extract - http://newsgroup.xnview.com/viewtopic.php?f=57&t=33879

\_\_\_\_ 2.36 Changelog

FLIF format added  
SVG support via rsvg-convert.exe - http://newsgroup.xnview.com/viewtopic.php?f=34&t=31748  
Search similar & extension - http://newsgroup.xnview.com/viewtopic.php?f=56&t=32840  
Multipage save doesn't use read settings  
PCT crash - http://newsgroup.xnview.com/viewtopic.php?f=36&t=33025  
NConvert: -t start step for number in output name

\_\_\_\_ 2.35 Changelog

#THUMB\_WIDTH\_MAX# & #THUMB\_HEIGHT\_MAX# - http://newsgroup.xnview.com/viewtopic.php?f=34&t=30652  
JPEGXR  
Backspace not working in fullscreen  
LibPNG 1.6.20  
ZIPPack Addon - http://newsgroup.xnview.com/viewtopic.php?f=35&t=31563

Pierre.

CVE-2021-28427: XnView 2.49.4 - XnView Software

Buffer Overflow vulnerability in XNView before 2.50, allows local attackers to execute arbitrary code via crafted GEM bitmap file.

  

XnView Classic: Best Photo Viewer, Image Resizer & Batch Converter for Windows.

XnView is compatible with Windows 7 and Windows 10.  
Version 2.51.2

  

**XnView** is an efficient image viewer, browser and converter for Windows.  
This software is really simple to use and totally free for personal use. It supports more than 500 image formats! No Adware, No Spyware. Download for Windows

Features

Photo Viewer

With XnView you can browse, organize, and view your images in numerous ways:

*   Thumbnail View
*   FullScreen View
*   FilmStrip View
*   SlideShow with FX
*   Images Compare
*   etc...

Photo Editor

XnView allows you to process your images with an arsenal of editing tools:

*   Resize, Rotate, Crop
*   Lossless Rotate & Crop (jpeg)
*   Adjust Brightness, Contrast, ...
*   Auto Levels, Auto Contrast
*   Modify Colors depth & palette
*   Apply filters & Effects

Create

In addition to **exporting** to more than 70 Formats XnView lets you create:

*   SlideShows
*   Web Pages
*   Contact Sheets
*   Video Thumbnails Gallery
*   File Listings
*   Strip of Images

Unrivaled Compatibility

XnView lets you **read** about 500 formats (including Multipage and animated still formats APNG, TIFF, GIF, ICO,etc..).  
_Some formats may require Plug-ins_

XnView also provides a convenient **Screen Capture module** and Windows ™ **TWAIN & WIA** interface to capture images.

And Much More ...

Some other notable features of XnView are:

*   Metadata support & Editing (IPTC)
*   JPEG lossless Transforms
*   Duplicate File Finder
*   Batch Processing
*   Batch Rename
*   Print Module

Downloads

Download **XnView 2.51.2** for Windows:

Donate

XnView is provided as **FREEWARE** (NO Adware, NO Spyware) for private or educational use (including non-profit organizations).  
If you enjoy using XnView, Don't hesitate to help the developer with a small donation.

You may want to check out all the Addons also available for XnView.

SHA-256 checksums:  
XnView-win.exe: A09A25EC83F277580821AFC0982041078E8992A9C778E52984CE6CC8F3C69B90  
XnView-win.zip: B463C5E2B77F981614B67E4AAB0D78385DC2EE80A6A8852EE129ED2E345BD1D4  
XnView-win-full.exe: 5089486DD86D0DE1CB55EEA4D13EB73BDC2BBCECD4831371F971DE50E4E2DA7B  
XnView-win-full.zip: 96D8A69DA9014466A22ED3677426E0134D8C41452202E8C198314559A5A1807A  
XnView-win-small.exe: 064A8D8647C1D3FD2AAC97DB1FE8A04FDAD3E80C63A1AC3591C980452E7E01E2  
XnView-win-small.zip: 1DA17B608BB0D7E5892FAD7562D8E9E36C6459118AFA30F11A412C91AC6D7916'

Screenshots

History of changes

Changelog

Support

**Visit the Forum**

The XnView forum is probably the best place to start interacting with other users and the developer.

**User Guide**

XnView Wiki is where XnView user guide is maintained.

CVE-2021-28835: The Best Windows Photo Viewer, Image Resizer and Batch Converter · XnView

Buffer Overflow vulnerability in jfif_decode() function in rockcarry ffjpeg through version 1.0.0, allows local attackers to execute arbitrary code due to an issue with ALIGN.

There is a segment fault in jfif\_decode (ctxt=0x60a010, pb=0x7fffffffe3c0) at jfif.c:545.

My system is ubuntu 16.04.6 amd64. I compiled the lastest version of ffjpeg and use my fuzzer to fuzz it by using the command ling:  
ffjpeg -d \[file\_name\]

I got a crash sample that could cause a segment fault.

The sample is attached below.  

yang@yang-HP-ZHAN-99-Mobile-Workstation-G1:/MyProject/remote\_test/target\_src/ffjpeg/src$ gdb ./ffjpeg  
GNU gdb (Ubuntu 7.11.1-0ubuntu116.5) 7.11.1  
Copyright (C) 2016 Free Software Foundation, Inc.  
License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html  
This is free software: you are free to change and redistribute it.  
There is NO WARRANTY, to the extent permitted by law. Type "show copying"  
and "show warranty" for details.  
This GDB was configured as "x86\_64-linux-gnu".  
Type "show configuration" for configuration details.  
For bug reporting instructions, please see:  
http://www.gnu.org/software/gdb/bugs/.  
Find the GDB manual and other documentation resources online at:  
http://www.gnu.org/software/gdb/documentation/.  
For help, type "help".  
Type "apropos word" to search for commands related to "word"...  
Reading symbols from ./ffjpeg...done.  
(gdb) r -d /home/yang/crash.jpg  
Starting program: /home/yang/MyProject/remote\_test/target\_src/ffjpeg/src/ffjpeg -d /home/yang/crash.jpg

Program received signal SIGSEGV, Segmentation fault.  
0x0000000000402eb2 in jfif\_decode (ctxt=0x60a010, pb=0x7fffffffe3c0) at jfif.c:545  
545 yuv\_to\_rgb(\*ysrc, \*usrc, \*vsrc, bdst + 2, bdst + 1, bdst + 0);  
(gdb) list  
540 for (j=0; jwidth; j++) {  
541 int ux = j \* jfif->comp\_info\[1\].samp\_factor\_h / sfh\_max;  
542 int vx = j \* jfif->comp\_info\[2\].samp\_factor\_h / sfh\_max;  
543 usrc = yuv\_datbuf\[1\] + uy \* yuv\_stride\[1\] + ux;  
544 vsrc = yuv\_datbuf\[2\] + vy \* yuv\_stride\[2\] + vx;  
545 yuv\_to\_rgb(\*ysrc, \*usrc, \*vsrc, bdst + 2, bdst + 1, bdst + 0);  
546 bdst += 3;  
547 ysrc += 1;  
548 }  
549 bdst -= jfif->width \* 3;  
(gdb)

We used ASAN to identify crash type.  
\==12023==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f1c5c6da24c at pc 0x000000405d2d bp 0x7ffe6131cc00 sp 0x7ffe6131cbf0  
READ of size 4 at 0x7f1c5c6da24c thread T0  
#0 0x405d2c in jfif\_decode /home/aota04/MC\_xxfuzz/test/ffjpeg/build\_asan/src/jfif.c:545  
#1 0x401233 in main (/home/aota04/MC\_xxfuzz/test/ffjpeg/build\_asan/src/ffjpeg+0x401233)  
#2 0x7f1c5b1f383f in \_\_libc\_start\_main (/lib/x86\_64-linux-gnu/libc.so.6+0x2083f)  
#3 0x4010c8 in \_start (/home/aota04/MC\_xxfuzz/test/ffjpeg/build\_asan/src/ffjpeg+0x4010c8)

0x7f1c5c6da24c is located 0 bytes to the right of 141900-byte region \[0x7f1c5c6b7800,0x7f1c5c6da24c)  
allocated by thread T0 here:  
#0 0x7f1c5b635602 in malloc (/usr/lib/x86\_64-linux-gnu/libasan.so.2+0x98602)  
#1 0x404c96 in jfif\_decode /home/aota04/MC\_xxfuzz/test/ffjpeg/build\_asan/src/jfif.c:442  
#2 0x401233 in main (/home/aota04/MC\_xxfuzz/test/ffjpeg/build\_asan/src/ffjpeg+0x401233)  
#3 0x7f1c5b1f383f in \_\_libc\_start\_main (/lib/x86\_64-linux-gnu/libc.so.6+0x2083f)

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/aota04/MC\_xxfuzz/test/ffjpeg/build\_asan/src/jfif.c:545 jfif\_decode  
Shadow bytes around the buggy address:  
0x0fe40b8d33f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
0x0fe40b8d3400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
0x0fe40b8d3410: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
0x0fe40b8d3420: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
0x0fe40b8d3430: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
\=>0x0fe40b8d3440: 00 00 00 00 00 00 00 00 00\[04\]fa fa fa fa fa fa  
0x0fe40b8d3450: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa  
0x0fe40b8d3460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa  
0x0fe40b8d3470: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa  
0x0fe40b8d3480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa  
0x0fe40b8d3490: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa  
Shadow byte legend (one shadow byte represents 8 application bytes):  
Addressable: 00  
Partially addressable: 01 02 03 04 05

CVE-2020-24222: ffjpeg "jfif_decode" function segment fault · Issue #31 · rockcarry/ffjpeg

An issue was discovered in GetByte function in miniupnp ngiflib version 0.4, allows local attackers to cause a denial of service (DoS) via crafted .gif file (infinite loop).

I used the command line gif2tga --outbase /dev/null path\_to\_file to run gif2tga and got a timeout.  
The program didn't return or repsond.  
The system is ubuntu 16.04.6 amd-64, source commit id is: 0245fd4  
compiled by gcc version 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.12)

debug informations is:  
GNU gdb (Ubuntu 7.11.1-0ubuntu1~16.5) 7.11.1  
Copyright (C) 2016 Free Software Foundation, Inc.  
License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html  
This is free software: you are free to change and redistribute it.  
There is NO WARRANTY, to the extent permitted by law. Type "show copying"  
and "show warranty" for details.  
This GDB was configured as "x86\_64-linux-gnu".  
Type "show configuration" for configuration details.  
For bug reporting instructions, please see:  
http://www.gnu.org/software/gdb/bugs/.  
Find the GDB manual and other documentation resources online at:  
http://www.gnu.org/software/gdb/documentation/.  
For help, type "help".  
Type "apropos word" to search for commands related to "word"...  
Reading symbols from gif2tga...done.  
(gdb) r --outbase /dev/null /home/yang/test.gif  
Starting program: /home/yang/MyProject/remote\_test/target\_src/ngiflib/gif2tga --outbase /dev/null /home/yang/test.gif  
^C  
Program received signal SIGINT, Interrupt.  
0x00007ffff7b04320 in \_\_read\_nocancel () at ../sysdeps/unix/syscall-template.S:84  
84 ../sysdeps/unix/syscall-template.S: No such file or directory.  
(gdb) step  
\_IO\_new\_file\_underflow (fp=0x605070) at fileops.c:594  
594 fileops.c: No such file or directory.  
(gdb) step  
597 in fileops.c  
(gdb)  
596 in fileops.c  
(gdb)  
597 in fileops.c  
(gdb)  
607 in fileops.c  
(gdb)  
613 in fileops.c  
(gdb)  
608 in fileops.c  
(gdb)  
613 in fileops.c  
(gdb)  
\_\_GI\_\_IO\_default\_uflow (fp=0x605070) at genops.c:414  
414 genops.c: No such file or directory.  
(gdb)  
417 in genops.c  
(gdb)  
\_IO\_getc (fp=0x605070) at getc.c:37  
37 getc.c: No such file or directory.  
(gdb)  
\_IO\_acquire\_lock\_fct (p=) at libioP.h:866  
866 libioP.h: No such file or directory.  
(gdb)  
\_IO\_getc (fp=0x605070) at getc.c:37  
37 getc.c: No such file or directory.  
(gdb)  
\_IO\_acquire\_lock\_fct (p=) at libioP.h:867  
867 libioP.h: No such file or directory.  
(gdb)

The poc is attached below.

  
Thank you.