XPDF commit ffaf11c was discovered to contain a global-buffer overflow via Lexer::getObj(Object*) at /xpdf/Lexer.cc.

Hi, in the lastest version of this code \[ ps: commit id ffaf11c\] I found something unusual.

**crash sample**

8id65\_global\_buffer\_overflow\_in\_getObj.zip

**command to reproduce**

./pdftops -q [crash sample] /dev/null

**crash detail**

    ==115893==ERROR: AddressSanitizer: global-buffer-overflow on address 0x00000093aadc at pc 0x000000689c9a bp 0x7ffe79eed770 sp 0x7ffe79eed768
    READ of size 1 at 0x00000093aadc thread T0
        #0 0x689c99 in Lexer::getObj(Object*) /home/bupt/Desktop/xpdf/xpdf/Lexer.cc:132:16
        #1 0x6a8fc5 in Parser::Parser(XRef*, Lexer*, int) /home/bupt/Desktop/xpdf/xpdf/Parser.cc:33:10
        #2 0x581742 in Gfx::display(Object*, int) /home/bupt/Desktop/xpdf/xpdf/Gfx.cc:641:16
        #3 0x6a76a1 in Page::displaySlice(OutputDev*, double, double, int, int, int, int, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/Page.cc:360:10
        #4 0x6d5f6e in PSOutputDev::checkPageSlice(Page*, double, double, int, int, int, int, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/PSOutputDev.cc:3276:11
        #5 0x6a7172 in Page::displaySlice(OutputDev*, double, double, int, int, int, int, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/Page.cc:328:13
        #6 0x6a6f81 in Page::display(OutputDev*, double, double, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/Page.cc:308:3
        #7 0x6af9b4 in PDFDoc::displayPage(OutputDev*, int, double, double, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/PDFDoc.cc:384:27
        #8 0x6af9b4 in PDFDoc::displayPages(OutputDev*, int, int, double, double, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/PDFDoc.cc:397:5
        #9 0x796d81 in main /home/bupt/Desktop/xpdf/xpdf/pdftops.cc:342:10
        #10 0x7f2de419dc86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
        #11 0x41d5d9 in _start (/home/bupt/Desktop/xpdf/xpdf/pdftops+0x41d5d9)
    
    0x00000093aadc is located 4 bytes to the left of global variable 'specialChars' defined in 'Lexer.cc:26:13' (0x93aae0) of size 256
    0x00000093aadc is located 55 bytes to the right of global variable '<string literal>' defined in 'Lexer.cc:471:52' (0x93aaa0) of size 5
      '<string literal>' is ascii string 'null'
    SUMMARY: AddressSanitizer: global-buffer-overflow /home/bupt/Desktop/xpdf/xpdf/Lexer.cc:132:16 in Lexer::getObj(Object*)
    Shadow bytes around the buggy address:
      0x00008011f500: f9 f9 f9 f9 00 00 04 f9 f9 f9 f9 f9 00 00 00 00
      0x00008011f510: 02 f9 f9 f9 f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9
      0x00008011f520: 00 00 00 00 00 02 f9 f9 f9 f9 f9 f9 00 00 06 f9
      0x00008011f530: f9 f9 f9 f9 00 00 00 02 f9 f9 f9 f9 00 00 07 f9
      0x00008011f540: f9 f9 f9 f9 05 f9 f9 f9 f9 f9 f9 f9 06 f9 f9 f9
    =>0x00008011f550: f9 f9 f9 f9 05 f9 f9 f9 f9 f9 f9[f9]00 00 00 00
      0x00008011f560: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      0x00008011f570: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9
      0x00008011f580: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
      0x00008011f590: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      0x00008011f5a0: 00 00 00 00 00 00 06 f9 f9 f9 f9 f9 02 f9 f9 f9
    Shadow byte legend (one shadow byte represents 8 application bytes):
      Addressable:           00
      Partially addressable: 01 02 03 04 05 06 07 
      Heap left redzone:       fa
      Freed heap region:       fd
      Stack left redzone:      f1
      Stack mid redzone:       f2
      Stack right redzone:     f3
      Stack after return:      f5
      Stack use after scope:   f8
      Global redzone:          f9
      Global init order:       f6
      Poisoned by user:        f7
      Container overflow:      fc
      Array cookie:            ac
      Intra object redzone:    bb
      ASan internal:           fe
      Left alloca redzone:     ca
      Right alloca redzone:    cb
      Shadow gap:              cc
    ==115893==ABORTING

CVE-2022-38236: global_buffer_overflow_in_getObj · Issue #8 · jhcloos/xpdf

XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::readHuffSym(DCTHuffTable*) at /xpdf/Stream.cc.

Hi, in the lastest version of this code \[ ps: commit id ffaf11c\] I found something unusual.

**crash sample**

8id0\_heap-buffer-overflow\_in\_readHuffSym.zip

**command to reproduce**

./pdftops -q [crash sample] /dev/null

**crash detail**

    =================================================================
    ==108391==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x620000001782 at pc 0x000000759029 bp 0x7ffd51edc550 sp 0x7ffd51edc548
    READ of size 2 at 0x620000001782 thread T0
        #0 0x759028 in DCTStream::readHuffSym(DCTHuffTable*) /home/bupt/Desktop/xpdf/xpdf/Stream.cc:3119:16
        #1 0x7548ba in DCTStream::readDataUnit(DCTHuffTable*, DCTHuffTable*, int*, int*) /home/bupt/Desktop/xpdf/xpdf/Stream.cc:2624:17
        #2 0x751b27 in DCTStream::readMCURow() /home/bupt/Desktop/xpdf/xpdf/Stream.cc:2392:9
        #3 0x750d6e in DCTStream::getChar() /home/bupt/Desktop/xpdf/xpdf/Stream.cc:2316:12
        #4 0x6899e3 in Object::streamGetChar() /home/bupt/Desktop/xpdf/xpdf/./Object.h:288:20
        #5 0x6899e3 in Lexer::getChar() /home/bupt/Desktop/xpdf/xpdf/Lexer.cc:92:42
        #6 0x6899e3 in Lexer::getObj(Object*) /home/bupt/Desktop/xpdf/xpdf/Lexer.cc:124:14
        #7 0x6a8fc5 in Parser::Parser(XRef*, Lexer*, int) /home/bupt/Desktop/xpdf/xpdf/Parser.cc:33:10
        #8 0x581742 in Gfx::display(Object*, int) /home/bupt/Desktop/xpdf/xpdf/Gfx.cc:641:16
        #9 0x6a76a1 in Page::displaySlice(OutputDev*, double, double, int, int, int, int, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/Page.cc:360:10
        #10 0x6d5f6e in PSOutputDev::checkPageSlice(Page*, double, double, int, int, int, int, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/PSOutputDev.cc:3276:11
        #11 0x6a7172 in Page::displaySlice(OutputDev*, double, double, int, int, int, int, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/Page.cc:328:13
        #12 0x6a6f81 in Page::display(OutputDev*, double, double, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/Page.cc:308:3
        #13 0x6af9b4 in PDFDoc::displayPage(OutputDev*, int, double, double, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/PDFDoc.cc:384:27
        #14 0x6af9b4 in PDFDoc::displayPages(OutputDev*, int, int, double, double, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/PDFDoc.cc:397:5
        #15 0x796d81 in main /home/bupt/Desktop/xpdf/xpdf/pdftops.cc:342:10
        #16 0x7f3b180d3c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
        #17 0x41d5d9 in _start (/home/bupt/Desktop/xpdf/xpdf/pdftops+0x41d5d9)
    
    0x620000001782 is located 2314 bytes to the right of 3576-byte region [0x620000000080,0x620000000e78)
    allocated by thread T0 here:
        #0 0x4f5768 in operator new(unsigned long) /home/bupt/Desktop/tools/llvm-12.0.1/llvm/projects/compiler-rt/lib/asan/asan_new_delete.cpp:99
        #1 0x7259bc in Stream::makeFilter(char*, Stream*, Object*, int) /home/bupt/Desktop/xpdf/xpdf/Stream.cc:269:11
        #2 0x72459a in Stream::addFilters(Object*, int) /home/bupt/Desktop/xpdf/xpdf/Stream.cc:141:11
        #3 0x6ad41e in Parser::makeStream(Object*, unsigned char*, CryptAlgorithm, int, int, int, int) /home/bupt/Desktop/xpdf/xpdf/Parser.cc:214:14
        #4 0x6ab6f6 in Parser::getObj(Object*, int, unsigned char*, CryptAlgorithm, int, int, int, int) /home/bupt/Desktop/xpdf/xpdf/Parser.cc:101:18
        #5 0x781a3a in XRef::fetch(int, int, Object*, int) /home/bupt/Desktop/xpdf/xpdf/XRef.cc:1028:13
        #6 0x6a7611 in Page::displaySlice(OutputDev*, double, double, int, int, int, int, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/Page.cc:357:12
        #7 0x6d5f6e in PSOutputDev::checkPageSlice(Page*, double, double, int, int, int, int, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/PSOutputDev.cc:3276:11
    
    SUMMARY: AddressSanitizer: heap-buffer-overflow /home/bupt/Desktop/xpdf/xpdf/Stream.cc:3119:16 in DCTStream::readHuffSym(DCTHuffTable*)
    Shadow bytes around the buggy address:
      0x0c407fff82a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c407fff82b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c407fff82c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c407fff82d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c407fff82e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    =>0x0c407fff82f0:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c407fff8300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c407fff8310: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c407fff8320: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c407fff8330: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c407fff8340: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    Shadow byte legend (one shadow byte represents 8 application bytes):
      Addressable:           00
      Partially addressable: 01 02 03 04 05 06 07 
      Heap left redzone:       fa
      Freed heap region:       fd
      Stack left redzone:      f1
      Stack mid redzone:       f2
      Stack right redzone:     f3
      Stack after return:      f5
      Stack use after scope:   f8
      Global redzone:          f9
      Global init order:       f6
      Poisoned by user:        f7
      Container overflow:      fc
      Array cookie:            ac
      Intra object redzone:    bb
      ASan internal:           fe
      Left alloca redzone:     ca
      Right alloca redzone:    cb
      Shadow gap:              cc
    ==108391==ABORTING

CVE-2022-38229: heap-buffer-overflow_in_readHuffSym · Issue #3 · jhcloos/xpdf

XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::lookChar() at /xpdf/Stream.cc.

Hi, in the lastest version of this code \[ ps: commit id ffaf11c\] I found something unusual.

**crash sample**

8id148\_heap\_buffer\_overflow\_in\_lookChar.zip

**command to reproduce**

./pdftops -q [crash sample] /dev/null

**crash detail**

    =================================================================
    ==115813==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x631000038800 at pc 0x000000754566 bp 0x7ffe27e56210 sp 0x7ffe27e56208
    READ of size 4 at 0x631000038800 thread T0
        #0 0x754565 in DCTStream::lookChar() /home/bupt/Desktop/xpdf/xpdf/Stream.cc:2331:12
        #1 0x68a82a in Object::streamLookChar() /home/bupt/Desktop/xpdf/xpdf/./Object.h:291:20
        #2 0x68a82a in Lexer::lookChar() /home/bupt/Desktop/xpdf/xpdf/Lexer.cc:108:17
        #3 0x68a82a in Lexer::getObj(Object*) /home/bupt/Desktop/xpdf/xpdf/Lexer.cc:458:17
        #4 0x6ab867 in Parser::getObj(Object*, int, unsigned char*, CryptAlgorithm, int, int, int, int) /home/bupt/Desktop/xpdf/xpdf/Parser.cc
        #5 0x6aa214 in Parser::getObj(Object*, int, unsigned char*, CryptAlgorithm, int, int, int, int) /home/bupt/Desktop/xpdf/xpdf/Parser.cc:69:21
        #6 0x582f60 in Gfx::go(int) /home/bupt/Desktop/xpdf/xpdf/Gfx.cc:757:13
        #7 0x581775 in Gfx::display(Object*, int) /home/bupt/Desktop/xpdf/xpdf/Gfx.cc:642:3
        #8 0x6a76a1 in Page::displaySlice(OutputDev*, double, double, int, int, int, int, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/Page.cc:360:10
        #9 0x6d5f6e in PSOutputDev::checkPageSlice(Page*, double, double, int, int, int, int, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/PSOutputDev.cc:3276:11
        #10 0x6a7172 in Page::displaySlice(OutputDev*, double, double, int, int, int, int, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/Page.cc:328:13
        #11 0x6a6f81 in Page::display(OutputDev*, double, double, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/Page.cc:308:3
        #12 0x6af9b4 in PDFDoc::displayPage(OutputDev*, int, double, double, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/PDFDoc.cc:384:27
        #13 0x6af9b4 in PDFDoc::displayPages(OutputDev*, int, int, double, double, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/PDFDoc.cc:397:5
        #14 0x796d81 in main /home/bupt/Desktop/xpdf/xpdf/pdftops.cc:342:10
        #15 0x7f3e6975dc86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
        #16 0x41d5d9 in _start (/home/bupt/Desktop/xpdf/xpdf/pdftops+0x41d5d9)
    
    0x631000038800 is located 0 bytes to the right of 65536-byte region [0x631000028800,0x631000038800)
    allocated by thread T0 here:
        #0 0x4afba0 in malloc /home/bupt/Desktop/tools/llvm-12.0.1/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:145
        #1 0x7aa7fa in gmalloc /home/bupt/Desktop/xpdf/goo/gmem.cc:102:13
        #2 0x7aa7fa in gmallocn /home/bupt/Desktop/xpdf/goo/gmem.cc:168:10
    
    SUMMARY: AddressSanitizer: heap-buffer-overflow /home/bupt/Desktop/xpdf/xpdf/Stream.cc:2331:12 in DCTStream::lookChar()
    Shadow bytes around the buggy address:
      0x0c627ffff0b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      0x0c627ffff0c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      0x0c627ffff0d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      0x0c627ffff0e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      0x0c627ffff0f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    =>0x0c627ffff100:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c627ffff110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c627ffff120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c627ffff130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c627ffff140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c627ffff150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    Shadow byte legend (one shadow byte represents 8 application bytes):
      Addressable:           00
      Partially addressable: 01 02 03 04 05 06 07 
      Heap left redzone:       fa
      Freed heap region:       fd
      Stack left redzone:      f1
      Stack mid redzone:       f2
      Stack right redzone:     f3
      Stack after return:      f5
      Stack use after scope:   f8
      Global redzone:          f9
      Global init order:       f6
      Poisoned by user:        f7
      Container overflow:      fc
      Array cookie:            ac
      Intra object redzone:    bb
      ASan internal:           fe
      Left alloca redzone:     ca
      Right alloca redzone:    cb
      Shadow gap:              cc
    ==115813==ABORTING

CVE-2022-38238: heap_buffer_overflow_in_lookChar · Issue #15 · jhcloos/xpdf

XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::getChar() at /xpdf/Stream.cc.

Hi, in the lastest version of this code \[ ps: commit id ffaf11c\] I found something unusual.

**crash sample**

8id93\_heap\_buffer\_overflow\_in\_getChar.zip

**command to reproduce**

./pdftops -q [crash sample] /dev/null

**crash detail**

    =================================================================
    ==115941==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f54608ff800 at pc 0x000000750e7c bp 0x7ffdad0d6050 sp 0x7ffdad0d6048
    READ of size 4 at 0x7f54608ff800 thread T0
        #0 0x750e7b in DCTStream::getChar() /home/bupt/Desktop/xpdf/xpdf/Stream.cc:2302:9
        #1 0x6899e3 in Object::streamGetChar() /home/bupt/Desktop/xpdf/xpdf/./Object.h:288:20
        #2 0x6899e3 in Lexer::getChar() /home/bupt/Desktop/xpdf/xpdf/Lexer.cc:92:42
        #3 0x6899e3 in Lexer::getObj(Object*) /home/bupt/Desktop/xpdf/xpdf/Lexer.cc:124:14
        #4 0x6ab867 in Parser::getObj(Object*, int, unsigned char*, CryptAlgorithm, int, int, int, int) /home/bupt/Desktop/xpdf/xpdf/Parser.cc
        #5 0x582f60 in Gfx::go(int) /home/bupt/Desktop/xpdf/xpdf/Gfx.cc:757:13
        #6 0x581775 in Gfx::display(Object*, int) /home/bupt/Desktop/xpdf/xpdf/Gfx.cc:642:3
        #7 0x6a76a1 in Page::displaySlice(OutputDev*, double, double, int, int, int, int, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/Page.cc:360:10
        #8 0x6d5f6e in PSOutputDev::checkPageSlice(Page*, double, double, int, int, int, int, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/PSOutputDev.cc:3276:11
        #9 0x6a7172 in Page::displaySlice(OutputDev*, double, double, int, int, int, int, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/Page.cc:328:13
        #10 0x6a6f81 in Page::display(OutputDev*, double, double, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/Page.cc:308:3
        #11 0x6af9b4 in PDFDoc::displayPage(OutputDev*, int, double, double, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/PDFDoc.cc:384:27
        #12 0x6af9b4 in PDFDoc::displayPages(OutputDev*, int, int, double, double, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/PDFDoc.cc:397:5
        #13 0x796d81 in main /home/bupt/Desktop/xpdf/xpdf/pdftops.cc:342:10
        #14 0x7f5463589c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
        #15 0x41d5d9 in _start (/home/bupt/Desktop/xpdf/xpdf/pdftops+0x41d5d9)
    
    0x7f54608ff800 is located 0 bytes to the right of 131072-byte region [0x7f54608df800,0x7f54608ff800)
    allocated by thread T0 here:
        #0 0x4afba0 in malloc /home/bupt/Desktop/tools/llvm-12.0.1/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:145
        #1 0x7aa7fa in gmalloc /home/bupt/Desktop/xpdf/goo/gmem.cc:102:13
        #2 0x7aa7fa in gmallocn /home/bupt/Desktop/xpdf/goo/gmem.cc:168:10
    
    SUMMARY: AddressSanitizer: heap-buffer-overflow /home/bupt/Desktop/xpdf/xpdf/Stream.cc:2302:9 in DCTStream::getChar()
    Shadow bytes around the buggy address:
      0x0feb0c117eb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      0x0feb0c117ec0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      0x0feb0c117ed0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      0x0feb0c117ee0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      0x0feb0c117ef0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    =>0x0feb0c117f00:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0feb0c117f10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0feb0c117f20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0feb0c117f30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0feb0c117f40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0feb0c117f50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    Shadow byte legend (one shadow byte represents 8 application bytes):
      Addressable:           00
      Partially addressable: 01 02 03 04 05 06 07 
      Heap left redzone:       fa
      Freed heap region:       fd
      Stack left redzone:      f1
      Stack mid redzone:       f2
      Stack right redzone:     f3
      Stack after return:      f5
      Stack use after scope:   f8
      Global redzone:          f9
      Global init order:       f6
      Poisoned by user:        f7
      Container overflow:      fc
      Array cookie:            ac
      Intra object redzone:    bb
      ASan internal:           fe
      Left alloca redzone:     ca
      Right alloca redzone:    cb
      Shadow gap:              cc
    ==115941==ABORTING

CVE-2022-38231: heap_buffer_overflow_in_getChar · Issue #11 · jhcloos/xpdf

XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::transformDataUnit at /xpdf/Stream.cc.

Hi, in the lastest version of this code \[ ps: commit id ffaf11c\] I found something unusual.

**crash sample**

8id64\_heap\_buffer\_overflow\_in\_transformDataUnit.zip

**command to reproduce**

./pdftops -q [crash sample] /dev/null

**crash detail**

    =================================================================
    ==115877==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6200000080e0 at pc 0x000000756136 bp 0x7fff10b0da30 sp 0x7fff10b0da28
    READ of size 2 at 0x6200000080e0 thread T0
        #0 0x756135 in DCTStream::transformDataUnit(unsigned short*, int*, unsigned char*) /home/bupt/Desktop/xpdf/xpdf/Stream.cc:2968:17
        #1 0x748741 in DCTStream::decodeImage() /home/bupt/Desktop/xpdf/xpdf/Stream.cc:2835:6
        #2 0x7402bb in DCTStream::reset() /home/bupt/Desktop/xpdf/xpdf/Stream.cc:2261:5
        #3 0x68912e in Object::streamReset() /home/bupt/Desktop/xpdf/xpdf/./Object.h:282:13
        #4 0x68912e in Lexer::Lexer(XRef*, Object*) /home/bupt/Desktop/xpdf/xpdf/Lexer.cc:74:12
        #5 0x581714 in Gfx::display(Object*, int) /home/bupt/Desktop/xpdf/xpdf/Gfx.cc:641:33
        #6 0x6a76a1 in Page::displaySlice(OutputDev*, double, double, int, int, int, int, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/Page.cc:360:10
        #7 0x6d5f6e in PSOutputDev::checkPageSlice(Page*, double, double, int, int, int, int, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/PSOutputDev.cc:3276:11
        #8 0x6a7172 in Page::displaySlice(OutputDev*, double, double, int, int, int, int, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/Page.cc:328:13
        #9 0x6a6f81 in Page::display(OutputDev*, double, double, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/Page.cc:308:3
        #10 0x6af9b4 in PDFDoc::displayPage(OutputDev*, int, double, double, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/PDFDoc.cc:384:27
        #11 0x6af9b4 in PDFDoc::displayPages(OutputDev*, int, int, double, double, int, int, int, int, int (*)(void*), void*) /home/bupt/Desktop/xpdf/xpdf/PDFDoc.cc:397:5
        #12 0x796d81 in main /home/bupt/Desktop/xpdf/xpdf/pdftops.cc:342:10
        #13 0x7f57efb1ec86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
        #14 0x41d5d9 in _start (/home/bupt/Desktop/xpdf/xpdf/pdftops+0x41d5d9)
    
    Address 0x6200000080e0 is a wild pointer.
    SUMMARY: AddressSanitizer: heap-buffer-overflow /home/bupt/Desktop/xpdf/xpdf/Stream.cc:2968:17 in DCTStream::transformDataUnit(unsigned short*, int*, unsigned char*)
    Shadow bytes around the buggy address:
      0x0c407fff8fc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c407fff8fd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c407fff8fe0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c407fff8ff0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c407fff9000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    =>0x0c407fff9010: fa fa fa fa fa fa fa fa fa fa fa fa[fa]fa fa fa
      0x0c407fff9020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c407fff9030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c407fff9040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c407fff9050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c407fff9060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    Shadow byte legend (one shadow byte represents 8 application bytes):
      Addressable:           00
      Partially addressable: 01 02 03 04 05 06 07 
      Heap left redzone:       fa
      Freed heap region:       fd
      Stack left redzone:      f1
      Stack mid redzone:       f2
      Stack right redzone:     f3
      Stack after return:      f5
      Stack use after scope:   f8
      Global redzone:          f9
      Global init order:       f6
      Poisoned by user:        f7
      Container overflow:      fc
      Array cookie:            ac
      Intra object redzone:    bb
      ASan internal:           fe
      Left alloca redzone:     ca
      Right alloca redzone:    cb
      Shadow gap:              cc
    ==115877==ABORTING

CVE-2022-38228: heap_buffer_overflow_in_transformDataUnit · Issue #7 · jhcloos/xpdf

fdkaac v1.0.3 was discovered to contain a heap buffer overflow via __interceptor_memcpy.part.46 at /sanitizer_common/sanitizer_common_interceptors.inc.

Hi, in the lastest version of this repo \[PS: commit ID -> 1a1ee29\], I found something insterest.

    ==122363==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x625000018900 at pc 0x00000043b985 bp 0x7ffe69d827d0 sp 0x7ffe69d81f80
    READ of size 4 at 0x625000018900 thread T0
        #0 0x43b984 in __interceptor_memcpy.part.46 /home/bupt/Desktop/tools/llvm-12.0.1/llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:810
        #1 0x7fe7e606c24a in aacEncEncode (/usr/lib/x86_64-linux-gnu/libfdk-aac.so.1+0x2424a)
        #2 0x4f7154 in aac_encode_frame /home/bupt/Desktop/fdkaac/src/aacenc.c:291:11
        #3 0x51fd71 in encode /home/bupt/Desktop/fdkaac/src/main.c:554:24
        #4 0x51fd71 in main /home/bupt/Desktop/fdkaac/src/main.c:862:19
        #5 0x7fe7e5097c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
        #6 0x41c9d9 in _start (/home/bupt/Desktop/fdkaac/fdkaac+0x41c9d9)
    
    0x625000018900 is located 0 bytes to the right of 8192-byte region [0x625000016900,0x625000018900)
    allocated by thread T0 here:
        #0 0x4aefa0 in malloc /home/bupt/Desktop/tools/llvm-12.0.1/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:145
        #1 0x51fb60 in encode /home/bupt/Desktop/fdkaac/src/main.c:535:12
        #2 0x51fb60 in main /home/bupt/Desktop/fdkaac/src/main.c:862:19
        #3 0x7fe7e5097c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
    
    SUMMARY: AddressSanitizer: heap-buffer-overflow /home/bupt/Desktop/tools/llvm-12.0.1/llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:810 in __interceptor_memcpy.part.46
    Shadow bytes around the buggy address:
      0x0c4a7fffb0d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      0x0c4a7fffb0e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      0x0c4a7fffb0f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      0x0c4a7fffb100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      0x0c4a7fffb110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    =>0x0c4a7fffb120:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c4a7fffb130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c4a7fffb140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c4a7fffb150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c4a7fffb160: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c4a7fffb170: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    Shadow byte legend (one shadow byte represents 8 application bytes):
      Addressable:           00
      Partially addressable: 01 02 03 04 05 06 07 
      Heap left redzone:       fa
      Freed heap region:       fd
      Stack left redzone:      f1
      Stack mid redzone:       f2
      Stack right redzone:     f3
      Stack after return:      f5
      Stack use after scope:   f8
      Global redzone:          f9
      Global init order:       f6
      Poisoned by user:        f7
      Container overflow:      fc
      Array cookie:            ac
      Intra object redzone:    bb
      ASan internal:           fe
      Left alloca redzone:     ca
      Right alloca redzone:    cb
      Shadow gap:              cc
    ==122363==ABORTING
    

    AddressSanitizer:DEADLYSIGNAL
    =================================================================
    ==122379==ERROR: AddressSanitizer: FPE on unknown address 0x00000053ade9 (pc 0x00000053ade9 bp 0x7ffe2be4ff90 sp 0x7ffe2be4fc60 T0)
        #0 0x53ade9 in wav_open /home/bupt/Desktop/fdkaac/src/wav_reader.c:212:54
        #1 0x51e35b in open_input /home/bupt/Desktop/fdkaac/src/main.c:746:27
        #2 0x51e35b in main /home/bupt/Desktop/fdkaac/src/main.c:802:19
        #3 0x7f17fe499c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
        #4 0x41c9d9 in _start (/home/bupt/Desktop/fdkaac/fdkaac+0x41c9d9)
    
    AddressSanitizer can not provide additional info.
    SUMMARY: AddressSanitizer: FPE /home/bupt/Desktop/fdkaac/src/wav_reader.c:212:54 in wav_open
    ==122379==ABORTING

CVE-2022-37781: bugs found · Issue #54 · nu774/fdkaac

SWFMill commit 53d7690 was discovered to contain a heap-buffer overflow via base64_encode.

    ==55556==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000019813 at pc 0x0000005311c9 bp 0x7ffedbddc7f0 sp 0x7ffedbddc7e8
    WRITE of size 1 at 0x602000019813 thread T0
        #0 0x5311c8 in base64_encode /home/bupt/Desktop/swfmill/src/base64.c:46:10
        #1 0x5d5152 in SWF::UnknownTag::writeXML(_xmlNode*, SWF::Context*) /home/bupt/Desktop/swfmill/src/gSWFWriteXML.cpp:3881:12
        #2 0x5bc1ee in SWF::Header::writeXML(_xmlNode*, SWF::Context*) /home/bupt/Desktop/swfmill/src/gSWFWriteXML.cpp:375:11
        #3 0x53e1d2 in SWF::File::getXML(SWF::Context*) /home/bupt/Desktop/swfmill/src/SWFFile.cpp:215:11
        #4 0x53e4f0 in SWF::File::saveXML(_IO_FILE*, SWF::Context*) /home/bupt/Desktop/swfmill/src/SWFFile.cpp:239:19
        #5 0x54eebe in swfmill_swf2xml(int, char**) /home/bupt/Desktop/swfmill/src/swfmill.cpp:147:24
        #6 0x7f93171f1c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
        #7 0x4224d9 in _start (/home/bupt/Desktop/swfmill/src/swfmill+0x4224d9)
    
    0x602000019813 is located 0 bytes to the right of 3-byte region [0x602000019810,0x602000019813)
    allocated by thread T0 here:
        #0 0x4fa7c8 in operator new[](unsigned long) /home/bupt/Desktop/tools/llvm-12.0.1/llvm/projects/compiler-rt/lib/asan/asan_new_delete.cpp:102
        #1 0x5d5140 in SWF::UnknownTag::writeXML(_xmlNode*, SWF::Context*) /home/bupt/Desktop/swfmill/src/gSWFWriteXML.cpp:3879:19
        #2 0x5bc1ee in SWF::Header::writeXML(_xmlNode*, SWF::Context*) /home/bupt/Desktop/swfmill/src/gSWFWriteXML.cpp:375:11
        #3 0x53e1d2 in SWF::File::getXML(SWF::Context*) /home/bupt/Desktop/swfmill/src/SWFFile.cpp:215:11
        #4 0x53e4f0 in SWF::File::saveXML(_IO_FILE*, SWF::Context*) /home/bupt/Desktop/swfmill/src/SWFFile.cpp:239:19
        #5 0x54eebe in swfmill_swf2xml(int, char**) /home/bupt/Desktop/swfmill/src/swfmill.cpp:147:24
        #6 0x7f93171f1c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
    
    SUMMARY: AddressSanitizer: heap-buffer-overflow /home/bupt/Desktop/swfmill/src/base64.c:46:10 in base64_encode
    Shadow bytes around the buggy address:
      0x0c047fffb2b0: fa fa 02 fa fa fa 07 fa fa fa 02 fa fa fa 05 fa
      0x0c047fffb2c0: fa fa 02 fa fa fa 00 01 fa fa 04 fa fa fa 05 fa
      0x0c047fffb2d0: fa fa 00 03 fa fa 07 fa fa fa 00 01 fa fa 06 fa
      0x0c047fffb2e0: fa fa 07 fa fa fa 04 fa fa fa 06 fa fa fa 06 fa
      0x0c047fffb2f0: fa fa 07 fa fa fa 05 fa fa fa 05 fa fa fa 00 03
    =>0x0c047fffb300: fa fa[03]fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c047fffb310: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c047fffb320: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c047fffb330: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c047fffb340: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c047fffb350: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    Shadow byte legend (one shadow byte represents 8 application bytes):
      Addressable:           00
      Partially addressable: 01 02 03 04 05 06 07 
      Heap left redzone:       fa
      Freed heap region:       fd
      Stack left redzone:      f1
      Stack mid redzone:       f2
      Stack right redzone:     f3
      Stack after return:      f5
      Stack use after scope:   f8
      Global redzone:          f9
      Global init order:       f6
      Poisoned by user:        f7
      Container overflow:      fc
      Array cookie:            ac
      Intra object redzone:    bb
      ASan internal:           fe
      Left alloca redzone:     ca
      Right alloca redzone:    cb
      Shadow gap:              cc
    ==55556==ABORTING

CVE-2022-36144: heap-buffer-overflow  in base64_encode · Issue #63 · djcsdy/swfmill

SWFMill commit 53d7690 was discovered to contain a heap-buffer overflow via __interceptor_strlen.part at /sanitizer_common/sanitizer_common_interceptors.inc.

**sample file**

id5\_heap-buffer-overflow\_372.zip

**command to reproduce**

./swfmill swf2xml  [sample file] /dev/null

**crash detail**

    ==55620==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62a0000051f3 at pc 0x000000440074 bp 0x7ffd17764350 sp 0x7ffd17763b00
    READ of size 1 at 0x62a0000051f3 thread T0
        #0 0x440073 in __interceptor_strlen.part.36 /home/bupt/Desktop/tools/llvm-12.0.1/llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:372
        #1 0x53570f in SWF::Reader::getString() /home/bupt/Desktop/swfmill/src/SWFReader.cpp:194:16
        #2 0x62559d in SWF::Symbol::parse(SWF::Reader*, int, SWF::Context*) /home/bupt/Desktop/swfmill/src/gSWFParser.cpp:1043:12
        #3 0x766d70 in SWF::Symbol::get(SWF::Reader*, int, SWF::Context*) /home/bupt/Desktop/swfmill/src/gSWFBasics.cpp:1293:7
        #4 0x668a01 in SWF::Export::parse(SWF::Reader*, int, SWF::Context*) /home/bupt/Desktop/swfmill/src/gSWFParser.cpp:7711:11
        #5 0x54120a in SWF::Tag::get(SWF::Reader*, int, SWF::Context*) /home/bupt/Desktop/swfmill/src/SWFTag.cpp:29:8
        #6 0x61e75d in SWF::Header::parse(SWF::Reader*, int, SWF::Context*) /home/bupt/Desktop/swfmill/src/gSWFParser.cpp:432:13
        #7 0x53c76a in SWF::File::load(_IO_FILE*, SWF::Context*, unsigned int) /home/bupt/Desktop/swfmill/src/SWFFile.cpp:88:11
        #8 0x54eda2 in swfmill_swf2xml(int, char**) /home/bupt/Desktop/swfmill/src/swfmill.cpp:135:20
        #9 0x7f15a18b0c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
        #10 0x4224d9 in _start (/home/bupt/Desktop/swfmill/src/swfmill+0x4224d9)
    
    0x62a0000051f3 is located 1 bytes to the right of 20466-byte region [0x62a000000200,0x62a0000051f2)
    allocated by thread T0 here:
        #0 0x4fa7c8 in operator new[](unsigned long) /home/bupt/Desktop/tools/llvm-12.0.1/llvm/projects/compiler-rt/lib/asan/asan_new_delete.cpp:102
        #1 0x53c625 in SWF::File::load(_IO_FILE*, SWF::Context*, unsigned int) /home/bupt/Desktop/swfmill/src/SWFFile.cpp:70:10
        #2 0x54eda2 in swfmill_swf2xml(int, char**) /home/bupt/Desktop/swfmill/src/swfmill.cpp:135:20
        #3 0x7f15a18b0c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
    
    SUMMARY: AddressSanitizer: heap-buffer-overflow /home/bupt/Desktop/tools/llvm-12.0.1/llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:372 in __interceptor_strlen.part.36
    Shadow bytes around the buggy address:
      0x0c547fff89e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      0x0c547fff89f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      0x0c547fff8a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      0x0c547fff8a10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      0x0c547fff8a20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    =>0x0c547fff8a30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[02]fa
      0x0c547fff8a40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c547fff8a50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c547fff8a60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c547fff8a70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c547fff8a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    Shadow byte legend (one shadow byte represents 8 application bytes):
      Addressable:           00
      Partially addressable: 01 02 03 04 05 06 07 
      Heap left redzone:       fa
      Freed heap region:       fd
      Stack left redzone:      f1
      Stack mid redzone:       f2
      Stack right redzone:     f3
      Stack after return:      f5
      Stack use after scope:   f8
      Global redzone:          f9
      Global init order:       f6
      Poisoned by user:        f7
      Container overflow:      fc
      Array cookie:            ac
      Intra object redzone:    bb
      ASan internal:           fe
      Left alloca redzone:     ca
      Right alloca redzone:    cb
      Shadow gap:              cc
    ==55620==ABORTING

CVE-2022-36143: heap-buffer-overflow  · Issue #62 · djcsdy/swfmill

SWFMill commit 53d7690 was discovered to contain a heap-buffer overflow via SWF::Reader::getU30().

**sample file**

id2\_heap-buffer-overflow\_getU30.zip

**command to reproduce**

./swfmill swf2xml  [sample file] /dev/null

**crash detail**

    ==55588==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62a0000051f3 at pc 0x000000534648 bp 0x7ffedf009d00 sp 0x7ffedf009cf8
    READ of size 1 at 0x62a0000051f3 thread T0
        #0 0x534647 in SWF::Reader::getU30() /home/bupt/Desktop/swfmill/src/SWFReader.cpp:84:8
        #1 0x535d7a in SWF::Reader::getPStringU30() /home/bupt/Desktop/swfmill/src/SWFReader.cpp:212:18
        #2 0x61c22a in SWF::String2::parse(SWF::Reader*, int, SWF::Context*) /home/bupt/Desktop/swfmill/src/gSWFParser.cpp:164:13
        #3 0x75d855 in SWF::String2::get(SWF::Reader*, int, SWF::Context*) /home/bupt/Desktop/swfmill/src/gSWFBasics.cpp:243:7
        #4 0x63d7d1 in SWF::Constants::parse(SWF::Reader*, int, SWF::Context*) /home/bupt/Desktop/swfmill/src/gSWFParser.cpp:3546:11
        #5 0x64010e in SWF::Action3::parse(SWF::Reader*, int, SWF::Context*) /home/bupt/Desktop/swfmill/src/gSWFParser.cpp:3676:12
        #6 0x672e50 in SWF::DoABC::parse(SWF::Reader*, int, SWF::Context*) /home/bupt/Desktop/swfmill/src/gSWFParser.cpp:8747:10
        #7 0x54120a in SWF::Tag::get(SWF::Reader*, int, SWF::Context*) /home/bupt/Desktop/swfmill/src/SWFTag.cpp:29:8
        #8 0x61e75d in SWF::Header::parse(SWF::Reader*, int, SWF::Context*) /home/bupt/Desktop/swfmill/src/gSWFParser.cpp:432:13
        #9 0x53c76a in SWF::File::load(_IO_FILE*, SWF::Context*, unsigned int) /home/bupt/Desktop/swfmill/src/SWFFile.cpp:88:11
        #10 0x54eda2 in swfmill_swf2xml(int, char**) /home/bupt/Desktop/swfmill/src/swfmill.cpp:135:20
        #11 0x7f3f0162dc86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
        #12 0x4224d9 in _start (/home/bupt/Desktop/swfmill/src/swfmill+0x4224d9)
    
    0x62a0000051f3 is located 1 bytes to the right of 20466-byte region [0x62a000000200,0x62a0000051f2)
    allocated by thread T0 here:
        #0 0x4fa7c8 in operator new[](unsigned long) /home/bupt/Desktop/tools/llvm-12.0.1/llvm/projects/compiler-rt/lib/asan/asan_new_delete.cpp:102
        #1 0x53c625 in SWF::File::load(_IO_FILE*, SWF::Context*, unsigned int) /home/bupt/Desktop/swfmill/src/SWFFile.cpp:70:10
        #2 0x54eda2 in swfmill_swf2xml(int, char**) /home/bupt/Desktop/swfmill/src/swfmill.cpp:135:20
        #3 0x7f3f0162dc86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
    
    SUMMARY: AddressSanitizer: heap-buffer-overflow /home/bupt/Desktop/swfmill/src/SWFReader.cpp:84:8 in SWF::Reader::getU30()
    Shadow bytes around the buggy address:
      0x0c547fff89e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      0x0c547fff89f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      0x0c547fff8a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      0x0c547fff8a10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      0x0c547fff8a20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    =>0x0c547fff8a30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[02]fa
      0x0c547fff8a40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c547fff8a50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c547fff8a60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c547fff8a70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c547fff8a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    Shadow byte legend (one shadow byte represents 8 application bytes):
      Addressable:           00
      Partially addressable: 01 02 03 04 05 06 07 
      Heap left redzone:       fa
      Freed heap region:       fd
      Stack left redzone:      f1
      Stack mid redzone:       f2
      Stack right redzone:     f3
      Stack after return:      f5
      Stack use after scope:   f8
      Global redzone:          f9
      Global init order:       f6
      Poisoned by user:        f7
      Container overflow:      fc
      Array cookie:            ac
      Intra object redzone:    bb
      ASan internal:           fe
      Left alloca redzone:     ca
      Right alloca redzone:    cb
      Shadow gap:              cc
    ==55588==ABORTING

CVE-2022-36142: heap-buffer-overflow in SWF::Reader::getU30() · Issue #61 · djcsdy/swfmill

SWFMill commit 53d7690 was discovered to contain a heap-buffer overflow via SWF::Writer::writeByte(unsigned char).

    =================================================================
    ==56715==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b00000133e at pc 0x0000005376d4 bp 0x7ffc19fbb2d0 sp 0x7ffc19fbb2c8
    WRITE of size 1 at 0x60b00000133e thread T0
        #0 0x5376d3 in SWF::Writer::writeByte(unsigned char) /home/bupt/Desktop/swfmill/src/SWFWriter.cpp:269:15
        #1 0x5376d3 in SWF::Writer::putByte(unsigned char) /home/bupt/Desktop/swfmill/src/SWFWriter.cpp:36:3
        #2 0x5418b1 in SWF::Action::writeHeader(SWF::Writer*, SWF::Context*, unsigned long) /home/bupt/Desktop/swfmill/src/SWFAction.cpp:32:6
        #3 0x6d1324 in SWF::Play::write(SWF::Writer*, SWF::Context*) /home/bupt/Desktop/swfmill/src/gSWFWriter.cpp:5918:9
        #4 0x6ac96a in SWF::Event::write(SWF::Writer*, SWF::Context*) /home/bupt/Desktop/swfmill/src/gSWFWriter.cpp:1466:16
        #5 0x6c1d39 in SWF::PlaceObject2::write(SWF::Writer*, SWF::Context*) /home/bupt/Desktop/swfmill/src/gSWFWriter.cpp:4114:16
        #6 0x6a2eac in SWF::Header::write(SWF::Writer*, SWF::Context*) /home/bupt/Desktop/swfmill/src/gSWFWriter.cpp:232:16
        #7 0x53d45c in SWF::File::save(_IO_FILE*, SWF::Context*) /home/bupt/Desktop/swfmill/src/SWFFile.cpp:158:11
        #8 0x54f8b9 in swfmill_xml2swf(int, char**) /home/bupt/Desktop/swfmill/src/swfmill.cpp:251:21
        #9 0x7f631bcfdc86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
        #10 0x4224d9 in _start (/home/bupt/Desktop/swfmill/src/swfmill+0x4224d9)
    
    0x60b00000133e is located 0 bytes to the right of 110-byte region [0x60b0000012d0,0x60b00000133e)
    allocated by thread T0 here:
        #0 0x4fa7c8 in operator new[](unsigned long) /home/bupt/桌面/tools/llvm-12.0.1/llvm/projects/compiler-rt/lib/asan/asan_new_delete.cpp:102
        #1 0x53d3ae in SWF::File::save(_IO_FILE*, SWF::Context*) /home/bupt/Desktop/swfmill/src/SWFFile.cpp:149:10
    
    SUMMARY: AddressSanitizer: heap-buffer-overflow /home/bupt/Desktop/swfmill/src/SWFWriter.cpp:269:15 in SWF::Writer::writeByte(unsigned char)
    Shadow bytes around the buggy address:
      0x0c167fff8210: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
      0x0c167fff8220: 00 00 00 00 06 fa fa fa fa fa fa fa fa fa 00 00
      0x0c167fff8230: 00 00 00 00 00 00 00 00 00 00 00 07 fa fa fa fa
      0x0c167fff8240: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
      0x0c167fff8250: 00 07 fa fa fa fa fa fa fa fa 00 00 00 00 00 00
    =>0x0c167fff8260: 00 00 00 00 00 00 00[06]fa fa fa fa fa fa fa fa
      0x0c167fff8270: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c167fff8280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c167fff8290: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c167fff82a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c167fff82b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    Shadow byte legend (one shadow byte represents 8 application bytes):
      Addressable:           00
      Partially addressable: 01 02 03 04 05 06 07 
      Heap left redzone:       fa
      Freed heap region:       fd
      Stack left redzone:      f1
      Stack mid redzone:       f2
      Stack right redzone:     f3
      Stack after return:      f5
      Stack use after scope:   f8
      Global redzone:          f9
      Global init order:       f6
      Poisoned by user:        f7
      Container overflow:      fc
      Array cookie:            ac
      Intra object redzone:    bb
      ASan internal:           fe
      Left alloca redzone:     ca
      Right alloca redzone:    cb
      Shadow gap:              cc
    ==56715==ABORTING

Tag

#buffer_overflow