AddressSanitizer: heap-buffer-overflow in bytesEqual /LuPng/lupng.c:248

[ambrosecm]

Desctiption

When using the handleChunk function to handle a specific input. AddressSanitizer: heap-buffer-overflow in bytesEqual /LuPng/lupng.c:248

LuPng/lupng.c

Lines 756 to 762 in 5ec546e

	static LU_INLINE int handleChunk(PngInfoStruct *info, PngChunk *chunk)
	{
	/* critical chunk */
	if (!(chunk->type[0] & 0x20)) {
	if (bytesEqual(chunk->type, (const uint8_t *)"IHDR", 4))
	return parseIhdr(info, chunk);
	if (bytesEqual(chunk->type, (const uint8_t *)"PLTE", 4))

LuPng/lupng.c

Lines 244 to 248 in 5ec546e

	static int bytesEqual(const uint8_t *a, const uint8_t *b, size_t count)
	{
	size_t i;
	for (i = 0; i < count; ++i) {
	if (*(a + i) != *(b + i))

Test Environment

Ubuntu 22.04.1, 64bit
LuPng(commits on Aug 28, 2021 master 5ec546e)
program source file

How to trigger

Download the poc file , program and run the following cmd:

 $ ./handleChunk ./poc

Detail

ASAN report

(gdb) r
Starting program: /home/ambrose/vsproject/HIMFuzz/harness/output/LuPng_deepseek24/crashes/lupng.c/luPngReadUC/handleChunk/handleChunk output/default/crashes/id:000000,sig:06,src:000002,time:3934,execs:1706,op:havoc,rep:4
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
=================================================================
==3163659==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c1ff6e20011 at pc 0x555555781f4b bp 0x7fffffffd700 sp 0x7fffffffd6f8
READ of size 1 at 0x7c1ff6e20011 thread T0
[Detaching after fork from child process 3163665]
    #0 0x555555781f4a in bytesEqual /home/ambrose/vsproject/TestLib/LuPng/lupng.c:248:13
    #1 0x555555788023 in handleChunk /home/ambrose/vsproject/TestLib/LuPng/lupng.c:762:13
    #2 0x55555579a2c3 in main /home/ambrose/vsproject/HIMFuzz/harness/output/LuPng_deepseek24/harness/code/lupng.c/luPngReadUC/handleChunk.c:57:18
    #3 0x7ffff7c29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #4 0x7ffff7c29e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #5 0x555555584444 in _start (/home/ambrose/vsproject/HIMFuzz/harness/output/LuPng_deepseek24/crashes/lupng.c/luPngReadUC/handleChunk/handleChunk+0x30444) (BuildId: 0e8ed4180148565bd59fb1fd98a68f703c3d8eef)

0x7c1ff6e20011 is located 0 bytes after 1-byte region [0x7c1ff6e20010,0x7c1ff6e20011)
allocated by thread T0 here:
    #0 0x555555627434 in malloc (/home/ambrose/vsproject/HIMFuzz/harness/output/LuPng_deepseek24/crashes/lupng.c/luPngReadUC/handleChunk/handleChunk+0xd3434) (BuildId: 0e8ed4180148565bd59fb1fd98a68f703c3d8eef)
    #1 0x555555799969 in readFile /home/ambrose/vsproject/HIMFuzz/harness/output/LuPng_deepseek24/harness/code/lupng.c/luPngReadUC/handleChunk.c:18:33
    #2 0x555555799ed2 in main /home/ambrose/vsproject/HIMFuzz/harness/output/LuPng_deepseek24/harness/code/lupng.c/luPngReadUC/handleChunk.c:36:23
    #3 0x7ffff7c29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/ambrose/vsproject/TestLib/LuPng/lupng.c:248:13 in bytesEqual
Shadow bytes around the buggy address:
  0x7c1ff6e1fd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7c1ff6e1fe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7c1ff6e1fe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7c1ff6e1ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7c1ff6e1ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x7c1ff6e20000: fa fa[01]fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c1ff6e20080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c1ff6e20100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c1ff6e20180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c1ff6e20200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c1ff6e20280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==3163659==ABORTING
[Inferior 1 (process 3163659) exited with code 01]