Program received signal SIGILL, Illegal instruction. in mz_inflateInit2 at /LuPng/miniz.h:1722

[ambrosecm]

Desctiption

When using the mz_inflateInit2 function to handle a specific input. Program received signal SIGILL, Illegal instruction. in mz_inflateInit2 at /LuPng/miniz.h:1722

LuPng/miniz.h

Lines 1717 to 1722 in 5ec546e

	int mz_inflateInit2(mz_streamp pStream, int window_bits)
	{
	inflate_state *pDecomp;
	if (!pStream)
	return MZ_STREAM_ERROR;
	if ((window_bits != MZ_DEFAULT_WINDOW_BITS) && (-window_bits != MZ_DEFAULT_WINDOW_BITS))

The primary cause is that the parameter in mz_inflateInit2 is corrupted and don’t be checked, leading to a Illegal instruction.

Test Environment

Ubuntu 22.04.1, 64bit
LuPng(commits on Aug 28, 2021 master 5ec546e)
program source file

How to trigger

Download the poc file , program and run the following cmd:

 $ ./mz_inflateInit2 ./poc

Detail

GDB report

(gdb) r
Starting program: /home/ambrose/vsproject/HIMFuzz/harness/output/LuPng_deepseek24/crashes/miniz.h/generate/mz_inflateInit2/mz_inflateInit2 output/default/crashes/id:000000,sig:04,src:000000,time:626,execs:271,op:int32,pos:0,val:-2147483648
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Program received signal SIGILL, Illegal instruction.
0x0000555555676b90 in mz_inflateInit2 (pStream=0x7bfff5c09030, window_bits=-2147483648) at /home/ambrose/vsproject/TestLib/LuPng/miniz.h:1722
1722        if ((window_bits != MZ_DEFAULT_WINDOW_BITS) && (-window_bits != MZ_DEFAULT_WINDOW_BITS))
(gdb) bt
#0  0x0000555555676b90 in mz_inflateInit2 (pStream=0x7bfff5c09030, window_bits=-2147483648)
    at /home/ambrose/vsproject/TestLib/LuPng/miniz.h:1722
#1  0x000055555577fa9b in main (argc=2, argv=0x7fffffffdaa8)
    at output/LuPng_deepseek24/harness/code/miniz.h/generate/mz_inflateInit2.c:36