AddressSanitizer: heap-buffer-overflow in mz_zip_reader_init_file_v2 /LuPng/miniz.h:5299

[ambrosecm]

Desctiption

When using the mz_zip_reader_init_file_v2 function to handle a specific input. AddressSanitizer: heap-buffer-overflow in mz_zip_reader_init_file_v2 /LuPng/miniz.h:5299

LuPng/miniz.h

Lines 5291 to 5299 in 5ec546e

	mz_bool mz_zip_reader_init_file_v2(mz_zip_archive *pZip, const char *pFilename, mz_uint flags, mz_uint64 file_start_ofs, mz_uint64 archive_size)
	{
	mz_uint64 file_size;
	MZ_FILE *pFile;
	if ((!pZip) || (!pFilename) || ((archive_size) && (archive_size < MZ_ZIP_END_OF_CENTRAL_DIR_HEADER_SIZE)))
	return mz_zip_set_error(pZip, MZ_ZIP_INVALID_PARAMETER);
	pFile = MZ_FOPEN(pFilename, "rb");

Test Environment

Ubuntu 22.04.1, 64bit
LuPng(commits on Aug 28, 2021 master 5ec546e)
program source file

How to trigger

Download the poc file , program and run the following cmd:

 $ ./mz_zip_extract_archive_file_to_heap ./poc

Detail

ASAN report

(gdb) r
Starting program: /home/ambrose/vsproject/HIMFuzz/harness/output/LuPng_deepseek24/crashes/miniz.h/generate/mz_zip_extract_archive_file_to_heap/mz_zip_extract_archive_file_to_heap output/default/crashes/id:000000,sig:06,src:000000,time:64,execs:28,op:havoc,rep:14
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
=================================================================
==3182823==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c2ff6c2005e at pc 0x5555555e80db bp 0x7fffffffd500 sp 0x7fffffffccc0
READ of size 31 at 0x7c2ff6c2005e thread T0
[Detaching after fork from child process 3182826]
    #0 0x5555555e80da in fopen (/home/ambrose/vsproject/HIMFuzz/harness/output/LuPng_deepseek24/crashes/miniz.h/generate/mz_zip_extract_archive_file_to_heap/mz_zip_extract_archive_file_to_heap+0x940da) (BuildId: e2df9a6c1f81599201b3c19e0178e235e1cee7fa)
    #1 0x5555556de491 in mz_zip_reader_init_file_v2 /home/ambrose/vsproject/TestLib/LuPng/miniz.h:5299:13
    #2 0x55555577be19 in mz_zip_extract_archive_file_to_heap_v2 /home/ambrose/vsproject/TestLib/LuPng/miniz.h:8832:10
    #3 0x55555577c300 in mz_zip_extract_archive_file_to_heap /home/ambrose/vsproject/TestLib/LuPng/miniz.h:8855:12
    #4 0x555555780a9e in main /home/ambrose/vsproject/HIMFuzz/harness/output/LuPng_deepseek24/harness/code/miniz.h/generate/mz_zip_extract_archive_file_to_heap.c:40:27
    #5 0x7ffff7c29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #6 0x7ffff7c29e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #7 0x555555584434 in _start (/home/ambrose/vsproject/HIMFuzz/harness/output/LuPng_deepseek24/crashes/miniz.h/generate/mz_zip_extract_archive_file_to_heap/mz_zip_extract_archive_file_to_heap+0x30434) (BuildId: e2df9a6c1f81599201b3c19e0178e235e1cee7fa)

0x7c2ff6c2005e is located 0 bytes after 30-byte region [0x7c2ff6c20040,0x7c2ff6c2005e)
allocated by thread T0 here:
    #0 0x555555627424 in malloc (/home/ambrose/vsproject/HIMFuzz/harness/output/LuPng_deepseek24/crashes/miniz.h/generate/mz_zip_extract_archive_file_to_heap/mz_zip_extract_archive_file_to_heap+0xd3424) (BuildId: e2df9a6c1f81599201b3c19e0178e235e1cee7fa)
    #1 0x5555557808a4 in main /home/ambrose/vsproject/HIMFuzz/harness/output/LuPng_deepseek24/harness/code/miniz.h/generate/mz_zip_extract_archive_file_to_heap.c:29:22
    #2 0x7ffff7c29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/ambrose/vsproject/HIMFuzz/harness/output/LuPng_deepseek24/crashes/miniz.h/generate/mz_zip_extract_archive_file_to_heap/mz_zip_extract_archive_file_to_heap+0x940da) (BuildId: e2df9a6c1f81599201b3c19e0178e235e1cee7fa) in fopen
Shadow bytes around the buggy address:
  0x7c2ff6c1fd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7c2ff6c1fe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7c2ff6c1fe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7c2ff6c1ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7c2ff6c1ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x7c2ff6c20000: fa fa 00 00 00 fa fa fa 00 00 00[06]fa fa fa fa
  0x7c2ff6c20080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c2ff6c20100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c2ff6c20180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c2ff6c20200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c2ff6c20280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==3182823==ABORTING
[Inferior 1 (process 3182823) exited with code 01]