Skip to content

Test from #365 reveals more issues in LoaderExifJpeg #933

@awilfox

Description

@awilfox

Describe the bug
Nominally, a test failure.

Practically, potentially a much worse issue.

To Reproduce
Steps to reproduce the behaviour:

  1. Run the exiv2 testsuite on a non-x86 computer.

Expected behavior
test_run (bugfixes.github.test_CVE_2018_12265.AdditionOverflowInLoaderExifJpeg) ... OK

Actual behaviour
test_run (bugfixes.github.test_CVE_2018_12265.AdditionOverflowInLoaderExifJpeg) ... FAIL

Desktop (please complete the following information):

  • OS: Adélie Linux 1.0-BETA3
  • Compiler & Version: GCC 8.3.0
  • Compilation mode and/or compiler flags:
    • ppc64: -O2 -ggdb -mcpu=970 -mtune=power9 -maltivec -mlong-double-64 -fno-inline-small-functions
    • ppc: -O2 -ggdb -mcpu=G3 -fno-omit-frame-pointer -mfpu=dp_full
    • aarch64: -O2 -ggdb -mtune=cortex-a53

Additional context

======================================================================
FAIL: test_run (bugfixes.github.test_CVE_2018_12265.AdditionOverflowInLoaderExifJpeg)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/tests/system_tests.py", line 632, in test_run
    self.compare_stderr(i, command, processed_stderr, stderr)
  File "/usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/tests/system_tests.py", line 755, in compare_stderr
    msg="Standard error does not match"
  File "/usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/tests/system_tests.py", line 726, in _compare_output
    expected, got, msg=msg
AssertionError: 'Erro[431 chars]uncating the entry\n' != 'Erro[431 chars]uncating the entry\nUncaught exception: Overflow in addition\n'
  Error: Upper boundary of data for directory Image, entry 0x00fe is out of bounds: Offset = 0x0000002a, size = 64, exceeds buffer size by 22 Bytes; truncating the entry
  Warning: Directory Image, entry 0x0201: Strip 0 is outside of the data area; ignored.
  Warning: Directory Image, entry 0x0201: Strip 7 is outside of the data area; ignored.
  Error: Offset of directory Thumbnail, entry 0x0201 is out of bounds: Offset = 0x00000000; truncating the entry
+ Uncaught exception: Overflow in addition

Setting a breakpoint in the ctor of LoaderExifJpeg shows the following output:

on x86 (i586):

Breakpoint 1, (anonymous namespace)::LoaderExifJpeg::LoaderExifJpeg (parIdx=0, image=..., id=24, this=0xf7ca6ae0) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:549
549             if (Safe::add(offset_, size_) > static_cast<uint32_t>(image_.io().size()))
(gdb) bt
#0  (anonymous namespace)::LoaderExifJpeg::LoaderExifJpeg (parIdx=0, image=..., id=24, this=0xf7ca6ae0) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:549
#1  (anonymous namespace)::createLoaderExifJpeg (id=24, image=..., parIdx=0) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:557
#2  0xf7d980e6 in (anonymous namespace)::Loader::create (id=24, image=...) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:389
#3  0xf7d99ad8 in Exiv2::PreviewManager::getPreviewProperties (this=<optimized out>, this@entry=0xffffd3b4) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:1148
#4  0x565731e0 in Action::Extract::writePreviews (this=0xf7ffde30) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/actions.cpp:1134
#5  0x5657b43f in Action::Extract::run (this=0xf7ffde30, path=...) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/actions.cpp:1051
#6  0x5655e52f in main (argc=3, argv=0xffffd5e4) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/exiv2.cpp:169

on ppc:

Breakpoint 1, (anonymous namespace)::LoaderExifJpeg::LoaderExifJpeg (parIdx=16750280, image=..., id=-8804, this=0xf7ff91b0) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:549
549             if (Safe::add(offset_, size_) > static_cast<uint32_t>(image_.io().size()))
(gdb) bt
#0  (anonymous namespace)::LoaderExifJpeg::LoaderExifJpeg (parIdx=16750280, image=..., id=-8804, this=0xf7ff91b0) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:549
#1  (anonymous namespace)::createLoaderExifJpeg (id=id@entry=24, image=..., parIdx=parIdx@entry=0) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:557
#2  0xf7d07c30 in (anonymous namespace)::Loader::create (id=id@entry=24, image=...) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:389
#3  0xf7d096c0 in Exiv2::PreviewManager::getPreviewProperties (this=this@entry=0xffffdf54) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:1148
#4  0x0041ac74 in Action::Extract::writePreviews (this=this@entry=0xf7ffe4d0) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/actions.cpp:1134
#5  0x004223e0 in Action::Extract::run (this=0xf7ffe4d0, path=...) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/actions.cpp:1051
#6  0x00406b7c in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/exiv2.cpp:169

on aarch64:

Breakpoint 1, (anonymous namespace)::LoaderExifJpeg::LoaderExifJpeg (parIdx=-1210642848, image=..., id=-4200, this=0xaaaaaaae7460) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:549
549             if (Safe::add(offset_, size_) > static_cast<uint32_t>(image_.io().size()))
(gdb) bt
#0  (anonymous namespace)::LoaderExifJpeg::LoaderExifJpeg (parIdx=-1210642848, image=..., id=-4200, this=0xaaaaaaae7460) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:549
#1  (anonymous namespace)::createLoaderExifJpeg (id=id@entry=24, image=..., parIdx=parIdx@entry=0) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:557
#2  0x0000ffffb7d72470 in (anonymous namespace)::Loader::create (id=id@entry=24, image=...) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:389
#3  0x0000ffffb7d73c78 in Exiv2::PreviewManager::getPreviewProperties (this=this@entry=0xfffffffff1f8) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:1148
#4  0x0000aaaaaaac3dec in Action::Extract::writePreviews (this=this@entry=0xffffb7acdf60) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/actions.cpp:1134
#5  0x0000aaaaaaacaee8 in Action::Extract::run (this=0xffffb7acdf60, path=...) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/actions.cpp:1051
#6  0x0000aaaaaaab1bd0 in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/exiv2.cpp:169

Note the really weird parIdx and id in the not-x86 runs.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions