Describe the bug
Nominally, a test failure.
Practically, potentially a much worse issue.
To Reproduce
Steps to reproduce the behaviour:
- Run the exiv2 testsuite on a non-x86 computer.
Expected behavior
test_run (bugfixes.github.test_CVE_2018_12265.AdditionOverflowInLoaderExifJpeg) ... OK
Actual behaviour
test_run (bugfixes.github.test_CVE_2018_12265.AdditionOverflowInLoaderExifJpeg) ... FAIL
Desktop (please complete the following information):
- OS: Adélie Linux 1.0-BETA3
- Compiler & Version: GCC 8.3.0
- Compilation mode and/or compiler flags:
- ppc64:
-O2 -ggdb -mcpu=970 -mtune=power9 -maltivec -mlong-double-64 -fno-inline-small-functions
- ppc:
-O2 -ggdb -mcpu=G3 -fno-omit-frame-pointer -mfpu=dp_full
- aarch64:
-O2 -ggdb -mtune=cortex-a53
Additional context
======================================================================
FAIL: test_run (bugfixes.github.test_CVE_2018_12265.AdditionOverflowInLoaderExifJpeg)
----------------------------------------------------------------------
Traceback (most recent call last):
File "/usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/tests/system_tests.py", line 632, in test_run
self.compare_stderr(i, command, processed_stderr, stderr)
File "/usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/tests/system_tests.py", line 755, in compare_stderr
msg="Standard error does not match"
File "/usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/tests/system_tests.py", line 726, in _compare_output
expected, got, msg=msg
AssertionError: 'Erro[431 chars]uncating the entry\n' != 'Erro[431 chars]uncating the entry\nUncaught exception: Overflow in addition\n'
Error: Upper boundary of data for directory Image, entry 0x00fe is out of bounds: Offset = 0x0000002a, size = 64, exceeds buffer size by 22 Bytes; truncating the entry
Warning: Directory Image, entry 0x0201: Strip 0 is outside of the data area; ignored.
Warning: Directory Image, entry 0x0201: Strip 7 is outside of the data area; ignored.
Error: Offset of directory Thumbnail, entry 0x0201 is out of bounds: Offset = 0x00000000; truncating the entry
+ Uncaught exception: Overflow in addition
Setting a breakpoint in the ctor of LoaderExifJpeg shows the following output:
on x86 (i586):
Breakpoint 1, (anonymous namespace)::LoaderExifJpeg::LoaderExifJpeg (parIdx=0, image=..., id=24, this=0xf7ca6ae0) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:549
549 if (Safe::add(offset_, size_) > static_cast<uint32_t>(image_.io().size()))
(gdb) bt
#0 (anonymous namespace)::LoaderExifJpeg::LoaderExifJpeg (parIdx=0, image=..., id=24, this=0xf7ca6ae0) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:549
#1 (anonymous namespace)::createLoaderExifJpeg (id=24, image=..., parIdx=0) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:557
#2 0xf7d980e6 in (anonymous namespace)::Loader::create (id=24, image=...) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:389
#3 0xf7d99ad8 in Exiv2::PreviewManager::getPreviewProperties (this=<optimized out>, this@entry=0xffffd3b4) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:1148
#4 0x565731e0 in Action::Extract::writePreviews (this=0xf7ffde30) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/actions.cpp:1134
#5 0x5657b43f in Action::Extract::run (this=0xf7ffde30, path=...) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/actions.cpp:1051
#6 0x5655e52f in main (argc=3, argv=0xffffd5e4) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/exiv2.cpp:169
on ppc:
Breakpoint 1, (anonymous namespace)::LoaderExifJpeg::LoaderExifJpeg (parIdx=16750280, image=..., id=-8804, this=0xf7ff91b0) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:549
549 if (Safe::add(offset_, size_) > static_cast<uint32_t>(image_.io().size()))
(gdb) bt
#0 (anonymous namespace)::LoaderExifJpeg::LoaderExifJpeg (parIdx=16750280, image=..., id=-8804, this=0xf7ff91b0) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:549
#1 (anonymous namespace)::createLoaderExifJpeg (id=id@entry=24, image=..., parIdx=parIdx@entry=0) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:557
#2 0xf7d07c30 in (anonymous namespace)::Loader::create (id=id@entry=24, image=...) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:389
#3 0xf7d096c0 in Exiv2::PreviewManager::getPreviewProperties (this=this@entry=0xffffdf54) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:1148
#4 0x0041ac74 in Action::Extract::writePreviews (this=this@entry=0xf7ffe4d0) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/actions.cpp:1134
#5 0x004223e0 in Action::Extract::run (this=0xf7ffe4d0, path=...) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/actions.cpp:1051
#6 0x00406b7c in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/exiv2.cpp:169
on aarch64:
Breakpoint 1, (anonymous namespace)::LoaderExifJpeg::LoaderExifJpeg (parIdx=-1210642848, image=..., id=-4200, this=0xaaaaaaae7460) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:549
549 if (Safe::add(offset_, size_) > static_cast<uint32_t>(image_.io().size()))
(gdb) bt
#0 (anonymous namespace)::LoaderExifJpeg::LoaderExifJpeg (parIdx=-1210642848, image=..., id=-4200, this=0xaaaaaaae7460) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:549
#1 (anonymous namespace)::createLoaderExifJpeg (id=id@entry=24, image=..., parIdx=parIdx@entry=0) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:557
#2 0x0000ffffb7d72470 in (anonymous namespace)::Loader::create (id=id@entry=24, image=...) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:389
#3 0x0000ffffb7d73c78 in Exiv2::PreviewManager::getPreviewProperties (this=this@entry=0xfffffffff1f8) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/preview.cpp:1148
#4 0x0000aaaaaaac3dec in Action::Extract::writePreviews (this=this@entry=0xffffb7acdf60) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/actions.cpp:1134
#5 0x0000aaaaaaacaee8 in Action::Extract::run (this=0xffffb7acdf60, path=...) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/actions.cpp:1051
#6 0x0000aaaaaaab1bd0 in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/packages/user/exiv2/src/exiv2-0.27.1-Source/src/exiv2.cpp:169
Note the really weird parIdx and id in the not-x86 runs.
Describe the bug
Nominally, a test failure.
Practically, potentially a much worse issue.
To Reproduce
Steps to reproduce the behaviour:
Expected behavior
test_run (bugfixes.github.test_CVE_2018_12265.AdditionOverflowInLoaderExifJpeg) ... OK
Actual behaviour
test_run (bugfixes.github.test_CVE_2018_12265.AdditionOverflowInLoaderExifJpeg) ... FAIL
Desktop (please complete the following information):
-O2 -ggdb -mcpu=970 -mtune=power9 -maltivec -mlong-double-64 -fno-inline-small-functions-O2 -ggdb -mcpu=G3 -fno-omit-frame-pointer -mfpu=dp_full-O2 -ggdb -mtune=cortex-a53Additional context
Setting a breakpoint in the ctor of LoaderExifJpeg shows the following output:
on x86 (i586):
on ppc:
on aarch64:
Note the really weird parIdx and id in the not-x86 runs.