[Debian-astro-maintainers] Bug#906529: dcraw: stack-based buffer overflow bug

[Jaeseung Choi]

Package: dcraw
Version: 9.27-1+b1
Severity: normal

A stack-based buffer overflow bug exists in dcraw.

Running the attached poc file raises a stack-based buffer overflow error,
which may allow a control flow hijack attack.

Following gdb log shows the program resulting in segfault.

jason at debian-amd64-stretch:~/report/debian-latest/dcraw$ gdb dcraw -q
Reading symbols from dcraw...(no debugging symbols found)...done.
(gdb) run poc_ovf
Starting program: /usr/bin/dcraw poc_ovf
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
strlen () at ../sysdeps/x86_64/strlen.S:137
137     ../sysdeps/x86_64/strlen.S: No such file or directory.
(gdb) bt 10
#0  strlen () at ../sysdeps/x86_64/strlen.S:137
#1  0x00007ffff72dfa84 in __libc_message (do_abort=do_abort at entry=2,
fmt=fmt at entry=0x7ffff73d3305 "*** %s ***: %s terminated\n") at
../sysdeps/posix/libc_fatal.c:109
#2  0x00007ffff73681f7 in __GI___fortify_fail (msg=msg at entry=0x7ffff73d32ed
"stack smashing detected") at fortify_fail.c:30
#3  0x00007ffff73681c0 in __stack_chk_fail () at stack_chk_fail.c:28
#4  0x000055555557ea4e in ?? ()
#5  0xffffffffffffffff in ?? ()
#6  0xffffffffffffffff in ?? ()
#7  0xffffffffffffffff in ?? ()
#8  0xffffffffffffffff in ?? ()
#9  0xffffffffffffffff in ?? ()
(More stack frames follow...)

Address sanitizer reports stack-buffer-overflow error in find_green()
function as follow.

jason at debian-amd64-stretch:~/report/source-latest/dcraw$ ./dcraw-9.27/dcraw
poc_ovf
=================================================================
==5868==ERROR: AddressSanitizer: stack-buffer-overflow on address
0x7fffffffc720 at pc 0x000000595ece bp 0x7fffffffa6b0 sp 0x7fffffffa6a8
WRITE of size 2 at 0x7fffffffc720 thread T0
    #0 0x595ecd in find_green
/home/jason/report/source-latest/dcraw/dcraw-9.27/dcraw.c:8147:19
    #1 0x59e77b in identify
/home/jason/report/source-latest/dcraw/dcraw-9.27/dcraw.c:8716:5
    #2 0x5b94f9 in main
/home/jason/report/source-latest/dcraw/dcraw-9.27/dcraw.c:10007:15
    #3 0x7ffff6a4f2e0 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x202e0)
    #4 0x41c049 in _start
(/home/jason/report/source-latest/dcraw/dcraw-9.27/dcraw+0x41c049)

Address 0x7fffffffc720 is located in stack of thread T0 at offset 8288 in
frame
    #0 0x595a6f in find_green
/home/jason/report/source-latest/dcraw/dcraw-9.27/dcraw.c:8133

  This frame has 2 object(s):
    [32, 8288) 'img' <== Memory access at offset 8288 overflows this
variable
    [8544, 8560) 'sum'
HINT: this may be a false positive if your program uses some custom stack
unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow
/home/jason/report/source-latest/dcraw/dcraw-9.27/dcraw.c:8147:19 in
find_green
Shadow bytes around the buggy address:
  0x10007fff7890: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff78a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff78b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff78c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff78d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10007fff78e0: 00 00 00 00[f2]f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2
  0x10007fff78f0: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2
  0x10007fff7900: f2 f2 f2 f2 00 00 f3 f3 00 00 00 00 00 00 00 00
  0x10007fff7910: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff7920: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff7930: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):

-- System Information:
Debian Release: 9.1
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.9.0-3-amd64 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8),
LANGUAGE=en_US:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages dcraw depends on:
ii  libc6            2.24-11+deb9u3
ii  libjpeg62-turbo  1:1.5.1-2
ii  liblcms2-2       2.8-4

dcraw recommends no packages.

Versions of packages dcraw suggests:
pn  gphoto2  <none>
ii  netpbm   2:10.0-15.3+b2

-- no debconf information
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-astro-maintainers/attachments/20180818/eb1d835e/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: poc_ovf
Type: application/octet-stream
Size: 85 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/debian-astro-maintainers/attachments/20180818/eb1d835e/attachment-0001.obj>