[Debian-astro-maintainers] Bug#906530: dcraw: NULL dereference bug

[Jaeseung Choi]

Package: dcraw
Version: 9.27-1+b1
Severity: normal

Dear Maintainer,

Running dcraw with the attached poc file raises a NULL dereference bug.

Following gdb log shows the program resulting in segfault.

jason at debian-amd64-stretch:~/report/debian-latest/dcraw$ gdb dcraw -q
Reading symbols from dcraw...(no debugging symbols found)...done.
(gdb) run poc_null
Starting program: /usr/bin/dcraw poc_null
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
poc_null: Unexpected end of file

Program received signal SIGSEGV, Segmentation fault.
0x000055555555d01c in ?? ()
(gdb) x/i $rip
=> 0x55555555d01c:      mov    %r10w,(%r9,%rax,2)
(gdb) info reg r9 rax
r9             0x0      0
rax            0x0      0
(gdb) bt 5
#0  0x000055555555d01c in ?? ()
#1  0x000055555555b1bc in ?? ()
#2  0x00007ffff728f2e1 in __libc_start_main (main=0x555555559940, argc=2,
argv=0x7fffffffe638, init=<optimized out>, fini=<optimized out>,
rtld_fini=<optimized out>,
    stack_end=0x7fffffffe628) at ../csu/libc-start.c:291
#3  0x000055555555b4da in ?? ()

When we compiled the source with AddressSanitizer, it reports NULL
dereference bug in nokia_load_raw() function as follow.

jason at debian-amd64-stretch:~/report/source-latest/dcraw$ ./dcraw-9.27/dcraw
poc_null
poc_null: Unexpected end of file
ASAN:DEADLYSIGNAL
=================================================================
==5981==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc
0x00000051301a bp 0x7fffffffdc70 sp 0x7fffffffda40 T0)
    #0 0x513019 in nokia_load_raw
/home/jason/report/source-latest/dcraw/dcraw-9.27/dcraw.c:1972:28
    #1 0x5bcf96 in main
/home/jason/report/source-latest/dcraw/dcraw-9.27/dcraw.c:10150:10
    #2 0x7ffff6a4f2e0 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x202e0)
    #3 0x41c049 in _start
(/home/jason/report/source-latest/dcraw/dcraw-9.27/dcraw+0x41c049)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV
/home/jason/report/source-latest/dcraw/dcraw-9.27/dcraw.c:1972:28 in
nokia_load_raw
==5981==ABORTING


-- System Information:
Debian Release: 9.1
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.9.0-3-amd64 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8),
LANGUAGE=en_US:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages dcraw depends on:
ii  libc6            2.24-11+deb9u3
ii  libjpeg62-turbo  1:1.5.1-2
ii  liblcms2-2       2.8-4

dcraw recommends no packages.

Versions of packages dcraw suggests:
pn  gphoto2  <none>
ii  netpbm   2:10.0-15.3+b2

-- no debconf information
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-astro-maintainers/attachments/20180818/b1dec93f/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: poc_null
Type: application/octet-stream
Size: 47 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/debian-astro-maintainers/attachments/20180818/b1dec93f/attachment.obj>