search

rockcarry / ffjpeg

a simple jpeg codec.
GNU General Public License v3.0
106 stars 46 forks source link

SEGV in jfif_encode() at jfif.c:763 #47

Closed Marsman1996 closed 2 years ago

Marsman1996 commented 2 years ago

This segment fault error is because in bmp_load(), when bmp's size is out of range, it returns without assign memory buffer to pb->pdata and did not exit the program. So the program crashes when it tries to access the pb->data, which is a invalid memory address.

Test Environment

Ubuntu 16.04, 64bit
ffjpeg (master d5cfd49)

How to trigger

$ ./ffjpeg -e $POC

POC FILE

https://github.com/Marsman1996/pocs/blob/master/ffjpeg/poc-ffjpeg-d5cfd49-jfif_encode-SEGV?raw=true

Details

gdb report

Breakpoint 1, bmp_load (pb=0x7fffffffdae0, file=0x7fffffffe070 "./poc-ffjpeg-d5cfd49-jfif_encode-SEGV") at bmp.c:45
45              printf("bmp's width * height is out of range !\n");
(gdb) n
bmp's width * height is out of range !
46              goto done;
(gdb) c
Continuing.

Breakpoint 2, jfif_encode (pb=0x7fffffffdae0) at jfif.c:757
757         bsrc = pb->pdata;
(gdb) n
758         ydst = yuv_datbuf[0];
(gdb) p bsrc
$2 = (BYTE *) 0x0
(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x0000000000520b78 in jfif_encode (pb=0x7fffffffdae0) at jfif.c:763
763                 rgb_to_yuv(bsrc[2], bsrc[1], bsrc[0], ydst, udst, vdst);
(gdb) bt
#0  0x0000000000520b78 in jfif_encode (pb=0x7fffffffdae0) at jfif.c:763
#1  0x0000000000515e58 in main (argc=3, argv=0x7fffffffdcf8) at ffjpeg.c:30