Segmentation fault (ASAN: SEGV on unknown address) in the load_pnm function of frompnm.c:288

[gutiniao]

A crafted input will lead to crash in frompnm.c at libsixel 1.8.2.

Triggered by: ./img2sixel 004-SEGV-load-pnm288

Poc: 004-SEGV-load-pnm288

The gdb debug info:

# gdb ./img2sixel 
\GNU gdb (Ubuntu 8.1-0ubuntu3.2) 8.1.0.20180409-git
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./img2sixel...done.
(gdb) r 004-SEGV-load-pnm288
Starting program: /usr/local/libsixel-fuzz/bin/img2sixel 004-SEGV-load-pnm288

Program received signal SIGSEGV, Segmentation fault.
load_pnm (p=0x55555575b39c "", length=<optimized out>, allocator=<optimized out>, result=<optimized out>, psx=0x5555557635d8, psy=0x5555557635dc, ppalette=0x5555557635d0, pncolors=0x5555557635e0, ppixelformat=0x5555557635e4) at frompnm.c:288
288             *(*result + (y * width + x) * 3 + 0) = component[0];
(gdb) l
283                 break;
284             default:
285                 goto unknown;
286             }
287 
288             *(*result + (y * width + x) * 3 + 0) = component[0];
289             *(*result + (y * width + x) * 3 + 1) = component[1];
290             *(*result + (y * width + x) * 3 + 2) = component[2];
291         }
292     }
(gdb) bt
#0  load_pnm (p=0x55555575b39c "", length=<optimized out>, allocator=<optimized out>, result=<optimized out>, psx=0x5555557635d8, psy=0x5555557635dc, ppalette=0x5555557635d0, pncolors=0x5555557635e0, ppixelformat=0x5555557635e4) at frompnm.c:288
#1  0x00007ffff7b799e0 in load_with_builtin (pchunk=0x55555575b350, fstatic=fstatic@entry=0, fuse_palette=fuse_palette@entry=1, reqcolors=reqcolors@entry=256, bgcolor=bgcolor@entry=0x0, loop_control=<optimized out>, fn_load=0x7ffff7b96de0 <load_image_callback>, 
    context=0x55555575b290) at loader.c:801
#2  0x00007ffff7b835cb in sixel_helper_load_image_file (filename=filename@entry=0x7fffffffe806 "004-SEGV-load-pnm289", fstatic=0, fuse_palette=fuse_palette@entry=1, reqcolors=256, bgcolor=0x0, loop_control=0, fn_load=0x7ffff7b96de0 <load_image_callback>, finsecure=0, 
    cancel_flag=0x55555575a050 <signaled>, context=0x55555575b290, allocator=0x55555575b260) at loader.c:1352
#3  0x00007ffff7b9d42c in sixel_encoder_encode (encoder=0x55555575b290, filename=0x7fffffffe806 "004-SEGV-load-pnm289") at encoder.c:1737
#4  0x0000555555555af6 in main (argc=2, argv=0x7fffffffe598) at img2sixel.c:457
(gdb)

[saitoha]

This problem is not reproduced on v1.8.3 because it is fixed by e17c0765. Thanks!

[carnil]

CVE-2019-20022 has been assigned for this issue.