Closed glen-mac closed 6 years ago
Thanks, looks like recent merge 139a558edfda4d59e9404a622e031dd1dcac189e introduced this. Fix has been checked-in.
Issue wasn't technically "double-free" but realloc() and free() using now stale pointer...
Fix was to update the pointer to the buffer after realloc(): 5b38e8e1176ae0e81daf0a2cd6947f5a811678ef
I have come across a double free in jpegoptim. Please see the ASAN report below.
The crash file test case can be found here.
This was found in commit d23abf2c59692e0e3638ce8c89d98a3628c686b7.
The command to compile the binary is as follows:
CC=clang CXX=clang++ CFLAGS='-fsanitize=address,undefined -g -O2' CXXFLAGS=$CFLAGS make
This double-free could be used to assist in exploiting the software via heap manipulation resulting in code execution.