search

xsscx / macos-research

Welcome to Hoyt's macOS Fuzzing & Code Repo. Contribute Code or Open an Issue or Discussion.
https://srd.cx
GNU General Public License v3.0
38 stars 2 forks source link

Bug in fuzz function() that throws libc++abi: terminating due to uncaught exception of type booboo #4

Closed xsscx closed 10 months ago

xsscx commented 10 months ago

Bug in fuzz function() | Use-After-Free Bug. [libEXR & libAppleEXR]

Discussion & Analysis 

libc++abi: terminating due to uncaught exception of type booboo

Summary: The fuzz() function in Jackalope when using example/imageio.variants contain some over-release and/or ARC Issues. Is easier to show the File Information, Channels and Sub Sampling Crash with the PoC Flowers.exr using Python, then show the same issue in Sub Sampling that the Fuzz() function it encountering.

Reproduction of Sub Sampling Issue causing Abort() in libAppleEXR and all those Apple Apps on XNU.

>>> exr_file = OpenEXR.InputFile(file_path)
>>> header = exr_file.header()
>>> dw = header['dataWindow']
>>> size = (dw.max.x - dw.min.x + 1, dw.max.y - dw.min.y + 1)
>>> channels = header['channels'].keys()
>>> pt = Imath.PixelType(Imath.PixelType.FLOAT)
>>> channel_data = {c: np.frombuffer(exr_file.channel(c, pt), dtype=np.float32) for c in channels}
>>> print("Header Info:", header)
Header Info: {'channels': {'BY': HALF (2, 2), 'RY': HALF (2, 2), 'Y': HALF (1, 1)}, 'compression': B44_COMPRESSION, 'dataWindow': (0, 0) - (783, 733), 'displayWindow': (0, 0) - (783, 733), 'lineOrder': INCREASING_Y, 'owner': b'Copyright 2006 Industrial Light & Magic', 'pixelAspectRatio': 1.0, 'screenWindowCenter': (0.0, 0.0), 'screenWindowWidth': 1.0}
>>> print("Image Size:", size)
Image Size: (784, 734)
>>> print("Channels:", list(channels))
Channels: ['BY', 'RY', 'Y']
>>> channels = header['channels'].keys()
>>> pt = Imath.PixelType(Imath.PixelType.FLOAT)
>>> channel_data = {c: np.frombuffer(exr_file.channel(c, pt), dtype=np.float32) for c in channels}
>>> for c in channel_data:
...  channel_data[c] = channel_data[c].reshape(size[1], size[0])
...
Traceback (most recent call last):
  File "<stdin>", line 2, in <module>
ValueError: cannot reshape array of size 143864 into shape (734,784)
>>> exr_file.close()
>>> dw = header['dataWindow']
>>> size = (dw.max.x - dw.min.x + 1, dw.max.y - dw.min.y + 1)
>>> channels = header['channels'].keys()
>>> pt = Imath.PixelType(Imath.PixelType.FLOAT)
>>> channel_data = {c: np.frombuffer(exr_file.channel(c, pt), dtype=np.float32) for c in channels}
libc++abi: terminating due to uncaught exception of type Iex_3_2::ArgExc: Cannot find image attribute "dataWindow".
zsh: abort      python3
xsscx commented 10 months ago

Now using https://github.com/xsscx/macos-research/blob/main/code/imageio/imageio-test-003.m for A/B/C/D Testing. Needs more time to Fuzz the Fuzz() function for Abort().