{"action":"opened","issue":{"url":"https://api.github.com/repos/libgd/libgd/issues/247","repository_url":"https://api.github.com/repos/libgd/libgd","labels_url":"https://api.github.com/repos/libgd/libgd/issues/247/labels{/name}","comments_url":"https://api.github.com/repos/libgd/libgd/issues/247/comments","events_url":"https://api.github.com/repos/libgd/libgd/issues/247/events","html_url":"https://github.com/libgd/libgd/issues/247","id":163166532,"number":247,"title":"A read out-of-bands was found in the parsing of TGA files","user":{"login":"gaa-cifasis","id":8667926,"avatar_url":"https://avatars.githubusercontent.com/u/8667926?v=3","gravatar_id":"","url":"https://api.github.com/users/gaa-cifasis","html_url":"https://github.com/gaa-cifasis","followers_url":"https://api.github.com/users/gaa-cifasis/followers","following_url":"https://api.github.com/users/gaa-cifasis/following{/other_user}","gists_url":"https://api.github.com/users/gaa-cifasis/gists{/gist_id}","starred_url":"https://api.github.com/users/gaa-cifasis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gaa-cifasis/subscriptions","organizations_url":"https://api.github.com/users/gaa-cifasis/orgs","repos_url":"https://api.github.com/users/gaa-cifasis/repos","events_url":"https://api.github.com/users/gaa-cifasis/events{/privacy}","received_events_url":"https://api.github.com/users/gaa-cifasis/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-06-30T13:33:42Z","updated_at":"2016-06-30T13:33:42Z","closed_at":null,"body":"Hi,\r\n\r\nA read out-of-bands was found in the parsing of TGA files using the last revision of libgd (a6a0e7feabb2a9738086a5dc96348f233c87fa79). Find [attached a small sample (it is a tga, not a really a txt)](https://github.com/libgd/libgd/files/341530/test.txt) to reproduce it. The ASAN report is here:\r\n\r\n```\r\n==25148==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62500000e91c at pc 0x7ffff6c8b446 bp 0x7fffffffdf40 sp 0x7fffffffdf38\r\nREAD of size 4 at 0x62500000e91c thread T0\r\n    #0 0x7ffff6c8b445 in gdImageCreateFromTgaCtx /tmp/libgd/src/gd_tga.c:103\r\n    #1 0x7ffff6c8ad26 in gdImageCreateFromTga /tmp/libgd/src/gd_tga.c:25\r\n    #2 0x401581 in main tga/bug00084.c:10\r\n    #3 0x7ffff686aec4 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)\r\n    #4 0x401458 (/tmp/libgd/tests/tga/.libs/lt-bug00084+0x401458)\r\n\r\n0x62500000e91c is located 0 bytes to the right of 8220-byte region [0x62500000c900,0x62500000e91c)\r\nallocated by thread T0 here:\r\n    #0 0x7ffff6f567df in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x547df)\r\n    #1 0x7ffff6ca49e1 in gdMalloc /tmp/libgd/src/gdhelpers.c:75\r\n    #2 0x7ffff6c8c254 in read_image_tga /tmp/libgd/src/gd_tga.c:226\r\n    #3 0x7ffff6c8af91 in gdImageCreateFromTgaCtx /tmp/libgd/src/gd_tga.c:74\r\n    #4 0x7ffff6c8ad26 in gdImageCreateFromTga /tmp/libgd/src/gd_tga.c:25\r\n    #5 0x401581 in main tga/bug00084.c:10\r\n    #6 0x7ffff686aec4 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)\r\n\r\nSUMMARY: AddressSanitizer: heap-buffer-overflow /tmp/libgd/src/gd_tga.c:103 gdImageCreateFromTgaCtx\r\n```\r\n\r\n(it is not related with bug 00084, i just re-used the test case to read an arbitrary TGA file)\r\n\r\nThis issue was found using QuickFuzz.\r\n\r\nRegards,\r\nGustavo."}}
{"actor":{"display_login":"gaa-cifasis"}}