{"action":"created","issue":{"url":"https://api.github.com/repos/openexr/openexr/issues/248","repository_url":"https://api.github.com/repos/openexr/openexr","labels_url":"https://api.github.com/repos/openexr/openexr/issues/248/labels{/name}","comments_url":"https://api.github.com/repos/openexr/openexr/issues/248/comments","events_url":"https://api.github.com/repos/openexr/openexr/issues/248/events","html_url":"https://github.com/openexr/openexr/issues/248","id":260829492,"node_id":"MDU6SXNzdWUyNjA4Mjk0OTI=","number":248,"title":"DOS bug while reading attributes in Header::readfrom","user":{"login":"noirfate","id":3271014,"node_id":"MDQ6VXNlcjMyNzEwMTQ=","avatar_url":"https://avatars1.githubusercontent.com/u/3271014?v=4","gravatar_id":"","url":"https://api.github.com/users/noirfate","html_url":"https://github.com/noirfate","followers_url":"https://api.github.com/users/noirfate/followers","following_url":"https://api.github.com/users/noirfate/following{/other_user}","gists_url":"https://api.github.com/users/noirfate/gists{/gist_id}","starred_url":"https://api.github.com/users/noirfate/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/noirfate/subscriptions","organizations_url":"https://api.github.com/users/noirfate/orgs","repos_url":"https://api.github.com/users/noirfate/repos","events_url":"https://api.github.com/users/noirfate/events{/privacy}","received_events_url":"https://api.github.com/users/noirfate/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2017-09-27T02:45:31Z","updated_at":"2018-11-08T13:15:30Z","closed_at":null,"author_association":"NONE","body":"I use ImageMagick to convert exr image, and it report allocate memory failure. After took a look, ImageMagick calls ImfOpenInputFile to open exr file, this function only takes filename as argument, so I think it is a openexr bug.\r\n\r\nVersion : \r\nImageMagick-7.0.7-4\r\nopenexr-2.2.0\r\nBoth are built with ASAN\r\n\r\nYou can get the POC file from https://github.com/noirfate/test/blob/master/test.exr and\r\nrun : magick test.exr 1.png\r\n\r\n```\r\nroot@test:~# ~/deps/bin/magick test.exr 1.png\r\n==8518==WARNING: AddressSanitizer failed to allocate 0xffffffffffffffff bytes\r\n==8518==AddressSanitizer's allocator is terminating the process instead of returning 0\r\n==8518==If you don't like this behavior set allocator_may_return_null=1\r\n==8518==AddressSanitizer CHECK failed: /home/snd-local/releases/4.0.1/release/final/llvm.src/projects/compiler-rt/lib/sanitizer_common/sanitizer_allocator.cc:221 \"((0)) != (0)\" (0x0, 0x0)\r\n    #0 0x4c898f in __asan::AsanCheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) /home/snd-local/releases/4.0.1/release/final/llvm.src/projects/compiler-rt/lib/asan/asan_rtl.cc:69:3\r\n    #1 0x4dc2ef in __sanitizer::CheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) /home/snd-local/releases/4.0.1/release/final/llvm.src/projects/compiler-rt/lib/sanitizer_common/sanitizer_termination.cc:79:5\r\n    #2 0x4cbc2f in __sanitizer::ReportAllocatorCannotReturnNull(bool) /home/snd-local/releases/4.0.1/release/final/llvm.src/projects/compiler-rt/lib/sanitizer_common/sanitizer_allocator.cc:221:3\r\n    #3 0x41bd9f in ReturnNullOrDieOnBadRequest /home/snd-local/releases/4.0.1/release/final/llvm.src/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_allocator_combined.h:88:5\r\n    #4 0x41bd9f in __asan::Allocator::Allocate(unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType, bool) /home/snd-local/releases/4.0.1/release/final/llvm.src/projects/compiler-rt/lib/asan/asan_allocator.cc:398\r\n    #5 0x4c1090 in __interceptor_malloc /home/snd-local/releases/4.0.1/release/final/llvm.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:67:10\r\n    #6 0x7f09bc789e77 in operator new(unsigned long) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0x8de77)\r\n    #7 0x7f09bc789f18 in operator new[](unsigned long) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0x8df18)\r\n    #8 0x7f09bef9619c in Imf_2_2::Array<char>::resizeErase(long) /root/dep_src/openexr-2.2.0/IlmImf/./ImfArray.h:196:14\r\n    #9 0x7f09bef9619c in Imf_2_2::OpaqueAttribute::readValueFrom(Imf_2_2::IStream&, int, int) /root/dep_src/openexr-2.2.0/IlmImf/ImfOpaqueAttribute.cpp:100\r\n    #10 0x7f09bef730c7 in Imf_2_2::Header::readFrom(Imf_2_2::IStream&, int&) /root/dep_src/openexr-2.2.0/IlmImf/ImfHeader.cpp:1219:9\r\n    #11 0x7f09bf0e9cf6 in Imf_2_2::MultiPartInputFile::initialize() /root/dep_src/openexr-2.2.0/IlmImf/ImfMultiPartInputFile.cpp:316:16\r\n    #12 0x7f09bf0ebe9d in Imf_2_2::MultiPartInputFile::MultiPartInputFile(Imf_2_2::IStream&, int, bool) /root/dep_src/openexr-2.2.0/IlmImf/ImfMultiPartInputFile.cpp:161:9\r\n    #13 0x7f09bef8072c in Imf_2_2::InputFile::compatibilityInitialize(Imf_2_2::IStream&) /root/dep_src/openexr-2.2.0/IlmImf/ImfInputFile.cpp:492:32\r\n    #14 0x7f09bef7f688 in Imf_2_2::InputFile::InputFile(char const*, int) /root/dep_src/openexr-2.2.0/IlmImf/ImfInputFile.cpp:362:13\r\n    #15 0x7f09befb68f0 in Imf_2_2::RgbaInputFile::RgbaInputFile(char const*, int) /root/dep_src/openexr-2.2.0/IlmImf/ImfRgbaFile.cpp:1166:21\r\n    #16 0x7f09bef534b2 in ImfOpenInputFile /root/dep_src/openexr-2.2.0/IlmImf/ImfCRgbaFile.cpp:1170:30\r\n    #17 0x7f09c62105c5 in ReadEXRImage /root/dep_src/ImageMagick-7.0.7-4/coders/exr.c:202:8\r\n    #18 0x7f09c5c1c3d8 in ReadImage /root/dep_src/ImageMagick-7.0.7-4/MagickCore/constitute.c:497:13\r\n    #19 0x7f09c5c1eaa4 in ReadImages /root/dep_src/ImageMagick-7.0.7-4/MagickCore/constitute.c:866:9\r\n    #20 0x7f09c55ddc29 in CLINoImageOperator /root/dep_src/ImageMagick-7.0.7-4/MagickWand/operation.c:4760:22\r\n    #21 0x7f09c55e034c in CLIOption /root/dep_src/ImageMagick-7.0.7-4/MagickWand/operation.c:5255:7\r\n    #22 0x7f09c54da6c7 in ProcessCommandOptions /root/dep_src/ImageMagick-7.0.7-4/MagickWand/magick-cli.c:424:13\r\n    #23 0x7f09c54db530 in MagickImageCommand /root/dep_src/ImageMagick-7.0.7-4/MagickWand/magick-cli.c:794:5\r\n    #24 0x7f09c550dc27 in MagickCommandGenesis /root/dep_src/ImageMagick-7.0.7-4/MagickWand/mogrify.c:183:14\r\n    #25 0x4ee15d in MagickMain /root/dep_src/ImageMagick-7.0.7-4/utilities/magick.c:149:10\r\n    #26 0x4ee15d in main /root/dep_src/ImageMagick-7.0.7-4/utilities/magick.c:180\r\n    #27 0x7f09bca9e82f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291\r\n    #28 0x41a2c8 in _start (/root/deps/bin/magick+0x41a2c8)\r\n```\r\n\r\nIn my debugging, the allocation size is controlled by attacker, so it not only can cause allocation failure and cause huge memory consumption as well.\r\n\r\nIn the POC file, 0x159~0x15c is the size\r\n```\r\n0000150: 0000 0013 2401 0000 0000 00cb 8401 0000\r\n```\r\n\r\nAnd the debug info : \r\n```\r\n1182            OPENEXR_IMF_INTERNAL_NAMESPACE::Xdr::read <OPENEXR_IMF_INTERNAL_NAMESPACE::StreamIO> (is, size);\r\n1: size = 203 (0xcb)\r\n(gdb) \r\n1184            AttributeMap::iterator i = _map.find (name);\r\n1: size = -889192448 (0xcb000000)\r\n(gdb) \r\n1186            if (i != _map.end())\r\n1: size = -889192448\r\n(gdb) \r\n1212                if (Attribute::knownType (typeName))\r\n1: size = -889192448\r\n(gdb) \r\n1215                    attr = new OpaqueAttribute (typeName);\r\n1: size = -889192448\r\n(gdb) \r\n1219                    attr->readValueFrom (is, size, version);\r\n```"},"comment":{"url":"https://api.github.com/repos/openexr/openexr/issues/comments/436989934","html_url":"https://github.com/openexr/openexr/issues/248#issuecomment-436989934","issue_url":"https://api.github.com/repos/openexr/openexr/issues/248","id":436989934,"node_id":"MDEyOklzc3VlQ29tbWVudDQzNjk4OTkzNA==","user":{"login":"pgajdos","id":4067843,"node_id":"MDQ6VXNlcjQwNjc4NDM=","avatar_url":"https://avatars3.githubusercontent.com/u/4067843?v=4","gravatar_id":"","url":"https://api.github.com/users/pgajdos","html_url":"https://github.com/pgajdos","followers_url":"https://api.github.com/users/pgajdos/followers","following_url":"https://api.github.com/users/pgajdos/following{/other_user}","gists_url":"https://api.github.com/users/pgajdos/gists{/gist_id}","starred_url":"https://api.github.com/users/pgajdos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pgajdos/subscriptions","organizations_url":"https://api.github.com/users/pgajdos/orgs","repos_url":"https://api.github.com/users/pgajdos/repos","events_url":"https://api.github.com/users/pgajdos/events{/privacy}","received_events_url":"https://api.github.com/users/pgajdos/received_events","type":"User","site_admin":false},"created_at":"2018-11-08T13:15:30Z","updated_at":"2018-11-08T13:15:30Z","author_association":"NONE","body":"Agreed, I think this could be closed as invalid and CVE rejected."}}
{"actor":{"display_login":"pgajdos"}}