{"action":"opened","issue":{"url":"https://api.github.com/repos/uclouvain/openjpeg/issues/1220","repository_url":"https://api.github.com/repos/uclouvain/openjpeg","labels_url":"https://api.github.com/repos/uclouvain/openjpeg/issues/1220/labels{/name}","comments_url":"https://api.github.com/repos/uclouvain/openjpeg/issues/1220/comments","events_url":"https://api.github.com/repos/uclouvain/openjpeg/issues/1220/events","html_url":"https://github.com/uclouvain/openjpeg/issues/1220","id":528514696,"node_id":"MDU6SXNzdWU1Mjg1MTQ2OTY=","number":1220,"title":"pdf2jp2 use NULL pointer cause crash","user":{"login":"xinali","id":7126894,"node_id":"MDQ6VXNlcjcxMjY4OTQ=","avatar_url":"https://avatars0.githubusercontent.com/u/7126894?v=4","gravatar_id":"","url":"https://api.github.com/users/xinali","html_url":"https://github.com/xinali","followers_url":"https://api.github.com/users/xinali/followers","following_url":"https://api.github.com/users/xinali/following{/other_user}","gists_url":"https://api.github.com/users/xinali/gists{/gist_id}","starred_url":"https://api.github.com/users/xinali/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xinali/subscriptions","organizations_url":"https://api.github.com/users/xinali/orgs","repos_url":"https://api.github.com/users/xinali/repos","events_url":"https://api.github.com/users/xinali/events{/privacy}","received_events_url":"https://api.github.com/users/xinali/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2019-11-26T06:20:53Z","updated_at":"2019-11-26T06:20:53Z","closed_at":null,"author_association":"NONE","body":"Crash:\r\n\r\n```\r\n➜  tests git:(master) ✗ gdb pdf2jp2\r\npwndbg: loaded 170 commands. Type pwndbg [filter] for a list.\r\npwndbg: created $rebase, $ida gdb functions (can be used with print/break)\r\nReading symbols from pdf2jp2...done.\r\npwndbg> r test.pdf\r\nStarting program: /home/openjpeg/tests/pdf2jp2 test.pdf\r\n\r\nProgram received signal SIGSEGV, Segmentation fault.\r\nrawmemchr () at ../sysdeps/x86_64/rawmemchr.S:37\r\n37      ../sysdeps/x86_64/rawmemchr.S: No such file or directory.\r\nLEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA\r\n──────────────────────────────────────────────────────────────────────────────────[ REGISTERS ]───────────────────────────────────────────────────────────────────────────────────\r\n RAX  0x7ffff7dd07a0 (_IO_str_jumps) ◂— 0x0\r\n RBX  0x7fffffffcb40 ◂— 0xfbad8000\r\n RCX  0x0\r\n RDX  0x0\r\n RDI  0x0\r\n RSI  0x0\r\n R8   0x0\r\n R9   0x0\r\n R10  0x361\r\n R11  0x7ffff7ab7070 (__strstr_sse2_unaligned) ◂— movzx  eax, byte ptr [rsi]\r\n R12  0x0\r\n R13  0x0\r\n R14  0x0\r\n R15  0x1\r\n RBP  0x401c60 ◂— '/Length  %d/'\r\n RSP  0x7fffffffcb08 —▸ 0x7ffff7a89ff2 (_IO_str_init_static_internal+34) ◂— mov    rbp, rax\r\n RIP  0x7ffff7aa356f (rawmemchr+31) ◂— movdqu xmm0, xmmword ptr [rdi]\r\n────────────────────────────────────────────────────────────────────────────────────[ DISASM ]────────────────────────────────────────────────────────────────────────────────────\r\n ► 0x7ffff7aa356f <rawmemchr+31>     movdqu xmm0, xmmword ptr [rdi]\r\n   0x7ffff7aa3573 <rawmemchr+35>     pcmpeqb xmm0, xmm1\r\n   0x7ffff7aa3577 <rawmemchr+39>     pmovmskb eax, xmm0\r\n   0x7ffff7aa357b <rawmemchr+43>     test   eax, eax\r\n   0x7ffff7aa357d <rawmemchr+45>     jne    rawmemchr+464 <0x7ffff7aa3720>\r\n    ↓\r\n   0x7ffff7aa3720 <rawmemchr+464>    bsf    eax, eax\r\n   0x7ffff7aa3723 <rawmemchr+467>    add    rax, rdi\r\n   0x7ffff7aa3726 <rawmemchr+470>    ret\r\n\r\n   0x7ffff7aa3727 <rawmemchr+471>    nop    word ptr [rax + rax]\r\n   0x7ffff7aa3730 <rawmemchr+480>    bsf    eax, eax\r\n   0x7ffff7aa3733 <rawmemchr+483>    lea    rax, [rax + rdi + 0x10]\r\n────────────────────────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────────────────────────\r\n00:0000│ rsp  0x7fffffffcb08 —▸ 0x7ffff7a89ff2 (_IO_str_init_static_internal+34) ◂— mov    rbp, rax\r\n01:0008│      0x7fffffffcb10 ◂— 0x0\r\n02:0010│      0x7fffffffcb18 ◂— 0x399\r\n03:0018│      0x7fffffffcb20 —▸ 0x401c60 ◂— '/Length  %d/'\r\n04:0020│      0x7fffffffcb28 —▸ 0x7fffffffcc68 ◂— 0x3000000010\r\n05:0028│      0x7fffffffcb30 ◂— 0x0\r\n06:0030│      0x7fffffffcb38 —▸ 0x7ffff7a7d267 (vsscanf+87) ◂— mov    rdx, r12\r\n07:0038│ rbx  0x7fffffffcb40 ◂— 0xfbad8000\r\n──────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────────────────────────\r\n ► f 0     7ffff7aa356f rawmemchr+31\r\n   f 1     7ffff7a89ff2 _IO_str_init_static_internal+34\r\n   f 2     7ffff7a7d267 vsscanf+87\r\n   f 3     7ffff7a77917 sscanf+135\r\n   f 4           4010eb main+1531\r\n   f 5     7ffff7a2d830 __libc_start_main+240\r\n──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────\r\nProgram received signal SIGSEGV (fault address 0x0)\r\npwndbg> bt\r\n#0  rawmemchr () at ../sysdeps/x86_64/rawmemchr.S:37\r\n#1  0x00007ffff7a89ff2 in _IO_str_init_static_internal (sf=sf@entry=0x7fffffffcb40, ptr=ptr@entry=0x0, size=size@entry=0, pstart=pstart@entry=0x0) at strops.c:41\r\n#2  0x00007ffff7a7d267 in _IO_vsscanf (string=0x0, format=0x401c60 \"/Length  %d/\", args=args@entry=0x7fffffffcc68) at iovsscanf.c:40\r\n#3  0x00007ffff7a77917 in __sscanf (s=<optimized out>, format=format@entry=0x401c60 \"/Length  %d/\") at sscanf.c:32\r\n#4  0x00000000004010eb in main (argc=argc@entry=2, argv=argv@entry=0x7fffffffe398) at pdf2jp2.c:114\r\n#5  0x00007ffff7a2d830 in __libc_start_main (main=0x400af0 <main>, argc=2, argv=0x7fffffffe398, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe388) at ../csu/libc-start.c:291\r\n#6  0x00000000004016e9 in _start ()\r\n```\r\n\r\nCheck:\r\n```\r\npwndbg> b pdf2jp2.c:114\r\nBreakpoint 1 at 0x4010d7: file pdf2jp2.c, line 114.\r\npwndbg> r test.pdf\r\nStarting program: /home/openjpeg/tests/pdf2jp2 test.pdf\r\n\r\nBreakpoint 1, main (argc=argc@entry=2, argv=argv@entry=0x7fffffffe398) at pdf2jp2.c:114\r\n114           s = sscanf(s2, \"/Length  %d/\", &len);\r\nLEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA\r\n──────────────────────────────────────────────────────────────────────────────────[ REGISTERS ]───────────────────────────────────────────────────────────────────────────────────\r\n RAX  0x0\r\n RBX  0x399\r\n RCX  0x6874676e654c2f\r\n RDX  0x4c\r\n RDI  0x7fffffffce70 ◂— 0x646f636544000a51 /* 'Q\\n' */\r\n RSI  0x7fffffffd070 ◂— 0x6874676e654c2f /* '/Length' */\r\n R8   0x100004\r\n R9   0x0\r\n R10  0x361\r\n R11  0x7ffff7ab7070 (__strstr_sse2_unaligned) ◂— movzx  eax, byte ptr [rsi]\r\n R12  0x0\r\n R13  0x0\r\n R14  0x0\r\n R15  0x1\r\n RBP  0x604010 ◂— 0xfbad2488\r\n RSP  0x7fffffffcd40 —▸ 0x7fffffffd279 ◂— 0x2020202020202020 ('        ')\r\n RIP  0x4010d7 (main+1511) ◂— lea    rdx, [rsp + 0x1c]\r\n────────────────────────────────────────────────────────────────────────────────────[ DISASM ]────────────────────────────────────────────────────────────────────────────────────\r\n ► 0x4010d7 <main+1511>    lea    rdx, [rsp + 0x1c]\r\n   0x4010dc <main+1516>    mov    rdi, rax\r\n   0x4010df <main+1519>    mov    esi, 0x401c60\r\n   0x4010e4 <main+1524>    xor    eax, eax\r\n   0x4010e6 <main+1526>    call   sscanf@plt <0x400a50>\r\n\r\n   0x4010eb <main+1531>    cmp    eax, 1\r\n   0x4010ee <main+1534>    jne    main+852 <0x400e44>\r\n\r\n   0x4010f4 <main+1540>    lea    rsp, [rsp - 0x98]\r\n   0x4010fc <main+1548>    mov    qword ptr [rsp], rdx\r\n   0x401100 <main+1552>    mov    qword ptr [rsp + 8], rcx\r\n   0x401105 <main+1557>    mov    qword ptr [rsp + 0x10], rax\r\n────────────────────────────────────────────────────────────────────────────────[ SOURCE (CODE) ]─────────────────────────────────────────────────────────────────────────────────\r\nIn file: /home/openjpeg/tests/pdf2jp2.c\r\n   109       assert( ret == 0 );\r\n   110       r = fgets(buffer, sizeof(buffer), f);\r\n   111       assert( r );\r\n   112       const char needle2[] = \"/Length\";\r\n   113       char * s2 = strstr(buffer, needle2);\r\n ► 114       s = sscanf(s2, \"/Length  %d/\", &len);\r\n   115       }\r\n   116     if( s == 1 )\r\n   117       {\r\n   118       FILE *jp2;\r\n   119       int j;\r\n────────────────────────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────────────────────────\r\n00:0000│ rsp  0x7fffffffcd40 —▸ 0x7fffffffd279 ◂— 0x2020202020202020 ('        ')\r\n01:0008│      0x7fffffffcd48 —▸ 0x7fffffffe669 ◂— 'test.pdf'\r\n02:0010│      0x7fffffffcd50 ◂— 0x0\r\n... ↓\r\n04:0020│      0x7fffffffcd60 ◂— 0x399\r\n05:0028│      0x7fffffffcd68 ◂— 0x0\r\n... ↓\r\n──────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────────────────────────\r\n ► f 0           4010d7 main+1511\r\n   f 1     7ffff7a2d830 __libc_start_main+240\r\n──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────\r\nBreakpoint pdf2jp2.c:114\r\npwndbg> p s2\r\n$1 = 0x0\r\npwndbg> p len\r\n$2 = 0\r\npwndbg> p *s2\r\nCannot access memory at address 0x0\r\n```\r\n"}}
{"actor":{"display_login":"xinali"}}