{"action":"closed","issue":{"url":"https://api.github.com/repos/saitoha/libsixel/issues/108","repository_url":"https://api.github.com/repos/saitoha/libsixel","labels_url":"https://api.github.com/repos/saitoha/libsixel/issues/108/labels{/name}","comments_url":"https://api.github.com/repos/saitoha/libsixel/issues/108/comments","events_url":"https://api.github.com/repos/saitoha/libsixel/issues/108/events","html_url":"https://github.com/saitoha/libsixel/issues/108","id":536213002,"node_id":"MDU6SXNzdWU1MzYyMTMwMDI=","number":108,"title":"Segmentation fault (ASAN: SEGV on unknown address) in the load_pnm function of frompnm.c:288","user":{"login":"gutiniao","id":57210135,"node_id":"MDQ6VXNlcjU3MjEwMTM1","avatar_url":"https://avatars3.githubusercontent.com/u/57210135?v=4","gravatar_id":"","url":"https://api.github.com/users/gutiniao","html_url":"https://github.com/gutiniao","followers_url":"https://api.github.com/users/gutiniao/followers","following_url":"https://api.github.com/users/gutiniao/following{/other_user}","gists_url":"https://api.github.com/users/gutiniao/gists{/gist_id}","starred_url":"https://api.github.com/users/gutiniao/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gutiniao/subscriptions","organizations_url":"https://api.github.com/users/gutiniao/orgs","repos_url":"https://api.github.com/users/gutiniao/repos","events_url":"https://api.github.com/users/gutiniao/events{/privacy}","received_events_url":"https://api.github.com/users/gutiniao/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2019-12-11T08:22:08Z","updated_at":"2019-12-17T11:02:30Z","closed_at":"2019-12-17T11:02:30Z","author_association":"NONE","body":"A crafted input will lead to crash in frompnm.c at libsixel 1.8.2.\r\n\r\nTriggered by:\r\n./img2sixel 004-SEGV-load-pnm288\r\n\r\nPoc:\r\n[004-SEGV-load-pnm288](https://github.com/gutiniao/afltest/blob/master/004-SEGV-load-pnm288)\r\n\r\nThe gdb debug info:\r\n\r\n```\r\n# gdb ./img2sixel \r\n\\GNU gdb (Ubuntu 8.1-0ubuntu3.2) 8.1.0.20180409-git\r\nCopyright (C) 2018 Free Software Foundation, Inc.\r\nLicense GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>\r\nThis is free software: you are free to change and redistribute it.\r\nThere is NO WARRANTY, to the extent permitted by law.  Type \"show copying\"\r\nand \"show warranty\" for details.\r\nThis GDB was configured as \"x86_64-linux-gnu\".\r\nType \"show configuration\" for configuration details.\r\nFor bug reporting instructions, please see:\r\n<http://www.gnu.org/software/gdb/bugs/>.\r\nFind the GDB manual and other documentation resources online at:\r\n<http://www.gnu.org/software/gdb/documentation/>.\r\nFor help, type \"help\".\r\nType \"apropos word\" to search for commands related to \"word\"...\r\nReading symbols from ./img2sixel...done.\r\n(gdb) r 004-SEGV-load-pnm288\r\nStarting program: /usr/local/libsixel-fuzz/bin/img2sixel 004-SEGV-load-pnm288\r\n\r\nProgram received signal SIGSEGV, Segmentation fault.\r\nload_pnm (p=0x55555575b39c \"\", length=<optimized out>, allocator=<optimized out>, result=<optimized out>, psx=0x5555557635d8, psy=0x5555557635dc, ppalette=0x5555557635d0, pncolors=0x5555557635e0, ppixelformat=0x5555557635e4) at frompnm.c:288\r\n288\t            *(*result + (y * width + x) * 3 + 0) = component[0];\r\n(gdb) l\r\n283\t                break;\r\n284\t            default:\r\n285\t                goto unknown;\r\n286\t            }\r\n287\t\r\n288\t            *(*result + (y * width + x) * 3 + 0) = component[0];\r\n289\t            *(*result + (y * width + x) * 3 + 1) = component[1];\r\n290\t            *(*result + (y * width + x) * 3 + 2) = component[2];\r\n291\t        }\r\n292\t    }\r\n(gdb) bt\r\n#0  load_pnm (p=0x55555575b39c \"\", length=<optimized out>, allocator=<optimized out>, result=<optimized out>, psx=0x5555557635d8, psy=0x5555557635dc, ppalette=0x5555557635d0, pncolors=0x5555557635e0, ppixelformat=0x5555557635e4) at frompnm.c:288\r\n#1  0x00007ffff7b799e0 in load_with_builtin (pchunk=0x55555575b350, fstatic=fstatic@entry=0, fuse_palette=fuse_palette@entry=1, reqcolors=reqcolors@entry=256, bgcolor=bgcolor@entry=0x0, loop_control=<optimized out>, fn_load=0x7ffff7b96de0 <load_image_callback>, \r\n    context=0x55555575b290) at loader.c:801\r\n#2  0x00007ffff7b835cb in sixel_helper_load_image_file (filename=filename@entry=0x7fffffffe806 \"004-SEGV-load-pnm289\", fstatic=0, fuse_palette=fuse_palette@entry=1, reqcolors=256, bgcolor=0x0, loop_control=0, fn_load=0x7ffff7b96de0 <load_image_callback>, finsecure=0, \r\n    cancel_flag=0x55555575a050 <signaled>, context=0x55555575b290, allocator=0x55555575b260) at loader.c:1352\r\n#3  0x00007ffff7b9d42c in sixel_encoder_encode (encoder=0x55555575b290, filename=0x7fffffffe806 \"004-SEGV-load-pnm289\") at encoder.c:1737\r\n#4  0x0000555555555af6 in main (argc=2, argv=0x7fffffffe598) at img2sixel.c:457\r\n(gdb)\r\n```\r\n\r\n"}}
{"actor":{"display_login":"saitoha"}}