Heap-buffer-overflow in get_unaligned_be32

==445397==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x612000001ad2 at pc 0x00000124ec6a bp 0x7ffd6245f1e0 sp 0x7ffd6245f1d8
READ of size 1 at 0x612000001ad2 thread T0
    #0 0x124ec69 in get_unaligned_be32 /src/cairo/_builddir/../src/cairoint.h:257:60
    #1 0x124f02a in _jbig2_get_next_segment /src/cairo/_builddir/../src/cairo-image-info.c:351:13
    #2 0x124ede6 in _cairo_image_info_get_jbig2_info /src/cairo/_builddir/../src/cairo-image-info.c:412:6
    #3 0x11f12d3 in _cairo_pdf_surface_emit_jbig2_image /src/cairo/_builddir/../src/cairo-pdf-surface.c:3219:14
    #4 0x11e2572 in _cairo_pdf_surface_emit_surface /src/cairo/_builddir/../src/cairo-pdf-surface.c:3744:11
    #5 0x11e7e65 in _cairo_pdf_surface_add_source_surface /src/cairo/_builddir/../src/cairo-pdf-surface.c:1735:14
    #6 0x11e5d51 in _cairo_pdf_surface_paint_surface_pattern /src/cairo/_builddir/../src/cairo-pdf-surface.c:5023:11
    #7 0x11e5418 in _cairo_pdf_surface_paint_pattern /src/cairo/_builddir/../src/cairo-pdf-surface.c:5166:9
    #8 0x11db7cc in _cairo_pdf_surface_paint /src/cairo/_builddir/../src/cairo-pdf-surface.c:7988:11
    #9 0x11a6f6c in _cairo_surface_paint /src/cairo/_builddir/../src/cairo-surface.c:2199:14
    #10 0x11a12d7 in _cairo_surface_wrapper_paint /src/cairo/_builddir/../src/cairo-surface-wrapper.c:162:14
    #11 0x11817de in _cairo_recording_surface_replay_internal /src/cairo/_builddir/../src/cairo-recording-surface.c:1862:15
    #12 0x11834f0 in _cairo_recording_surface_replay_region /src/cairo/_builddir/../src/cairo-recording-surface.c:2235:12
    #13 0x126ea1c in _paint_page /src/cairo/_builddir/../src/cairo-paginated-surface.c:469:11
    #14 0x126d9be in _cairo_paginated_surface_show_page /src/cairo/_builddir/../src/cairo-paginated-surface.c:583:14
    #15 0x11acadf in cairo_surface_show_page /src/cairo/_builddir/../src/cairo-surface.c:2506:40
    #16 0x6a33f0 in LLVMFuzzerTestOneInput /src/poppler/glib/tests/fuzzing/pdf_draw_fuzzer.cc:66:9
    #17 0x5a91d3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:599:15
    #18 0x594942 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6
    #19 0x59a5e6 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:856:9
    #20 0x5c3af2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #21 0x7f5fabdd9b26 in __libc_start_main (/lib64/libc.so.6+0x25b26)
    #22 0x5707f9 in _start (/root/oss-fuzz/build/out/poppler/pdf_draw_fuzzer+0x5707f9)

0x612000001ad2 is located 0 bytes to the right of 274-byte region [0x6120000019c0,0x612000001ad2)
allocated by thread T0 here:
    #0 0x66fefd in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3
    #1 0x6ecc9b in gmalloc(unsigned long, bool) /src/poppler/goo/gmem.h:41:17
    #2 0x6f6bca in CairoOutputDev::getStreamData(Stream*, char**, int*) /src/poppler/poppler/CairoOutputDev.cc:2872:23
    #3 0x6f6888 in CairoOutputDev::setMimeData(GfxState*, Stream*, Object*, GfxImageColorMap*, _cairo_surface*, int) /src/poppler/poppler/CairoOutputDev.cc:3063:7
    #4 0x6f7a36 in CairoOutputDev::drawImage(GfxState*, Object*, Stream*, int, int, GfxImageColorMap*, bool, int const*, bool) /src/poppler/poppler/CairoOutputDev.cc:3311:7
    #5 0x81495e in Gfx::doImage(Object*, Stream*, bool) /src/poppler/poppler/Gfx.cc:4583:7
    #6 0x7eb0ed in Gfx::opXObject(Object*, int) /src/poppler/poppler/Gfx.cc:4154:7
    #7 0x7fba7f in Gfx::execOp(Object*, Object*, int) /src/poppler/poppler/Gfx.cc:873:3
    #8 0x7facfa in Gfx::go(bool) /src/poppler/poppler/Gfx.cc:749:7
    #9 0x7fa6c3 in Gfx::display(Object*, bool) /src/poppler/poppler/Gfx.cc:711:3
    #10 0x8cfbad in Page::displaySlice(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) /src/poppler/poppler/Page.cc:596:10
    #11 0x6bc30f in _poppler_page_render(_PopplerPage*, _cairo*, bool, PopplerPrintFlags) /src/poppler/glib/poppler-page.cc:355:15
    #12 0x6bc58b in poppler_page_render_for_printing /src/poppler/glib/poppler-page.cc:458:3
    #13 0x6a33e7 in LLVMFuzzerTestOneInput /src/poppler/glib/tests/fuzzing/pdf_draw_fuzzer.cc:65:9
    #14 0x5a91d3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:599:15
    #15 0x594942 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6
    #16 0x59a5e6 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:856:9
    #17 0x5c3af2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #18 0x7f5fabdd9b26 in __libc_start_main (/lib64/libc.so.6+0x25b26)

SUMMARY: AddressSanitizer: heap-buffer-overflow /src/cairo/_builddir/../src/cairoint.h:257:60 in get_unaligned_be32
Shadow bytes around the buggy address:
  0x0c247fff8300: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c247fff8310: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c247fff8320: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
  0x0c247fff8330: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c247fff8340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c247fff8350: 00 00 00 00 00 00 00 00 00 00[02]fa fa fa fa fa
  0x0c247fff8360: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c247fff8370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c247fff8380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa
  0x0c247fff8390: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c247fff83a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==445397==ABORTING

src-openEuler/cairo

内容风险标识

评论 (1)

src-openEuler/cairo .gitee-modal { width: 500px !important; }

内容风险标识