Project: libraw (libraw/libraw), language: c++
Vulnerability instance: libraw.cve-2018-20364
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/LibRaw/LibRaw/issues/194
## Description:
Issue: LibRaw/LibRaw#194
Title: It exists SEGV when use function copy_bayer()
State: closed
Created by: fantasyoung
Created at: 2018-12-21 02:55:05+00:00

Issue Body:
### Description
When use function copy_bayer(),it will exist SEGV 
### My test program
postprocessing_benchmark in Libraw/bin
### Command and argument
./postprocessing_benchmark 1111
### Crash Information
```
Processing file 1111

5.9 msec for unpack
=================================================================
ASAN:SIGSEGV
==98633==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000004556fb bp 0x7ffe69c00ed0 sp 0x7ffe69c00e90 T0)
    #0 0x4556fa in LibRaw::copy_bayer(unsigned short*, unsigned short*) [clone ._omp_fn.2] src/libraw_cxx.cpp:3609
    #1 0x7f929c0dfcbe in GOMP_parallel (/usr/lib/x86_64-linux-gnu/libgomp.so.1+0xbcbe)
    #2 0x42c27b in LibRaw::copy_bayer(unsigned short*, unsigned short*) src/libraw_cxx.cpp:3601
    #3 0x42e039 in LibRaw::raw2image_ex(int) src/libraw_cxx.cpp:3802
    #4 0x43e36f in LibRaw::dcraw_process() src/libraw_cxx.cpp:5098
    #5 0x4049bc in main samples/postprocessing_benchmark.cpp:142
    #6 0x7f929b8f782f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #7 0x403e48 in _start (/home/wind/libraw_fuzz_new/as_libraw_7e29b/LibRaw-7e29b9f29449fde30cc878fbb137d61c14bba3a4/bin/postprocessing_benchmark+0x403e48)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV src/libraw_cxx.cpp:3609 LibRaw::copy_bayer(unsigned short*, unsigned short*) [clone ._omp_fn.2]
==98633==ABORTING
```
### Version
the commit is 7e29b9f29449fde30cc878fbb137d61c14bba3a4
### POC File
[crash.zip](https://github.com/LibRaw/LibRaw/files/2701338/crash.zip)
### CREDIT
pu!m,Weiran Labs


Comments:
Comment by LibRaw on 2018-12-21 04:15:04+00:00:
The line your ASAN report pointed to is pragma omp: https://github.com/LibRaw/LibRaw/blob/master/src/libraw_cxx.cpp#L3601

Is this problem  exists in not-openmp version too?

---

Comment by LibRaw on 2018-12-21 07:50:07+00:00:
It looks like it is same problem as in raw2image, but in raw2image_ex(), could you please check this patch: https://github.com/LibRaw/LibRaw/commit/7903346bfd5f8c24e5bfd4df48f0e5cd1e7b65cb

---

Comment by carnil on 2018-12-22 20:27:58+00:00:
This is CVE-2018-20364

---

Comment by LibRaw on 2018-12-24 12:55:44+00:00:
this is not copy_bayer, but raw2image_ex() problem, fixed in master branch.

Attachments:
https://github.com/LibRaw/LibRaw/files/2701338/crash.zip

Commit References:
7e29b9f29449fde30cc878fbb137d61c14bba3a4
7903346bfd5f8c24e5bfd4df48f0e5cd1e7b65cb

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./configure --disable-examples
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake libtool pkg-config
RUN git clone https://github.com/libraw/libraw libraw
RUN git -C libraw checkout e12cae8cbc7c73a7200f6e7621d71e113885ea72
WORKDIR $SRC/libraw
COPY build.sh $SRC/

Additional files:
filename: libraw_fuzzer.cc
content: /*  Copyright 2020 Google Inc.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

      http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

#include <stddef.h>
#include <stdint.h>

#include <string>

#include <libraw.h>

extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
  // Input less than 10mb
  if (size > 10000000) {
    return 0;
  }

  LibRaw lib_raw;

  int result = lib_raw.open_buffer(
      const_cast<char*>(reinterpret_cast<const char*>(data)), size);
  if (result != LIBRAW_SUCCESS) {
    return 0;
  }

  result = lib_raw.unpack();
  if (result != LIBRAW_SUCCESS) {
    return 0;
  }

  result = lib_raw.dcraw_process();
  if (result != LIBRAW_SUCCESS) {
    return 0;
  }

  return 0;
}