Project: exiv2 (exiv2/exiv2), language: c++
Vulnerability instance: exiv2.cve-2018-19607
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/Exiv2/exiv2/issues/561
## Description:
Issue: Exiv2/exiv2#561
Title: CVE-2018-19607: SEGV in Exiv2::isoSpeed at easyaccess.cpp:178
State: closed
Created by: Marsman1996
Created at: 2018-11-23 14:14:35+00:00
Labels: bug

Issue Body:
Tested in ubuntu 16.04 64bit, exiv2 (master 3f2e0de && 0.27-RC2)
`$ exiv2 $POC`

[POC file](https://github.com/Marsman1996/pocs/blob/master/exiv2/CVE-2018-19607/poc9-isoSpeed)

gdb info:
```
Program received signal SIGSEGV, Segmentation fault.
__strcmp_sse2_unaligned ()
    at ../sysdeps/x86_64/multiarch/strcmp-sse2-unaligned.S:31
31	../sysdeps/x86_64/multiarch/strcmp-sse2-unaligned.S: No such file or directory.
(gdb) bt
#0  __strcmp_sse2_unaligned ()
    at ../sysdeps/x86_64/multiarch/strcmp-sse2-unaligned.S:31
#1  0x00007ffff794b9ff in Exiv2::isoSpeed (ed=...)
    at /home/marsman/Desktop/crashana/exiv2/exiv2-3f2e0de/src/easyaccess.cpp:178
#2  0x0000000000425aef in Action::Print::printTag (this=0x65dde0, 
    exifData=..., 
    easyAccessFct=0x412390 <Exiv2::isoSpeed(Exiv2::ExifData const&)@plt>, 
    label="ISO speed")
    at /home/marsman/Desktop/crashana/exiv2/exiv2-3f2e0de/src/actions.cpp:500
#3  0x0000000000424038 in Action::Print::printSummary (this=0x65dde0)
    at /home/marsman/Desktop/crashana/exiv2/exiv2-3f2e0de/src/actions.cpp:387
#4  0x0000000000422901 in Action::Print::run (this=0x65dde0, 
    path="/home/marsman/Desktop/poc9-isoSpeed")
    at /home/marsman/Desktop/crashana/exiv2/exiv2-3f2e0de/src/actions.cpp:246
#5  0x0000000000412e39 in main (argc=2, argv=0x7fffffffdda8)
    at /home/marsman/Desktop/crashana/exiv2/exiv2-3f2e0de/src/exiv2.cpp:169
```

ASAN info:
```
==91500==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f186e2da05a bp 0x7fff4e8fe260 sp 0x7fff4e8fd9f0 T0)
    #0 0x7f186e2da059  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x47059)
    #1 0x7f186db38b0c in Exiv2::isoSpeed(Exiv2::ExifData const&) /home/marsman/Desktop/crashana/exiv2/exiv2-3f2e0de/src/easyaccess.cpp:178
    #2 0x42f9fd in Action::Print::printTag(Exiv2::ExifData const&, std::_List_const_iterator<Exiv2::Exifdatum> (*)(Exiv2::ExifData const&), std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) const /home/marsman/Desktop/crashana/exiv2/exiv2-3f2e0de/src/actions.cpp:500
    #3 0x42d6c2 in Action::Print::printSummary() /home/marsman/Desktop/crashana/exiv2/exiv2-3f2e0de/src/actions.cpp:387
    #4 0x42b9db in Action::Print::run(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /home/marsman/Desktop/crashana/exiv2/exiv2-3f2e0de/src/actions.cpp:246
    #5 0x4139a6 in main /home/marsman/Desktop/crashana/exiv2/exiv2-3f2e0de/src/exiv2.cpp:169
    #6 0x7f186cf9a82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #7 0x413308 in _start (/home/marsman/Desktop/crashana/exiv2/exiv2-3f2e0de/build_asan/bin/exiv2+0x413308)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ??:0 ??
```

Addition: This bug was found with mem-AFL, which is based on AFL. Mem-AFL is developed by Yanhao(unfuzzable123@gmail.com) & Marsman1996(lqliuyuwei@outlook.com)


Comments:
Comment by piponazo on 2018-11-26 12:56:52+00:00:
Confirmed. I could reproduce the issue in my desktop with Ubuntu 18.04 and gcc-7.3.

Thanks for reporting! We will try to fix this issue ASAP.

---

Comment by piponazo on 2018-11-26 15:39:33+00:00:
@Marsman1996 the issue should be fixed now. Could you please confirm?

---

Comment by Marsman1996 on 2018-11-26 15:55:39+00:00:
@piponazo I think this issue should be fixed, since exiv2 (master 6e42c1b) no longer crashes or something else when open the poc file.

---

Comment by carnil on 2018-11-30 20:02:20+00:00:
This issue has been assigned [CVE-2018-19607](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19607)

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
mkdir -p build
cd build
cmake -DEXIV2_ENABLE_PNG=ON -DEXIV2_ENABLE_WEBREADY=ON -DEXIV2_ENABLE_CURL=OFF -DEXIV2_ENABLE_BMFF=ON -DEXIV2_TEAM_WARNINGS_AS_ERRORS=ON -DBUILD_SHARED_LIBS=OFF -DCMAKE_CXX_COMPILER="${CXX}" -DCMAKE_CXX_FLAGS="${CXXFLAGS}" -DEXIV2_BUILD_FUZZ_TESTS=ON -DEXIV2_TEAM_OSS_FUZZ=ON -DLIB_FUZZING_ENGINE="${LIB_FUZZING_ENGINE}" ..
make -j $(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y cmake make ccache python3 libexpat1-dev zlib1g-dev libssh-dev libcurl4-openssl-dev libxml2-utils
RUN git clone https://github.com/exiv2/exiv2 exiv2
RUN git -C exiv2 checkout 6de1f3377f6f165a3f7722df142f61cafeede634
WORKDIR $SRC/exiv2
COPY build.sh $SRC/

Additional files: