Project: exiv2 (exiv2/exiv2), language: c++
Vulnerability instance: exiv2.cve-2018-11037
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/Exiv2/exiv2/issues/307
## Description:
Issue: Exiv2/exiv2#307
Title: SEGV on Exiv2::PngImage::printStructure
State: closed
Created by: legend-issue
Created at: 2018-05-13 07:00:35+00:00

Issue Body:
```jsx
STRUCTURE OF PNG FILE: ./fuzzdata_2018_5_13_11_28_25/crash/SEGV-0x607000010000_output__1526182114.43
 address | chunk |  length | data                           | checksum
       8 | IHDR  |      13 | ...o...Z....                   | 0xb672087e
      33 | bKGD  |       6 | ......                         | 0xa0bda793
      51 | pHYs  |       9 | ...H...H                       | 0x46c96b3e
      72 | IDAT  |   20639 | x...y.e.U....p.7.......5.U.... | 0x7b95dac3
   20723 | tEXt  |      37 | date:create.2012-06-19T16:25:2 | 0x6d339eca
   20772 | tEXt  |      37 | date:modify.2012-06-19T16:25:2 | 0x1c6e2676
   20821 | tEXt  |      70 | software.ImageMagick 6.7.3-4 2 | 0x0c7b7a53
ASAN:SIGSEGV
==54820==ERROR: AddressSanitizer: SEGV on unknown address 0x607000010000 (pc 0x7f8c9117c3e6 bp 0x000000000009 sp 0x7ffe60505b10 T0)
    #0 0x7f8c9117c3e5 in Exiv2::PngImage::printStructure(std::ostream&, Exiv2::PrintStructureOption, int) (/home/aflgo/song/exiv2/src/.libs/libexiv2.so.26+0x1963e5)
    #1 0x415a85 in Action::Print::printStructure(std::ostream&, Exiv2::PrintStructureOption) (/home/aflgo/song/exiv2/bin/.libs/lt-exiv2+0x415a85)
    #2 0x41d5d1 in Action::Print::run(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) (/home/aflgo/song/exiv2/bin/.libs/lt-exiv2+0x41d5d1)
    #3 0x4070dd in main (/home/aflgo/song/exiv2/bin/.libs/lt-exiv2+0x4070dd)
    #4 0x7f8c906a482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #5 0x4073b8 in _start (/home/aflgo/song/exiv2/bin/.libs/lt-exiv2+0x4073b8)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ??:0 Exiv2::PngImage::printStructure(std::ostream&, Exiv2::PrintStructureOption, int)
==54820==ABORTING
```
The command line is exiv2 -pR [poc]. 
And I think you need to use ASAN to reproduce. Otherwise,it can't crash and it's like an information leak.
https://github.com/legend-issue/pocs/blob/master/exiv2/SEGV-0x607000010000_output__1526182114.43


Comments:
Comment by piponazo on 2018-05-13 16:19:09+00:00:
Hi @legend-issue , could you please make the POC accessible? It seems that the link is broken.

---

Comment by legend-issue on 2018-05-14 00:10:46+00:00:
Sorry,I think it's OK now!

---

Comment by piponazo on 2018-05-14 05:17:23+00:00:
Yes :smiley: , we'll take a look ASAP

---

Comment by fgeek on 2018-05-15 01:20:43+00:00:
Can't reproduce in bb2019149ae2b6f226e8d6be5f5828898b455a03 or c80b1b9d51689692bc865f1a1d16bf7fd2a532c4 with or without ASan. Are you sure you are fuzzing the latest code commit?


---

Comment by legend-issue on 2018-05-15 06:45:47+00:00:
I think it's the latest code commit after I check it.I find this without fuzz.I just compile with ASAN and use some testcases. @fgeek 

---

Comment by fgeek on 2018-05-15 06:48:37+00:00:
Someone has requested a CVE identifier for this issue (not sure why), which is https://nvd.nist.gov/vuln/detail/CVE-2018-11037

---

Comment by D4N on 2018-08-30 21:17:12+00:00:
I can neither reproduce this on master.

@legend-issue Could you please provide us with the commit with which you build this? Otherwise I am going to close this issue.

---

Comment by D4N on 2018-09-18 22:28:38+00:00:
I am closing this issue, as it cannot be reproduced.

Commit References:
c80b1b9d51689692bc865f1a1d16bf7fd2a532c4
bb2019149ae2b6f226e8d6be5f5828898b455a03

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
mkdir -p build
cd build
cmake -DEXIV2_ENABLE_PNG=ON -DEXIV2_ENABLE_WEBREADY=ON -DEXIV2_ENABLE_CURL=OFF -DEXIV2_ENABLE_BMFF=ON -DEXIV2_TEAM_WARNINGS_AS_ERRORS=ON -DBUILD_SHARED_LIBS=OFF -DCMAKE_CXX_COMPILER="${CXX}" -DCMAKE_CXX_FLAGS="${CXXFLAGS}" -DEXIV2_BUILD_FUZZ_TESTS=ON -DEXIV2_TEAM_OSS_FUZZ=ON -DLIB_FUZZING_ENGINE="${LIB_FUZZING_ENGINE}" ..
make -j $(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y cmake make ccache python3 libexpat1-dev zlib1g-dev libssh-dev libcurl4-openssl-dev libxml2-utils
RUN git clone https://github.com/exiv2/exiv2 exiv2
RUN git -C exiv2 checkout fa449a4d2c58d63f0d75ff259f25683a98a44630
WORKDIR $SRC/exiv2
COPY build.sh $SRC/

Additional files: