Project: exiv2 (exiv2/exiv2), language: c++
Vulnerability instance: exiv2.cve-2018-17229
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/Exiv2/exiv2/issues/453
## Description:
Issue: Exiv2/exiv2#453
Title: CVE-2018-17229: AddressSanitizer: heap-buffer-overflow in Exiv2::d2Data
State: closed
Created by: Marsman1996
Created at: 2018-09-17 14:18:53+00:00

Issue Body:
Tested in Ubuntu 16.04, 64bit, Exiv2(master b6a8d39)
`$ exiv2 $POC`

https://github.com/Marsman1996/pocs/blob/master/exiv2/CVE-2018-17229/poc4-d2Data

```
./bin/exiv2 ../../poc4-d2Data 
=================================================================
==29719==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000edda at pc 0x7f380fbee411 bp 0x7ffe90b43600 sp 0x7ffe90b435f0
WRITE of size 1 at 0x60200000edda thread T0
    #0 0x7f380fbee410 in Exiv2::d2Data(unsigned char*, double, Exiv2::ByteOrder) /home/marsman/Desktop/crashana/exiv2/exiv2-b6a8d39613a28603a989bd5278798db8a54eeb1e/src/types.cpp:473
    #1 0x7f380fbfc1e7 in long Exiv2::toData<double>(unsigned char*, double, Exiv2::ByteOrder) /home/marsman/Desktop/crashana/exiv2/exiv2-b6a8d39613a28603a989bd5278798db8a54eeb1e/include/exiv2/value.hpp:1512
    #2 0x7f380fc03803 in Exiv2::ValueType<double>::copy(unsigned char*, Exiv2::ByteOrder) const /home/marsman/Desktop/crashana/exiv2/exiv2-b6a8d39613a28603a989bd5278798db8a54eeb1e/include/exiv2/value.hpp:1611
    #3 0x7f380fb47e58 in Exiv2::Exifdatum::copy(unsigned char*, Exiv2::ByteOrder) const /home/marsman/Desktop/crashana/exiv2/exiv2-b6a8d39613a28603a989bd5278798db8a54eeb1e/src/exif.cpp:357
    #4 0x7f380fbe9083 in Exiv2::TiffImage::readMetadata() /home/marsman/Desktop/crashana/exiv2/exiv2-b6a8d39613a28603a989bd5278798db8a54eeb1e/src/tiffimage.cpp:199
    #5 0x43a413 in Action::Print::printSummary() /home/marsman/Desktop/crashana/exiv2/exiv2-b6a8d39613a28603a989bd5278798db8a54eeb1e/src/actions.cpp:287
    #6 0x439c8b in Action::Print::run(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /home/marsman/Desktop/crashana/exiv2/exiv2-b6a8d39613a28603a989bd5278798db8a54eeb1e/src/actions.cpp:247
    #7 0x4222d7 in main /home/marsman/Desktop/crashana/exiv2/exiv2-b6a8d39613a28603a989bd5278798db8a54eeb1e/src/exiv2.cpp:167
    #8 0x7f380eed082f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #9 0x421ce8 in _start (/home/marsman/Desktop/crashana/exiv2/exiv2-b6a8d39613a28603a989bd5278798db8a54eeb1e/build_asan/bin/exiv2+0x421ce8)

0x60200000edda is located 0 bytes to the right of 10-byte region [0x60200000edd0,0x60200000edda)
allocated by thread T0 here:
    #0 0x7f381032d6b2 in operator new[](unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x996b2)
    #1 0x7f380fbeb51f in Exiv2::DataBuf::alloc(long) /home/marsman/Desktop/crashana/exiv2/exiv2-b6a8d39613a28603a989bd5278798db8a54eeb1e/src/types.cpp:156
    #2 0x7f380fbe8fe6 in Exiv2::TiffImage::readMetadata() /home/marsman/Desktop/crashana/exiv2/exiv2-b6a8d39613a28603a989bd5278798db8a54eeb1e/src/tiffimage.cpp:198
    #3 0x43a413 in Action::Print::printSummary() /home/marsman/Desktop/crashana/exiv2/exiv2-b6a8d39613a28603a989bd5278798db8a54eeb1e/src/actions.cpp:287
    #4 0x439c8b in Action::Print::run(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /home/marsman/Desktop/crashana/exiv2/exiv2-b6a8d39613a28603a989bd5278798db8a54eeb1e/src/actions.cpp:247
    #5 0x4222d7 in main /home/marsman/Desktop/crashana/exiv2/exiv2-b6a8d39613a28603a989bd5278798db8a54eeb1e/src/exiv2.cpp:167
    #6 0x7f380eed082f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/marsman/Desktop/crashana/exiv2/exiv2-b6a8d39613a28603a989bd5278798db8a54eeb1e/src/types.cpp:473 Exiv2::d2Data(unsigned char*, double, Exiv2::ByteOrder)
Shadow bytes around the buggy address:
  0x0c047fff9d60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9d70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9d90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9da0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c047fff9db0: fa fa fa fa fa fa fa fa fa fa 00[02]fa fa 00 00
  0x0c047fff9dc0: fa fa fd fd fa fa 02 fa fa fa 00 00 fa fa fd fa
  0x0c047fff9dd0: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fa
  0x0c047fff9de0: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fa
  0x0c047fff9df0: fa fa 00 fa fa fa 00 fa fa fa 00 fa fa fa fd fd
  0x0c047fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==29719==ABORTING
```

Addition: This bug was found with mem-AFL, which is based on AFL. Mem-AFL is developed by Yanhao(unfuzzable123@gmail.com) & Marsman1996(lqliuyuwei@outlook.com)


Comments:
Comment by D4N on 2018-09-17 14:36:01+00:00:
This issue is no longer present on master.

---

Comment by abergmann on 2018-09-20 15:26:04+00:00:
[CVE-2018-17229](https://nvd.nist.gov/vuln/detail/CVE-2018-17229) was assigned to this issue.

---

Comment by carnil on 2018-10-13 19:25:36+00:00:
A bisect of the issue seem to indicate the issue is adressed by afb98cbc6e288dc8ea75f3394a347fb9b37abc55 ("Allocate correct amount of memory for the ICC profile")

---

Comment by carnil on 2018-10-14 11:56:39+00:00:
Issue was introduced possibly later than 3d57bbc6e6036723df3c7da352e40267c90d1640 ("#1074 Work in progress.  ICC Jpeg/Png/Tiff exiv2 -eC foo.xxx writes good foo.icc profiles.  icc-test.sh is broken and to be investigated."). That is I was not able to determine exactly where the issue has been introduced.

The issue should be seen as well with the v0.26 tagged version if one cherry-picks (depending on used compiler) 04052ceb8609ea9c92095e61807efde2166cb6f5 on top and builds.

---

Comment by carnil on 2018-10-14 12:49:26+00:00:
Commit afb98cbc6e288dc8ea75f3394a347fb9b37abc55 introduces CVE-2018-17282, which was https://github.com/Exiv2/exiv2/issues/457

Commit References:
afb98cbc6e288dc8ea75f3394a347fb9b37abc55
3d57bbc6e6036723df3c7da352e40267c90d1640
b6a8d39613a28603a989bd5278798db8a54eeb1e
04052ceb8609ea9c92095e61807efde2166cb6f5

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
mkdir -p build
cd build
cmake -DEXIV2_ENABLE_PNG=ON -DEXIV2_ENABLE_WEBREADY=ON -DEXIV2_ENABLE_CURL=OFF -DEXIV2_ENABLE_BMFF=ON -DEXIV2_TEAM_WARNINGS_AS_ERRORS=ON -DBUILD_SHARED_LIBS=OFF -DCMAKE_CXX_COMPILER="${CXX}" -DCMAKE_CXX_FLAGS="${CXXFLAGS}" -DEXIV2_BUILD_FUZZ_TESTS=ON -DEXIV2_TEAM_OSS_FUZZ=ON -DLIB_FUZZING_ENGINE="${LIB_FUZZING_ENGINE}" ..
make -j $(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y cmake make ccache python3 libexpat1-dev zlib1g-dev libssh-dev libcurl4-openssl-dev libxml2-utils
RUN git clone https://github.com/exiv2/exiv2 exiv2
RUN git -C exiv2 checkout fa449a4d2c58d63f0d75ff259f25683a98a44630
WORKDIR $SRC/exiv2
COPY build.sh $SRC/

Additional files: