Project: exiv2 (exiv2/exiv2), language: c++
Vulnerability instance: exiv2.cve-2017-14863
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: Red Hat Bugzilla
## URL: https://bugzilla.redhat.com/show_bug.cgi?id=1494443
## Description:
Bugzilla ID: 1494443
Title: Null pointer dereference vulnerability in Exiv2::Image::printIFDStructure (image.cpp:408)

Description
Liu Zhu 2017-09-22 09:31:08 UTC
Created attachment 1329486 [details]
PoC File

ASAN:SIGSEGV
=================================================================
==53639==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fa6170833e8 bp 0x7fff73e26870 sp 0x7fff73e263d0 T0)
    #0 0x7fa6170833e7 in Exiv2::Image::printIFDStructure(Exiv2::BasicIo&, std::ostream&, Exiv2::PrintStructureOption, unsigned int, bool, char, int) /root/fuzzing/exiv2-trunk/src/image.cpp:408
    #1 0x7fa6170848a3 in Exiv2::Image::printTiffStructure(Exiv2::BasicIo&, std::ostream&, Exiv2::PrintStructureOption, int, unsigned long) /root/fuzzing/exiv2-trunk/src/image.cpp:517
    #2 0x7fa61716a73e in Exiv2::TiffImage::printStructure(std::ostream&, Exiv2::PrintStructureOption, int) /root/fuzzing/exiv2-trunk/src/tiffimage.cpp:348
    #3 0x7fa617168c06 in Exiv2::TiffImage::readMetadata() /root/fuzzing/exiv2-trunk/src/tiffimage.cpp:191
    #4 0x43ab02 in Action::Print::printSummary() /root/fuzzing/exiv2-trunk/src/actions.cpp:289
    #5 0x43a1af in Action::Print::run(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /root/fuzzing/exiv2-trunk/src/actions.cpp:244
    #6 0x422129 in main /root/fuzzing/exiv2-trunk/src/exiv2.cpp:170
    #7 0x7fa6163e282f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #8 0x421af8 in _start (/usr/local/exiv2_ASAN/bin/exiv2+0x421af8)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/fuzzing/exiv2-trunk/src/image.cpp:408 Exiv2::Image::printIFDStructure(Exiv2::BasicIo&, std::ostream&, Exiv2::PrintStructureOption, unsigned int, bool, char, int)
==53639==ABORTING


Comments:
Comment 2
Liu Zhu 2017-09-23 05:14:02 UTC
./exiv2 -V
exiv2 0.26 001a00 (64 bit build)
Copyright (C) 2004-2017 Andreas Huggel.

---

Comment 3
Salvatore Bonaccorso 2017-09-28 11:56:28 UTC
This was assigned CVE-2017-14863.

Can you please report the issue upstream?

---

Comment 4
Dan Čermák 2017-10-20 21:17:56 UTC
The upstream issue is https://github.com/Exiv2/exiv2/issues/132. The problem has already been fixed.

---

Comment 6
Jan Grulich 2019-01-28 16:08:16 UTC
Fixed with exiv2-0.27.0-1.el7_6.

---

Comment 10
errata-xmlrpc 2019-08-06 12:46:58 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:2101

Attachments:
Attachment 1329486: PoC File [Link: https://bugzilla.redhat.com/attachment.cgi?id=1329486]

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
mkdir -p build
cd build
cmake -DEXIV2_ENABLE_PNG=ON -DEXIV2_ENABLE_WEBREADY=ON -DEXIV2_ENABLE_CURL=OFF -DEXIV2_ENABLE_BMFF=ON -DEXIV2_TEAM_WARNINGS_AS_ERRORS=ON -DBUILD_SHARED_LIBS=OFF -DCMAKE_CXX_COMPILER="${CXX}" -DCMAKE_CXX_FLAGS="${CXXFLAGS}" -DEXIV2_BUILD_FUZZ_TESTS=ON -DEXIV2_TEAM_OSS_FUZZ=ON -DLIB_FUZZING_ENGINE="${LIB_FUZZING_ENGINE}" ..
make -j $(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y cmake make ccache python3 libexpat1-dev zlib1g-dev libssh-dev libcurl4-openssl-dev libxml2-utils
RUN git clone https://github.com/exiv2/exiv2 exiv2
RUN git -C exiv2 checkout fa449a4d2c58d63f0d75ff259f25683a98a44630
WORKDIR $SRC/exiv2
COPY build.sh $SRC/

Additional files: