Project: libgd (libgd/libgd), language: c++
Vulnerability instance: libgd.cve-2016-6214
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/libgd/libgd/issues/247#issuecomment-232084241
## Description:
Issue: libgd/libgd#247
Title: [CVE-2016-6132]: A read out-of-bands was found in the parsing of TGA files
Referenced comment by gaa-cifasis on 2016-07-12 15:27:28+00:00:

It looks like QuickFuzz can still find a read out-of-bound. The new test case is [here](https://gist.github.com/gaa-cifasis/3109030cb01c14500fcf52cfe3fc9c27). We recently added a new feature to our tool, to dump the internal structure of the corrupted file causing a crash in the .val file (hopefully it can help!). 

```
==20805== ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60060000f00c at pc 0x41a8f0 bp 0x7fffffffe3e0 sp 0x7fffffffe3d8
READ of size 4 at 0x60060000f00c thread T0
    #0 0x41a8ef (/home/vagrant/repos/libgd-asan/tests/gif/bug00066+0x41a8ef)
    #1 0x41a219 (/home/vagrant/repos/libgd-asan/tests/gif/bug00066+0x41a219)
    #2 0x4011ca (/home/vagrant/repos/libgd-asan/tests/gif/bug00066+0x4011ca)
    #3 0x7ffff47a1ec4 (/lib/x86_64-linux-gnu/libc-2.19.so+0x21ec4)
    #4 0x4010a8 (/home/vagrant/repos/libgd-asan/tests/gif/bug00066+0x4010a8)
0x60060000f00c is located 12 bytes to the right of 32-byte region [0x60060000efe0,0x60060000f000)
allocated by thread T0 here:
    #0 0x7ffff4e6041a (/usr/lib/x86_64-linux-gnu/libasan.so.0.0.0+0x1541a)
    #1 0x41d353 (/home/vagrant/repos/libgd-asan/tests/gif/bug00066+0x41d353)
    #2 0x41b999 (/home/vagrant/repos/libgd-asan/tests/gif/bug00066+0x41b999)
    #3 0x41a43e (/home/vagrant/repos/libgd-asan/tests/gif/bug00066+0x41a43e)
    #4 0x41a219 (/home/vagrant/repos/libgd-asan/tests/gif/bug00066+0x41a219)
    #5 0x4011ca (/home/vagrant/repos/libgd-asan/tests/gif/bug00066+0x4011ca)
    #6 0x7ffff47a1ec4 (/lib/x86_64-linux-gnu/libc-2.19.so+0x21ec4)
Shadow bytes around the buggy address:
  0x0c013fff9db0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c013fff9dc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c013fff9dd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c013fff9de0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c013fff9df0: fa fa fa fa fa fa fa fa fa fa fa fa 00 00 00 00
=>0x0c013fff9e00: fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c013fff9e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c013fff9e20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c013fff9e30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c013fff9e40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c013fff9e50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:     fa
  Heap righ redzone:     fb
  Freed Heap region:     fd
  Stack left redzone:    f1
  Stack mid redzone:     f2
  Stack right redzone:   f3
  Stack partial redzone: f4
  Stack after return:    f5
  Stack use after scope: f8
  Global redzone:        f9
  Global init order:     f6
  Poisoned by user:      f7
  ASan internal:         fe
==20805== ABORTING

Program received signal SIGABRT, Aborted.
0x00007ffff47b6cc9 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0  0x00007ffff47b6cc9 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007ffff47ba0d8 in __GI_abort () at abort.c:89
#2  0x00007ffff4e66829 in ?? () from /usr/lib/x86_64-linux-gnu/libasan.so.0
#3  0x00007ffff4e5d3ec in ?? () from /usr/lib/x86_64-linux-gnu/libasan.so.0
#4  0x00007ffff4e64012 in ?? () from /usr/lib/x86_64-linux-gnu/libasan.so.0
#5  0x00007ffff4e63121 in __asan_report_error () from /usr/lib/x86_64-linux-gnu/libasan.so.0
#6  0x00007ffff4e5d704 in __asan_report_load4 () from /usr/lib/x86_64-linux-gnu/libasan.so.0
#7  0x000000000041a8f0 in gdImageCreateFromTgaCtx (ctx=0x600e0000dfb0) at gd_tga.c:103
#8  0x000000000041a21a in gdImageCreateFromTga (fp=0x60360000fd80) at gd_tga.c:25
#9  0x00000000004011cb in main (argc=2, argv=0x7fffffffe5f8) at gif/bug00066.c:16
```

Maybe this patch wasn't complete?


Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./bootstrap.sh
./configure --prefix="$WORK" --disable-shared
make -j$(nproc) install

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake libtool pkg-config libz-dev
RUN apt-get install -y make autoconf automake libtool pkg-config libz-dev
RUN git clone https://github.com/libgd/libgd libgd
RUN git -C libgd checkout e6399f5a470f50285cef173e438638ae5bc741e0
WORKDIR $SRC/libgd
COPY build.sh $SRC/

Additional files:
filename: parser_target.cc
content: // Copyright 2018 Google Inc.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
/////////////////////////////////////////////////////////////////////////////

#include <stdint.h>
#include "gd.h"

#define PASTE(x) gdImageCreateFrom ## x ## Ptr
#define CREATE_IMAGE(FORMAT) PASTE(FORMAT)

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
    gdImagePtr im = CREATE_IMAGE(FUZZ_GD_FORMAT)(Size, (void*) Data);
    if (im) gdImageDestroy(im);
    return 0;
}