Debian Bug report logs - #530401
jhead: segmentation fault on corrupt input file

version graph

Package: jhead; Maintainer for jhead is Ludovic Rousseau <rousseau@debian.org>; Source for jhead is src:jhead.

Reported by: reportbug <debbug.jhead@sub.noloop.net>

Date: Sun, 24 May 2009 16:24:02 UTC

Severity: normal

Tags: upstream

Found in version jhead/2.84-2

Fixed in version jhead/2.875-2

Done: Ludovic Rousseau <rousseau@debian.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Ludovic Rousseau <rousseau@debian.org>:
Bug#530401; Package jhead. (Sun, 24 May 2009 16:24:04 GMT) Full text and rfc822 format available.

Acknowledgement sent to reportbug <debbug.jhead@sub.noloop.net>:
New Bug report received and forwarded. Copy sent to Ludovic Rousseau <rousseau@debian.org>. (Sun, 24 May 2009 16:24:04 GMT) Full text and rfc822 format available.

Message #5 received at submit@bugs.debian.org (full text, mbox):

From: reportbug <debbug.jhead@sub.noloop.net>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: jhead: segmentation fault on corrupt input file
Date: Sun, 24 May 2009 18:23:20 +0200
Package: jhead
Version: 2.84-2
Severity: normal

Using the zzuf fuzzer, it is fairly easy to get jhead to crash
with a segmentation fault. I guess this is due to lack of
validation of various exif header fields.

Here's an example:
(good file) http://www.noloop.net/bugs/jhead/001/hello.jpeg

Corrupted with "zzuf -c -v -s 148 cat hello.jpeg > hello-s148.jpeg":
(corrupt file) http://www.noloop.net/bugs/jhead/001/hello-s148.jpeg

gdb trace (when running against a non-stripped binary compiled
from the jhead source deb):

jhead-2.84/jhead hello-s148.jpeg

Nonfatal Error : 'hello-s148.jpeg' Suspicious offset of first IFD value

Program received signal SIGSEGV, Segmentation fault.
0x0804cc30 in Get16u (Short=0x865e1c1) at exif.c:319
319             return (((uchar *)Short)[1] << 8) | ((uchar *)Short)[0];
#0  0x0804cc30 in Get16u (Short=0x865e1c1) at exif.c:319
No locals.
#1  0x0804d0a3 in ProcessExifDir (DirStart=0x865e1c1 <Address 0x865e1c1 out of bounds>, 
    OffsetBase=0x825e1b8 "II*", ExifLength=126, NestingLevel=0) at exif.c:464
        de = 10
        a = -1208602636
        NumDirEntries = -1208601216
        ThumbnailOffset = 0
        ThumbnailSize = 0
        IndentString = "\000", ' ' <repeats 24 times>
#2  0x0804e539 in process_EXIF (ExifSection=0x825e1b0 "", length=134) at exif.c:996
        FirstOffset = 4194313
        ExifHeader = "Exif\000\000"
#3  0x0804bdc3 in ReadJpegSections (infile=0x825e048, ReadMode=READ_METADATA) at jpgfile.c:235
        marker = 225
        ll = 134
        lh = 0
        Data = (uchar *) 0x825e1b0 ""
        itemlen = 134
        got = 132
        a = 1
        HaveCom = 0
#4  0x0804c020 in ReadJpegFile (FileName=0xbfdbc927 "hello-s148.jpeg", ReadMode=READ_METADATA)
    at jpgfile.c:322
        infile = (FILE *) 0x825e048
        ret = 134516080
#5  0x08049f81 in ProcessFile (FileName=0xbfdbc927 "hello-s148.jpeg") at jhead.c:815
        Modified = 0
        ReadMode = READ_METADATA
#6  0x0804b6ee in main (argc=2, argv=0xbfdbad44) at jhead.c:1618
        argn = 1
        arg = 0xbfdbc927 "hello-s148.jpeg"

I guess in this particular case, the problem is on exif.c circa line 986,
the "FirstOffset" value is taken at face value (although a warning is 
printed). Looks like the segfault is caused by an invalid pointer memory read,
so I guess that's not exploitable(?), but I thought I'd report this anyway.

There were also problems with the IPTC parser not validating its length 
fields; I forgot to keep an example around, but running zzuf on any .jpeg file
with an IPTC section should reproduce the problem fairly easy.

-- System Information:
Debian Release: 5.0.1
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: i386 (i686)

Kernel: Linux 2.6.29.4 (SMP w/2 CPU cores)
Locale: LANG=en_US, LC_CTYPE=nb_NO.iso88591 (charmap=ISO-8859-1)
Shell: /bin/sh linked to /bin/bash

Versions of packages jhead depends on:
ii  libc6                         2.7-18     GNU C Library: Shared libraries
ii  libjpeg-progs                 6b-14      Programs for manipulating JPEG fil

jhead recommends no packages.

jhead suggests no packages.

-- no debconf information




Information forwarded to debian-bugs-dist@lists.debian.org, Ludovic Rousseau <rousseau@debian.org>:
Bug#530401; Package jhead. (Sun, 31 May 2009 14:33:03 GMT) Full text and rfc822 format available.

Acknowledgement sent to 530401@bugs.debian.org:
Extra info received and forwarded to list. Copy sent to Ludovic Rousseau <rousseau@debian.org>. (Sun, 31 May 2009 14:33:03 GMT) Full text and rfc822 format available.

Message #10 received at 530401@bugs.debian.org (full text, mbox):

From: Ludovic Rousseau <ludovic.rousseau@gmail.com>
To: reportbug <debbug.jhead@sub.noloop.net>, 530401@bugs.debian.org, control@bugs.debian.org
Subject: Re: Bug#530401: jhead: segmentation fault on corrupt input file
Date: Sun, 31 May 2009 16:32:15 +0200
tag 530401 upstream
forwarded 530401
thank

Matthias,

I can easily reproduce the problem. But I have no idea what to check to 
avoid it.

Thanks

reportbug a écrit :
> Package: jhead
> Version: 2.84-2
> Severity: normal
> 
> Using the zzuf fuzzer, it is fairly easy to get jhead to crash
> with a segmentation fault. I guess this is due to lack of
> validation of various exif header fields.
> 
> Here's an example:
> (good file) http://www.noloop.net/bugs/jhead/001/hello.jpeg
> 
> Corrupted with "zzuf -c -v -s 148 cat hello.jpeg > hello-s148.jpeg":
> (corrupt file) http://www.noloop.net/bugs/jhead/001/hello-s148.jpeg
> 
> gdb trace (when running against a non-stripped binary compiled
> from the jhead source deb):
> 
> jhead-2.84/jhead hello-s148.jpeg
> 
> Nonfatal Error : 'hello-s148.jpeg' Suspicious offset of first IFD value
> 
> Program received signal SIGSEGV, Segmentation fault.
> 0x0804cc30 in Get16u (Short=0x865e1c1) at exif.c:319
> 319             return (((uchar *)Short)[1] << 8) | ((uchar *)Short)[0];
> #0  0x0804cc30 in Get16u (Short=0x865e1c1) at exif.c:319
> No locals.
> #1  0x0804d0a3 in ProcessExifDir (DirStart=0x865e1c1 <Address 0x865e1c1 out of bounds>, 
>     OffsetBase=0x825e1b8 "II*", ExifLength=126, NestingLevel=0) at exif.c:464
>         de = 10
>         a = -1208602636
>         NumDirEntries = -1208601216
>         ThumbnailOffset = 0
>         ThumbnailSize = 0
>         IndentString = "\000", ' ' <repeats 24 times>
> #2  0x0804e539 in process_EXIF (ExifSection=0x825e1b0 "", length=134) at exif.c:996
>         FirstOffset = 4194313
>         ExifHeader = "Exif\000\000"
> #3  0x0804bdc3 in ReadJpegSections (infile=0x825e048, ReadMode=READ_METADATA) at jpgfile.c:235
>         marker = 225
>         ll = 134
>         lh = 0
>         Data = (uchar *) 0x825e1b0 ""
>         itemlen = 134
>         got = 132
>         a = 1
>         HaveCom = 0
> #4  0x0804c020 in ReadJpegFile (FileName=0xbfdbc927 "hello-s148.jpeg", ReadMode=READ_METADATA)
>     at jpgfile.c:322
>         infile = (FILE *) 0x825e048
>         ret = 134516080
> #5  0x08049f81 in ProcessFile (FileName=0xbfdbc927 "hello-s148.jpeg") at jhead.c:815
>         Modified = 0
>         ReadMode = READ_METADATA
> #6  0x0804b6ee in main (argc=2, argv=0xbfdbad44) at jhead.c:1618
>         argn = 1
>         arg = 0xbfdbc927 "hello-s148.jpeg"
> 
> I guess in this particular case, the problem is on exif.c circa line 986,
> the "FirstOffset" value is taken at face value (although a warning is 
> printed). Looks like the segfault is caused by an invalid pointer memory read,
> so I guess that's not exploitable(?), but I thought I'd report this anyway.
> 
> There were also problems with the IPTC parser not validating its length 
> fields; I forgot to keep an example around, but running zzuf on any .jpeg file
> with an IPTC section should reproduce the problem fairly easy.
> 
> -- System Information:
> Debian Release: 5.0.1
>   APT prefers stable
>   APT policy: (500, 'stable')
> Architecture: i386 (i686)
> 
> Kernel: Linux 2.6.29.4 (SMP w/2 CPU cores)
> Locale: LANG=en_US, LC_CTYPE=nb_NO.iso88591 (charmap=ISO-8859-1)
> Shell: /bin/sh linked to /bin/bash
> 
> Versions of packages jhead depends on:
> ii  libc6                         2.7-18     GNU C Library: Shared libraries
> ii  libjpeg-progs                 6b-14      Programs for manipulating JPEG fil
> 
> jhead recommends no packages.
> 
> jhead suggests no packages.
> 
> -- no debconf information
> 
> 


-- 
 Dr. Ludovic Rousseau




Tags added: upstream Request was from Ludovic Rousseau <ludovic.rousseau@gmail.com> to control@bugs.debian.org. (Sun, 31 May 2009 14:33:04 GMT) Full text and rfc822 format available.

Information forwarded to debian-bugs-dist@lists.debian.org, Ludovic Rousseau <rousseau@debian.org>:
Bug#530401; Package jhead. (Sun, 31 May 2009 15:06:02 GMT) Full text and rfc822 format available.

Acknowledgement sent to "Matthias Wandel" <mwandel@sentex.ca>:
Extra info received and forwarded to list. Copy sent to Ludovic Rousseau <rousseau@debian.org>. (Sun, 31 May 2009 15:06:02 GMT) Full text and rfc822 format available.

Message #17 received at 530401@bugs.debian.org (full text, mbox):

From: "Matthias Wandel" <mwandel@sentex.ca>
To: <530401@bugs.debian.org>
Subject: Re: Bug#530401: jhead: segmentation fault on corrupt input file
Date: Sun, 31 May 2009 11:01:09 -0400
Just fixed it and updated the head rev copy on the jhead page
http://www.sentex.net/~mwandel/jhead/jhead-latest.tar.gz

Matthias
----- Original Message ----- 
From: "Ludovic Rousseau" <ludovic.rousseau@gmail.com>
To: "reportbug" <debbug.jhead@sub.noloop.net>; <530401@bugs.debian.org>; 
<control@bugs.debian.org>
Sent: Sunday, May 31, 2009 10:32 AM
Subject: Re: Bug#530401: jhead: segmentation fault on corrupt input file


> tag 530401 upstream
> forwarded 530401
> thank
>
> Matthias,
>
> I can easily reproduce the problem. But I have no idea what to check to 
> avoid it.
>
> Thanks
>
> reportbug a écrit :
>> Package: jhead
>> Version: 2.84-2
>> Severity: normal
>>
>> Using the zzuf fuzzer, it is fairly easy to get jhead to crash
>> with a segmentation fault. I guess this is due to lack of
>> validation of various exif header fields.
>>
>> Here's an example:
>> (good file) http://www.noloop.net/bugs/jhead/001/hello.jpeg
>>
>> Corrupted with "zzuf -c -v -s 148 cat hello.jpeg > hello-s148.jpeg":
>> (corrupt file) http://www.noloop.net/bugs/jhead/001/hello-s148.jpeg
>>
>> gdb trace (when running against a non-stripped binary compiled
>> from the jhead source deb):
>>
>> jhead-2.84/jhead hello-s148.jpeg
>>
>> Nonfatal Error : 'hello-s148.jpeg' Suspicious offset of first IFD value
>>
>> Program received signal SIGSEGV, Segmentation fault.
>> 0x0804cc30 in Get16u (Short=0x865e1c1) at exif.c:319
>> 319             return (((uchar *)Short)[1] << 8) | ((uchar *)Short)[0];
>> #0  0x0804cc30 in Get16u (Short=0x865e1c1) at exif.c:319
>> No locals.
>> #1  0x0804d0a3 in ProcessExifDir (DirStart=0x865e1c1 <Address 0x865e1c1 
>> out of bounds>, OffsetBase=0x825e1b8 "II*", ExifLength=126, 
>> NestingLevel=0) at exif.c:464
>>         de = 10
>>         a = -1208602636
>>         NumDirEntries = -1208601216
>>         ThumbnailOffset = 0
>>         ThumbnailSize = 0
>>         IndentString = "\000", ' ' <repeats 24 times>
>> #2  0x0804e539 in process_EXIF (ExifSection=0x825e1b0 "", length=134) at 
>> exif.c:996
>>         FirstOffset = 4194313
>>         ExifHeader = "Exif\000\000"
>> #3  0x0804bdc3 in ReadJpegSections (infile=0x825e048, 
>> ReadMode=READ_METADATA) at jpgfile.c:235
>>         marker = 225
>>         ll = 134
>>         lh = 0
>>         Data = (uchar *) 0x825e1b0 ""
>>         itemlen = 134
>>         got = 132
>>         a = 1
>>         HaveCom = 0
>> #4  0x0804c020 in ReadJpegFile (FileName=0xbfdbc927 "hello-s148.jpeg", 
>> ReadMode=READ_METADATA)
>>     at jpgfile.c:322
>>         infile = (FILE *) 0x825e048
>>         ret = 134516080
>> #5  0x08049f81 in ProcessFile (FileName=0xbfdbc927 "hello-s148.jpeg") at 
>> jhead.c:815
>>         Modified = 0
>>         ReadMode = READ_METADATA
>> #6  0x0804b6ee in main (argc=2, argv=0xbfdbad44) at jhead.c:1618
>>         argn = 1
>>         arg = 0xbfdbc927 "hello-s148.jpeg"
>>
>> I guess in this particular case, the problem is on exif.c circa line 986,
>> the "FirstOffset" value is taken at face value (although a warning is 
>> printed). Looks like the segfault is caused by an invalid pointer memory 
>> read,
>> so I guess that's not exploitable(?), but I thought I'd report this 
>> anyway.
>>
>> There were also problems with the IPTC parser not validating its length 
>> fields; I forgot to keep an example around, but running zzuf on any .jpeg 
>> file
>> with an IPTC section should reproduce the problem fairly easy.
>>
>> -- System Information:
>> Debian Release: 5.0.1
>>   APT prefers stable
>>   APT policy: (500, 'stable')
>> Architecture: i386 (i686)
>>
>> Kernel: Linux 2.6.29.4 (SMP w/2 CPU cores)
>> Locale: LANG=en_US, LC_CTYPE=nb_NO.iso88591 (charmap=ISO-8859-1)
>> Shell: /bin/sh linked to /bin/bash
>>
>> Versions of packages jhead depends on:
>> ii  libc6                         2.7-18     GNU C Library: Shared 
>> libraries
>> ii  libjpeg-progs                 6b-14      Programs for manipulating 
>> JPEG fil
>>
>> jhead recommends no packages.
>>
>> jhead suggests no packages.
>>
>> -- no debconf information
>>
>>
>
>
> -- 
>  Dr. Ludovic Rousseau
> 





Reply sent to Ludovic Rousseau <rousseau@debian.org>:
You have taken responsibility. (Sun, 31 May 2009 16:30:06 GMT) Full text and rfc822 format available.

Notification sent to reportbug <debbug.jhead@sub.noloop.net>:
Bug acknowledged by developer. (Sun, 31 May 2009 16:30:06 GMT) Full text and rfc822 format available.

Message #22 received at 530401-close@bugs.debian.org (full text, mbox):

From: Ludovic Rousseau <rousseau@debian.org>
To: 530401-close@bugs.debian.org
Subject: Bug#530401: fixed in jhead 2.875-2
Date: Sun, 31 May 2009 15:47:03 +0000
Source: jhead
Source-Version: 2.875-2

We believe that the bug you reported is fixed in the latest version of
jhead, which is due to be installed in the Debian FTP archive:

jhead_2.875-2.diff.gz
  to pool/main/j/jhead/jhead_2.875-2.diff.gz
jhead_2.875-2.dsc
  to pool/main/j/jhead/jhead_2.875-2.dsc
jhead_2.875-2_amd64.deb
  to pool/main/j/jhead/jhead_2.875-2_amd64.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 530401@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Ludovic Rousseau <rousseau@debian.org> (supplier of updated jhead package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Sun, 31 May 2009 17:36:13 +0200
Source: jhead
Binary: jhead
Architecture: source amd64
Version: 2.875-2
Distribution: unstable
Urgency: low
Maintainer: Ludovic Rousseau <rousseau@debian.org>
Changed-By: Ludovic Rousseau <rousseau@debian.org>
Description: 
 jhead      - manipulate the non-image part of Exif compliant JPEG files
Closes: 530401
Changes: 
 jhead (2.875-2) unstable; urgency=low
 .
   * Fix "segmentation fault on corrupt input file" patch from upstream
     debian/patches/30_buffer_overflow (Closes: #530401)
Checksums-Sha1: 
 98da1f261f053e967a1ba61197743db99a85b928 986 jhead_2.875-2.dsc
 50d4970f773bc77888918dc5deccccf71aff6d26 5683 jhead_2.875-2.diff.gz
 cb6044e4b60cf3d41d9bc1c9e2e4ae9fa08924ce 46760 jhead_2.875-2_amd64.deb
Checksums-Sha256: 
 3472ac20660be6c54e4b24ae8757627254949dffab95352feebe57eea0d2df53 986 jhead_2.875-2.dsc
 0645aa7e6a44cdcfa1cf1d6af1c7afc0e56655ffc8e4985c17b483413bcb8170 5683 jhead_2.875-2.diff.gz
 34cfce5169864b9b395c7d1294cf9337807cc38f30def0166bad704528741956 46760 jhead_2.875-2_amd64.deb
Files: 
 bccf2ea52f296b9195bd929a4caba6b4 986 graphics optional jhead_2.875-2.dsc
 c74ee778777ee9ce80a77b15cda6a80d 5683 graphics optional jhead_2.875-2.diff.gz
 40aa3725d19a5a2b232787a2c47ac47e 46760 graphics optional jhead_2.875-2_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkoipG4ACgkQP0qKj+B/HPm4vACeP1dlGQpLq/5YaHqjPSGWm1jL
ZusAn2CgerohZ/nBZc4vFRX6ecDY3SOQ
=IdId
-----END PGP SIGNATURE-----





Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Thu, 09 Jul 2009 07:26:31 GMT) Full text and rfc822 format available.

Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Sat Apr 19 02:37:36 2014; Machine Name: buxtehude.debian.org

Debian Bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.