Bug 697152 - jpeg: SIGSEGV when reporting error from jpeg decoder
Summary: jpeg: SIGSEGV when reporting error from jpeg decoder
Status: RESOLVED FIXED
Alias: None
Product: MuPDF
Classification: Unclassified
Component: fuzzing (show other bugs)
Version: master
Hardware: All All
: P4 normal
Assignee: MuPDF bugs
URL:
Keywords:
: 697164 (view as bug list)
Depends on:
Blocks:
 
Reported: 2016-09-26 04:28 UTC by Sebastian Rasmussen
Modified: 2016-09-28 03:49 UTC (History)
0 users

See Also:
Customer:
Word Size: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sebastian Rasmussen 2016-09-26 04:28:16 UTC
When running this jpeg image:

https://raw.githubusercontent.com/Grumbel/imagetestsuite/master/jpg/21a84b8472f6d18f5bb5c0026e97cfaa.jpg

using the following command:

valgrind ./build/debug/mutool draw -i -s t 21a84b8472f6d18f5bb5c0026e97cfaa.jpg

I see a SIGSEGV:

==11895== Using Valgrind-3.12.0.SVN and LibVEX; rerun with -h for copyright info
...
Corrupt JPEG data: 87 extraneous bytes before marker 0xdb
==11895== Process terminating with default action of signal 11 (SIGSEGV)
==11895==  Bad permissions for mapped region at address 0x809B739
==11895==    at 0x8072D5D: fz_vthrow (error.c:163)
==11895==    by 0x8072DEE: fz_throw (error.c:185)
==11895==    by 0x8091855: error_exit (load-jpeg.c:70)
==11895==    by 0x81BBE7A: get_sos (jdmarker.c:371)
==11895==    by 0x81BE9DA: read_markers (jdmarker.c:1152)
==11895==    by 0x81BB1F1: consume_markers (jdinput.c:568)
==11895==    by 0x81B935F: jpeg_consume_input (jdapimin.c:302)
==11895==    by 0x81B928E: jpeg_read_header (jdapimin.c:250)
==11895==    by 0x809252A: fz_load_jpeg_info (load-jpeg.c:360)
==11895==    by 0x808CDB2: fz_new_image_from_buffer (image.c:960)
==11895==    by 0x8100A85: img_open_document_with_stream (muimg.c:120)
==11895==    by 0x8100B60: img_open_document (muimg.c:143)
Comment 2 Sebastian Rasmussen 2016-09-26 05:06:29 UTC
This should probably be marked as fuzzing, sorry for the noise.
Comment 3 Sebastian Rasmussen 2016-09-27 00:12:38 UTC
*** Bug 697164 has been marked as a duplicate of this bug. ***
Comment 4 Sebastian Rasmussen 2016-09-28 03:49:49 UTC
Fixed in commit 2945b540908b2c05cc730335829726675028475b.