| Summary: | Seg faults found by fuzzing in jpeg_free (../gs/base/sjpegc.c) | ||
|---|---|---|---|
| Product: | GhostPCL | Reporter: | Marcos H. Woehrmann <marcos.woehrmann> |
| Component: | fuzzing | Assignee: | Henry Stiles <henry.stiles> |
| Status: | RESOLVED INVALID | ||
| Severity: | normal | CC: | shailesh.mistry |
| Priority: | P4 | ||
| Version: | master | ||
| Hardware: | PC | ||
| OS: | Linux | ||
| Customer: | Word Size: | --- | |
No longer reproducible. |
Seg faults in the 64 bit build of ghostpcl were found by fuzzing in jpeg_free (../gs/base/sjpegc.c) while reading 1 file(s). Sample command line: ./pcl6 -sDEVICE=ppmraw -o /dev/null \ ./tests_private__xl__pxlfts3.0__T422.BIN.90 gdb stack trace: Program received signal SIGSEGV, Segmentation fault. 0x0000000000454b9b in jpeg_free (cinfo=0x20db9b0, data=0xf1f1f1f1f1f1f1f1, info=0x9018c8 'Freeing JPEG small internal data') at ../gs/base/sjpegc.c:228 228 gs_free_object(mem, data, info); (gdb) where #0 0x0000000000454b9b in jpeg_free (cinfo=0x20db9b0, data=0xf1f1f1f1f1f1f1f1, info=0x9018c8 'Freeing JPEG small internal data') at ../gs/base/sjpegc.c:228 #1 0x0000000000454cab in jpeg_free_small (cinfo=0x20db9b0, object=0xf1f1f1f1f1f1f1f1, size=168) at ../gs/base/sjpegc.c:249 #2 0x000000000045c78d in self_destruct (cinfo=0x20db9b0) at ./debugobj/jmemmgr.c:1016 #3 0x000000000045af67 in jpeg_destroy (cinfo=0x20db9b0) at ./debugobj/jcomapi.c:74 #4 0x0000000000454a31 in gs_jpeg_destroy (st=0x20db728) at ../gs/base/sjpegc.c:179 #5 0x0000000000890c86 in read_jpeg_bitmap_data (benum=0x20db698, pdata=0x7fffffffce38, par=0x135b7c8) at ../pxl/pximage.c:199 #6 0x000000000089189a in read_bitmap (benum=0x20db698, pdata=0x7fffffffce38, par=0x135b7c8) at ../pxl/pximage.c:555 #7 0x00000000008927bc in pxReadRastPattern (par=0x135b7c8, pxs=0x135b978) at ../pxl/pximage.c:816 #8 0x000000000088830c in px_process (st=0x135b178, pxs=0x135b978, pr=0x7fffffffd7e0) at ../pxl/pxparse.c:329 #9 0x0000000000407140 in pxl_impl_process (instance=0x134be38, cursor=0x7fffffffd7e0) at ../pxl/pxtop.c:442 #10 0x0000000000887011 in pl_process (instance=0x134be38, cursor=0x7fffffffd7e0) at ../pl/pltop.c:155 #11 0x00000000008ed0f0 in pl_main_aux (argc=5, argv=0x7fffffffe698, disp=0x0) at ../pl/plmain.c:476 #12 0x00000000008ed5be in pl_main (argc=5, argv=0x7fffffffe698) at ../pl/plmain.c:579 #13 0x00000000008ec494 in main (argc=5, argv=0x7fffffffe698) at ../pl/realmain.c:21