Segmentation fault in input-pnm.ci:272

[puppet-meteor]

There is a segmentation fault in input-pnm.ci:272 at sam2p 0.49.4. A crafted input will lead to denial of service attack.

Steps to Reproduce:

#./sam2p POC_0 EPS: /dev/null

POC File: https://github.com/puppet-meteor/sam2p_POC/blob/master/POC_0

Information from addresssanitizer:

This is sam2p 0.49.4.
Available Loaders: PS PDF JAI PNG JPEG TIFF PNM BMP GIF LBM XPM PCX TGA.
Available Appliers: XWD Meta Empty BMP PNG TIFF6 TIFF6-JAI JPEG-JAI JPEG PNM GIF89a+LZW XPM PSL1C PSL23+PDF PSL2+PDF-JAI P-TrOpBb.
ASAN:SIGSEGV
=================================================================
==6337==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000425c25 bp 0x7fff976c1f70 sp 0x7fff976c1c60 T0)
    #0 0x425c24 in pnm_load_image(GenBuffer::Readable*) /home/puppet/target/sam2p-gdb/input-pnm.ci:272
    #1 0x4264e5 in in_pnm_reader /home/puppet/target/sam2p-gdb/in_pnm.cpp:48
    #2 0x478f1b in Image::load(Image::Loader::UFD*, SimBuffer::Flat const&, char const*) /home/puppet/target/sam2p-gdb/image.cpp:1427
    #3 0x403a96 in run_sam2p_engine(Files::FILEW&, Files::FILEW&, char const* const*, bool) /home/puppet/target/sam2p-gdb/sam2p_main.cpp:1024
    #4 0x40264f in main /home/puppet/target/sam2p-gdb/sam2p_main.cpp:1117
    #5 0x7f308d9c782f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #6 0x402f98 in _start (/usr/local/bin/sam2p+0x402f98)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/puppet/target/sam2p-gdb/input-pnm.ci:272 pnm_load_image(GenBuffer::Readable*)
==6337==ABORTING

found by [email protected] from NESA Lab in Zhejiang University.

[pts]

Thank you for reporting this! I'm not able to reproduce this bug with the latest sam2p HEAD (d2656be), so I'm closing this issue now. Feel free to report more issues, but please check that you have d2656be or later checked out.

$ ./sam2p.asan POC_0 EPS: /dev/null
This is sam2p 0.49.4.
Available Loaders: PS PDF JAI PNG JPEG TIFF PNM BMP GIF LBM XPM PCX TGA.
Available Appliers: XWD Meta Empty BMP PNG TIFF6 TIFF6-JAI JPEG-JAI JPEG PNM GIF89a+LZW XPM PSL1C PSL23+PDF PSL2+PDF-JAI P-TrOpBb.
sam2p: Error: PNM: file not in a supported format

[pts]

Please note that I've recently added https://github.com/pts/sam2p/blob/master/compile_asan.sh to compile sam2p with AddressSanitizer enabled.

If you notice a bug, please pull master from https://github.com/pts/sam2p , and then use compile_asan.sh to compile sam2p, and include the output of ./sam2p.asan in the issue you report. (Additionally, feel free to include the output of other compilation methods and other sam2p versions.)