segfault on corrupted bmp files

[tianxiaogu]

Download and unzip the attached file.

catimg 42

42.zip

AddressSanitizer:DEADLYSIGNAL
=================================================================
==6640==ERROR: AddressSanitizer: SEGV on unknown address 0x7f34e2dfe8c0 (pc 0x0000006334c3 bp 0x7ffc1a40b340 sp 0x7ffc1a40ac60 T0)
==6640==The signal is caused by a READ memory access.
    #0 0x6334c2 in stbi__bmp_load_cont /home/t/Projects/afl/fuzzing-experiments/subjects/catimg/src/stb_image.h
    #1 0x58cce2 in stbi__bmp_load /home/t/Projects/afl/fuzzing-experiments/subjects/catimg/src/stb_image.h:4800:11
    #2 0x58cce2 in stbi__load_main /home/t/Projects/afl/fuzzing-experiments/subjects/catimg/src/stb_image.h:947
    #3 0x556121 in stbi__xload_main /home/t/Projects/afl/fuzzing-experiments/subjects/catimg/src/sh_image.c:72:26
    #4 0x5bea05 in stbi_xload /home/t/Projects/afl/fuzzing-experiments/subjects/catimg/src/sh_image.c:92:18
    #5 0x5bea05 in img_load_from_file /home/t/Projects/afl/fuzzing-experiments/subjects/catimg/src/sh_image.c:188
    #6 0x52836c in main /home/t/Projects/afl/fuzzing-experiments/subjects/catimg/src/catimg.c:115:9
    #7 0x7f3441323b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
    #8 0x41bbe9 in _start (/home/t/Projects/afl/fuzzing-experiments/subjects/catimg/bin/catimg+0x41bbe9)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/t/Projects/afl/fuzzing-experiments/subjects/catimg/src/stb_image.h in stbi__bmp_load_cont
==6640==ABORTING

[posva]

Thanks for posting this but these are all related to the external lib that load images. I accept prs for fixing these but I don't have time to fix it myself 🙂