#777495 winicontoppm: buffer over-read + null pointer dereference

Package:
netpbm
Source:
netpbm-free
Description:
Graphics conversion tools between image formats
Submitter:
Jakub Wilk
Date:
2015-02-08 20:15:06 UTC
Severity:
normal
#777495#3
Date:
2015-02-08 20:12:28 UTC
From:
To:
winicontoppm crashes on the attached file:

$ winicontoppm crash.ico
Segmentation fault

Valgrind says it's a buffer over-read, followed by null pointer
dereference:

==9552== Use of uninitialised value of size 4
==9552==    at 0x804CB22: writeXors (winicontoppm.c:623)
==9552==    by 0x804CB22: main (winicontoppm.c:830)
==9552==
==9552== Invalid read of size 4
==9552==    at 0x804CB22: writeXors (winicontoppm.c:623)
==9552==    by 0x804CB22: main (winicontoppm.c:830)
==9552==  Address 0x421ec90 is 8 bytes after a block of size 8 alloc'd
==9552==    at 0x40291CC: malloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==9552==    by 0x405AAB4: malloc2 (in /usr/lib/libnetpbm.so.10.0)
==9552==    by 0x804DC16: readIconFile (winicontoppm.c:437)
==9552==    by 0x804DC16: main (winicontoppm.c:786)
==9552==
==9552== Invalid read of size 1
==9552==    at 0x804CB25: writeXors (winicontoppm.c:624)
==9552==    by 0x804CB25: main (winicontoppm.c:830)
==9552==  Address 0x0 is not stack'd, malloc'd or (recently) free'd


This bug was found using American fuzzy lop:
http://lcamtuf.coredump.cx/afl/
(available in Debian experimental)