Following attached sample file crashes dmg2img. Sample file is fuzzed with
american fuzzy lop <http://lcamtuf.coredump.cx/afl/>. Feel free to contact me in
case you need more information. I was unable to find upstream bug tracker for
this software.
4151c324add3ce78c5a2e7417ae951c309924742 sample02.dmg
gdb:
"""
(gdb) run -v -V -d sample02.dmg
Starting program: dmg2img -v -V -d sample02.dmg
dmg2img v1.6.5 (c) vu1tur (to@vu1tur.eu.org)
sample02.dmg --> sample02.img
Debug info will be written to dmg2img.log
reading property list, 7740 bytes from address 18076 ...
bWlzaAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAA
AAgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAIAAAAgsOF5gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAACgAAABAAAAAsAAAAAAAAAAAAAAAAAAAABAAAA
AAAAFwwAAAAAAAAAH/////8AAAAAAAAAAAAAAAEAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAA=
partition 0: begin=203, size=430, decoded=284
bWlzaAAAAAEAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAAA
AAgIAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAIAAAAgMIi6gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAACgAAABQAAAAcAAAAAAAAAAAAAAAAAAAABAAAA
AAAAFsAAAAAAAAAATP////8AAAAAAAAAAAAAAAEAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAA=
partition 1: begin=948, size=430, decoded=284
bWlzaAAAAAEAAAAAAAAAAgAAAAAAAAAgAAAAAAAAAAAA
AAgIAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAIAAAAgQqxw8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAACgAAABQAAAE8AAAAAAAAAAAAAAAAAAAAgAAAA
AAAAAAAAAAAAAAAAsf////8AAAAAAAAAAAAAACAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAA=
partition 2: begin=1695, size=430, decoded=284
bWlzaAAAAAEAAAAAAAAAIgAAAAAAAAAGAAAAAAAAAAAA
AAgIAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAIAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAACAAAAAgAAAE8AAAAAAAAAAAAAAAAAAAAGAAAA
AAAAALEAAAAAAAAAAP////8AAAAAAAAAAAAAAAYAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAA=
partition 3: begin=2424, size=430, decoded=284
bWlzaAAAAAEAAAAAAAAAKAAAAAAAAEuIAAAAAAAAAAAA
AAgIAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAIAAAAgyxW3agAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAALgAAABQAAAE8AAAAAAAAAAAAAAAAAAAfaAAAA
AAAAMG8AAAAAAAAWLQAAAAAAAAAAAAAAAAAAB9oAAAAA
AAAAJgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAgAAAAAAAAAAuAAAAAAAAAAAAAAAAAAAAAAgAAABQAA
ACcAAAAAAAAK4AAAAAAAAASYAAAAAAAAASMAAAAAAAAP
7wAAAAIAAAAnAAAAAAAAD3gAAAAAAAADaAAAAAAAABcr
AAAAAAAAAAAAAAACAAAAAAAAAAAAABLgAAAAAAAAOJgA
AAAAAAAAAAAAAAAAAAAAgAAABQAAAA0AAAAAAABLeAAA
AAAAAAAIAAAAAAAAERIAAAAAAAAARQAAAAIAAAANAAAA
AAAAS4AAAAAAAAAABgAAAAAAAACxAAAAAAAAAACAAAAF
AAAADQAAAAAAAEuGAAAAAAAAAAEAAAAAAAARVwAAAAAA
AACFAAAAAgAAAA0AAAAAAABLhwAAAAAAAAABAAAAAAAA
ALEAAAAAAAAAAP////8AAAAAAAAAAAAAS4gAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAA=
partition 4: begin=3137, size=965, decoded=644
bWlzaAAAAAEAAAAAAABLsAAAAAAAAAAgAAAAAAAAAAAA
AAgIAAAABQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAIAAAAgQqxw8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAACgAAABQAAAA0AAAAAAAAAAAAAAAAAAAAgAAAA
AAAAL5AAAAAAAAAAsf////8AAAAAAAAAAAAAACAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAA=
partition 5: begin=4409, size=430, decoded=284
bWlzaAAAAAEAAAAAAABL0AAAAAAAAAABAAAAAAAAAAAA
AAgIAAAABgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAIAAAAg2iuEDgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAACgAAABQAAAA0AAAAAAAAAAAAAAAAAAAABAAAA
AAAAANUAAAAAAAAATv////8AAAAAAAAAAAAAAAEAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAA=
partition 6: begin=5154, size=430, decoded=284
decompressing:
opening partition 0 ...
offset = 0 block_type = 0x80000004
ADC decompress (in_addr=5900 in_size=31 out_addr=0 out_size=512)
Program received signal SIGSEGV, Segmentation fault.
adc_decompress (in_size=31, input=0x7ffff7ed8010 "x\001c`\030\005C8\004\376\375\377\377\016\210\031\201^\270\340M\272?BW\001", avail_size=1048576, output=0x7ffff7428010 "", bytes_written=<optimized out>) at adc.c:66
66 memcpy(outp, outp - offset - 1, 1);
(gdb) bt full
#0 adc_decompress (in_size=31, input=0x7ffff7ed8010 "x\001c`\030\005C8\004\376\375\377\377\016\210\031\201^\270\340M\272?BW\001", avail_size=1048576, output=0x7ffff7428010 "", bytes_written=<optimized out>) at adc.c:66
output_full = 0
inp = 0x7ffff7ed8010 "x\001c`\030\005C8\004\376\375\377\377\016\210\031\201^\270\340M\272?BW\001"
outp = 0x7ffff7428010 ""
i = 0
#1 0x00000000004052ca in main (argc=<optimized out>, argv=<optimized out>) at dmg2img.c:557
bytes_written = <optimized out>
read_from_input = <optimized out>
bi = 1
i = <optimized out>
err = <optimized out>
partnum = 7
tmp = 0x7ffff7ed8010 "x\001c`\030\005C8\004\376\375\377\377\016\210\031\201^\270\340M\272?BW\001"
otmp = 0x7ffff7529010 ""
dtmp = 0x7ffff7428010 ""
input_file = <optimized out>
output_file = 0x610010 "sample02.img"
plist = 0x6106f0 "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n<dict>\n\t<key>resource-fork</key>\n\t<d"...
blkx = 0x612540 "<key>blkx</key>\n\t\t<array>\n\t\t\t<dict>\n\t\t\t\t<key>Attributes</key>\n\t\t\t\t<string>0x0050</string>\n\t\t\t\t<key>CFName</key>\n\t\t\t\t<string>Protective Master Boot Record (MBR : 0)</string>\n\t\t\t\t<key>Data</key>\n\t\t\t\t<da"...
blkx_size = <optimized out>
parts = 0x613eb0
data_begin = <optimized out>
data_end = <optimized out>
partname_begin = <optimized out>
partname_end = <optimized out>
mish_begin = <optimized out>
partname = "GPT Header (Backup GPT Header : 6)", '\000' <repeats 220 times>
data_size = <optimized out>
out_offs = 2147483652
out_size = <optimized out>
in_offs = 5900
in_size = <optimized out>
in_offs_add = 5931
add_offs = 0
to_read = 31
to_write = 31
chunk = 31
reserved = "\000\000\000\v"
sztype = "adc", '\000' <repeats 60 times>
block_type = <optimized out>
szSignature = "koly"
rSignature = <optimized out>
__PRETTY_FUNCTION__ = "main"
#2 0x00007ffff7648ead in __libc_start_main (main=<optimized out>, argc=<optimized out>, ubp_av=<optimized out>, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffeae8) at libc-start.c:244
result = <optimized out>
unwind_buf = {cancel_jmp_buf = {{jmp_buf = {0, -7620581345912803821, 4226116, 140737488349936, 0, 0, 7620581346341432851, 7620564927882079763}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x40e7c0, 0x7fffffffeaf8}, data = {
prev = 0x0, cleanup = 0x0, canceltype = 4253632}}}
not_first_call = <optimized out>
#3 0x0000000000407c6d in _start ()
No symbol table info available.
"""
valgrind:
"""
==30730== Memcheck, a memory error detector
==30730== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al.
==30730== Using Valgrind-3.7.0 and LibVEX; rerun with -h for copyright info
==30730== Command: dmg2img sample02.dmg
==30730==
dmg2img v1.6.5 (c) vu1tur (to@vu1tur.eu.org)
sample02.dmg --> sample02.img
decompressing:
opening partition 0 ... ERROR: reading file sample02.dmg
==30730== Syscall param write(buf) points to uninitialised byte(s)
==30730== at 0x5326780: __write_nocancel (syscall-template.S:82)
==30730== by 0x52C8AF2: _IO_file_write@@GLIBC_2.2.5 (fileops.c:1276)
==30730== by 0x52C8769: new_do_write (fileops.c:530)
==30730== by 0x52C8A94: _IO_do_write@@GLIBC_2.2.5 (fileops.c:503)
==30730== by 0x52CA8D6: _IO_flush_all_lockp (genops.c:849)
==30730== by 0x52CB6E4: _IO_cleanup (genops.c:1010)
==30730== by 0x528CA7D: __run_exit_handlers (exit.c:91)
==30730== by 0x528CB34: exit (exit.c:100)
==30730== by 0x5274EB3: (below main) (libc-start.c:276)
==30730== Address 0x4025000 is not stack'd, malloc'd or (recently) free'd
==30730==
==30730==
==30730== HEAP SUMMARY:
==30730== in use at exit: 3,162,750 bytes in 16 blocks
==30730== total heap usage: 29 allocs, 13 frees, 3,170,754 bytes allocated
==30730==
==30730== LEAK SUMMARY:
==30730== definitely lost: 3,161,374 bytes in 11 blocks
==30730== indirectly lost: 240 bytes in 3 blocks
==30730== possibly lost: 0 bytes in 0 blocks
==30730== still reachable: 1,136 bytes in 2 blocks
==30730== suppressed: 0 bytes in 0 blocks
==30730== Rerun with --leak-check=full to see details of leaked memory
==30730==
==30730== For counts of detected and suppressed errors, rerun with: -v
==30730== Use --track-origins=yes to see where uninitialised values come from
==30730== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 4 from 4)
"""