Bug 105247 (CVE-2018-7731)

Created attachment 137601 [details]
POC file that crashing exempi in WEBP_Support.cpp:123 WEBP::VP8XChunk::VP8XChunk()

Description of problem:
The WEBP::VP8XChunk::VP8XChunk() function at WEBP_Support.cpp:123 in exempi 2.4.4 may result DoS(crash) via a crafted file.

Version-Release number of selected component (if applicable):
2.4.4

Steps to Reproduce:
./exempi -x $POC

Additional info:
Ubuntu 16.04, x64
The output of exempi with address sanitizer enabled

/opt/asan/exempi/bin/exempi -x exempi-WEBP_Support-123-SEGV 
processing file exempi-WEBP_Support-123-SEGV
dump_xmp for file exempi-WEBP_Support-123-SEGV
ASAN:SIGSEGV
=================================================================
==7132==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000007 (pc 0x0000005caa55 bp 0x7ffc6a6742b0 sp 0x7ffc6a674270 T0)
    #0 0x5caa54 in WEBP::VP8XChunk::VP8XChunk(WEBP::Container*) /root/exempi-2.4.4/XMPFiles/source/FormatSupport/WEBP_Support.cpp:123
    #1 0x5cb1a6 in WEBP::Container::Container(WEBP_MetaHandler*) /root/exempi-2.4.4/XMPFiles/source/FormatSupport/WEBP_Support.cpp:201
    #2 0x5c5fbf in WEBP_MetaHandler::CacheFileData() /root/exempi-2.4.4/XMPFiles/source/FileHandlers/WEBP_Handler.cpp:89
    #3 0x491ad4 in DoOpenFile /root/exempi-2.4.4/XMPFiles/source/XMPFiles.cpp:908
    #4 0x49230e in XMPFiles::OpenFile(char const*, unsigned int, unsigned int) /root/exempi-2.4.4/XMPFiles/source/XMPFiles.cpp:1011
    #5 0x488c27 in WXMPFiles_OpenFile_1 /root/exempi-2.4.4/XMPFiles/source/WXMPFiles.cpp:234
    #6 0x41dc70 in TXMPFiles<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >::OpenFile(char const*, unsigned int, unsigned int) (/opt/asan/exempi/bin/exempi+0x41dc70)
    #7 0x40b797 in xmp_files_open_new /root/exempi-2.4.4/exempi/exempi.cpp:280
    #8 0x4086f4 in get_xmp_from_file /root/exempi-2.4.4/exempi/main.cpp:235
    #9 0x4088ed in dump_xmp /root/exempi-2.4.4/exempi/main.cpp:250
    #10 0x409573 in process_file /root/exempi-2.4.4/exempi/main.cpp:340
    #11 0x408151 in main /root/exempi-2.4.4/exempi/main.cpp:187
    #12 0x7f9265c1282f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #13 0x4074d8 in _start (/opt/asan/exempi/bin/exempi+0x4074d8)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/exempi-2.4.4/XMPFiles/source/FormatSupport/WEBP_Support.cpp:123 WEBP::VP8XChunk::VP8XChunk(WEBP::Container*)
==7132==ABORTING

Weiran Labs, Zhaoliang
leon.zhao.7@gmail.com