{"action":"created","issue":{"url":"https://api.github.com/repos/kohler/gifsicle/issues/105","repository_url":"https://api.github.com/repos/kohler/gifsicle","labels_url":"https://api.github.com/repos/kohler/gifsicle/issues/105/labels{/name}","comments_url":"https://api.github.com/repos/kohler/gifsicle/issues/105/comments","events_url":"https://api.github.com/repos/kohler/gifsicle/issues/105/events","html_url":"https://github.com/kohler/gifsicle/issues/105","id":237995948,"number":105,"title":"Bad gif causes access violation on bad free","user":{"login":"strazzere","id":623686,"avatar_url":"https://avatars1.githubusercontent.com/u/623686?v=3","gravatar_id":"","url":"https://api.github.com/users/strazzere","html_url":"https://github.com/strazzere","followers_url":"https://api.github.com/users/strazzere/followers","following_url":"https://api.github.com/users/strazzere/following{/other_user}","gists_url":"https://api.github.com/users/strazzere/gists{/gist_id}","starred_url":"https://api.github.com/users/strazzere/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/strazzere/subscriptions","organizations_url":"https://api.github.com/users/strazzere/orgs","repos_url":"https://api.github.com/users/strazzere/repos","events_url":"https://api.github.com/users/strazzere/events{/privacy}","received_events_url":"https://api.github.com/users/strazzere/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-06-22T22:53:02Z","updated_at":"2017-06-23T14:54:04Z","closed_at":null,"body":"Similar to the others;\r\n\r\n```\r\ngdb$ run\r\nStarting program: /home/tstrazzere/repo/gifsicle/src/gifsicle -O2 ./weekend-crashes/id:000013,sig:11,src:000009+001152,op:splice,rep:2\r\n[Thread debugging using libthread_db enabled]\r\nUsing host libthread_db library \"/lib/x86_64-linux-gnu/libthread_db.so.1\".\r\ngifsicle:./accessviolationfree.gif:#0: read error: image corrupted, min_code_size too big\r\ngifsicle:./accessviolationfree.gif:#0: read error: image corrupted, code out of range (19 times)\r\ngifsicle:./accessviolationfree.gif:#0: read error: (not reporting more errors)\r\ngifsicle:./accessviolationfree.gif:#0: read error: missing 6528 pixels of image data\r\ngifsicle:./accessviolationfree.gif:#1: read error: image corrupted, min_code_size too big\r\ngifsicle:./accessviolationfree.gif:#1: read error: missing 1344 pixels of image data\r\ngifsicle:./accessviolationfree.gif:#2: read error: image corrupted, min_code_size too big\r\ngifsicle:./accessviolationfree.gif:#2: read error: image corrupted, code out of range (19 times)\r\ngifsicle:./accessviolationfree.gif:#2: read error: (not reporting more errors)\r\ngifsicle:./accessviolationfree.gif:#2: read error: missing 1213 pixels of image data\r\ngifsicle: (plus more errors; is this GIF corrupt?)\r\ngifsicle: warning: too many colors, using local colormaps\r\n  (You may want to try ‘--colors 256’.)\r\ngifsicle:./accessviolationfree.gif: warning: some colors undefined by colormap\r\n\r\nProgram received signal SIGSEGV, Segmentation fault.\r\n-----------------------------------------------------------------------------------------------------------------------[regs]\r\n  RAX: 0x02000000004014D0  RBX: 0x000000000063DAB0  RBP: 0x00007FFFF6DB7010  RSP: 0x00007FFFFFFFE250  o d I t s z a p c \r\n  RDI: 0x000000000063DA60  RSI: 0x0000000000000000  RDX: 0x0000000000000000  RCX: 0x0000000000000100  RIP: 0x0000000000408ACF\r\n  R8 : 0x000000000063DA9C  R9 : 0x0000000000000000  R10: 0x00000000006302B0  R11: 0x00000000000000D4  R12: 0x00007FFFF7505516\r\n  R13: 0x000000000063DAB0  R14: 0x00000000006388B0  R15: 0x0000000000638C30\r\n  CS: 0033  DS: 0000  ES: 0000  FS: 0000  GS: 0000  SS: 002B\t\t\t\t\r\n-----------------------------------------------------------------------------------------------------------------------[code]\r\n=> 0x408acf <Gif_ReleaseUncompressedImage+31>:\tcall   rax\r\n   0x408ad1 <Gif_ReleaseUncompressedImage+33>:\tmov    QWORD PTR [rbx+0x8],0x0\r\n   0x408ad9 <Gif_ReleaseUncompressedImage+41>:\tmov    QWORD PTR [rbx+0x10],0x0\r\n   0x408ae1 <Gif_ReleaseUncompressedImage+49>:\tmov    QWORD PTR [rbx+0x48],0x0\r\n   0x408ae9 <Gif_ReleaseUncompressedImage+57>:\tpop    rbx\r\n   0x408aea <Gif_ReleaseUncompressedImage+58>:\tret    \r\n   0x408aeb:\tnop    DWORD PTR [rax+rax*1+0x0]\r\n   0x408af0 <Gif_ClipImage>:\tmov    r9,QWORD PTR [rdi+0x8]\r\n-----------------------------------------------------------------------------------------------------------------------------\r\nGif_ReleaseUncompressedImage (gfi=gfi@entry=0x63dab0) at giffunc.c:714\r\n714\t    (*gfi->free_image_data)(gfi->image_data);\r\ngdb$ exploitable\r\nDescription: Access violation near NULL during branch instruction\r\nShort description: BranchAvNearNull (13/22)\r\nHash: 76a4f8f99d605e9b77fb3cfab7313902.ab595681a77cdf09ec84944276667d89\r\nExploitability Classification: PROBABLY_EXPLOITABLE\r\nExplanation: The target crashed on a branch instruction, which may indicate that the control flow is tainted. However, there is a chance it could be a NULL dereference.\r\nOther tags: AccessViolation (21/22)\r\n```\r\n\r\n[accessviolationfree.zip](https://github.com/kohler/gifsicle/files/1096359/accessviolationfree.zip)\r\n"},"comment":{"url":"https://api.github.com/repos/kohler/gifsicle/issues/comments/310687269","html_url":"https://github.com/kohler/gifsicle/issues/105#issuecomment-310687269","issue_url":"https://api.github.com/repos/kohler/gifsicle/issues/105","id":310687269,"user":{"login":"kohler","id":410647,"avatar_url":"https://avatars1.githubusercontent.com/u/410647?v=3","gravatar_id":"","url":"https://api.github.com/users/kohler","html_url":"https://github.com/kohler","followers_url":"https://api.github.com/users/kohler/followers","following_url":"https://api.github.com/users/kohler/following{/other_user}","gists_url":"https://api.github.com/users/kohler/gists{/gist_id}","starred_url":"https://api.github.com/users/kohler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kohler/subscriptions","organizations_url":"https://api.github.com/users/kohler/orgs","repos_url":"https://api.github.com/users/kohler/repos","events_url":"https://api.github.com/users/kohler/events{/privacy}","received_events_url":"https://api.github.com/users/kohler/received_events","type":"User","site_admin":false},"created_at":"2017-06-23T14:54:04Z","updated_at":"2017-06-23T14:54:04Z","body":"Hi, thanks for fuzzing gifsicle!!\r\n\r\nHowever, I can't replicate this. I ran `gifsicle -O2 accessviolationfree.gif -o x.gif` under valgrind. At current HEAD (a0a365136f44e5519f7f486b00a67387f641d0e8), I get no warnings or errors at all. At previous HEAD (0e02f7b62a9a3a344c34f92ddb7e178ad3b3e3ff), I get some uninitialized-value warnings, but no crash.\r\n\r\nWhat version of gifsicle are you fuzzing?"}}
{"actor":{"display_login":"kohler"}}