{"action":"created","issue":{"url":"https://api.github.com/repos/FLIF-hub/FLIF/issues/57","labels_url":"https://api.github.com/repos/FLIF-hub/FLIF/issues/57/labels{/name}","comments_url":"https://api.github.com/repos/FLIF-hub/FLIF/issues/57/comments","events_url":"https://api.github.com/repos/FLIF-hub/FLIF/issues/57/events","html_url":"https://github.com/FLIF-hub/FLIF/issues/57","id":110085462,"number":57,"title":"FLIF decoder needs to be afl-fuzzed (crashes found)","user":{"login":"d33tah","id":295322,"avatar_url":"https://avatars.githubusercontent.com/u/295322?v=3","gravatar_id":"","url":"https://api.github.com/users/d33tah","html_url":"https://github.com/d33tah","followers_url":"https://api.github.com/users/d33tah/followers","following_url":"https://api.github.com/users/d33tah/following{/other_user}","gists_url":"https://api.github.com/users/d33tah/gists{/gist_id}","starred_url":"https://api.github.com/users/d33tah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/d33tah/subscriptions","organizations_url":"https://api.github.com/users/d33tah/orgs","repos_url":"https://api.github.com/users/d33tah/repos","events_url":"https://api.github.com/users/d33tah/events{/privacy}","received_events_url":"https://api.github.com/users/d33tah/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/FLIF-hub/FLIF/labels/decoder","name":"decoder","color":"0052cc"},{"url":"https://api.github.com/repos/FLIF-hub/FLIF/labels/robustness","name":"robustness","color":"eb6420"}],"state":"closed","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/FLIF-hub/FLIF/milestones/2","html_url":"https://github.com/FLIF-hub/FLIF/milestones/M1","labels_url":"https://api.github.com/repos/FLIF-hub/FLIF/milestones/2/labels","id":1355921,"number":2,"title":"M1","description":"First 'safe to use' release. Images encoded after this milestone should be decodable with any future version of flif. The format is sufficiently stable to start pushing other projects (image viewers, image editors, web browsers, ...) to support FLIF.","creator":{"login":"jonsneyers","id":15010068,"avatar_url":"https://avatars.githubusercontent.com/u/15010068?v=3","gravatar_id":"","url":"https://api.github.com/users/jonsneyers","html_url":"https://github.com/jonsneyers","followers_url":"https://api.github.com/users/jonsneyers/followers","following_url":"https://api.github.com/users/jonsneyers/following{/other_user}","gists_url":"https://api.github.com/users/jonsneyers/gists{/gist_id}","starred_url":"https://api.github.com/users/jonsneyers/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jonsneyers/subscriptions","organizations_url":"https://api.github.com/users/jonsneyers/orgs","repos_url":"https://api.github.com/users/jonsneyers/repos","events_url":"https://api.github.com/users/jonsneyers/events{/privacy}","received_events_url":"https://api.github.com/users/jonsneyers/received_events","type":"User","site_admin":false},"open_issues":1,"closed_issues":22,"state":"open","created_at":"2015-10-14T18:21:38Z","updated_at":"2015-12-05T06:42:45Z","due_on":"2015-12-05T23:00:00Z","closed_at":null},"comments":16,"created_at":"2015-10-06T19:46:38Z","updated_at":"2015-12-05T06:55:07Z","closed_at":"2015-12-05T06:42:45Z","body":"I ran a quick round of fuzzing using [American Fuzzy Lop](http://lcamtuf.coredump.cx/afl/) and immediately found the following examples:\r\n\r\n```\r\nroot@e0a3ba7ea8a2:~/FLIF-master# ./flif -d  o/crashes/id\\:000001*  /tmp/a.png\r\nWarning: expected file name extension \".flif\" for input file, trying anyway...\r\nFloating point exception (core dumped)\r\nroot@e0a3ba7ea8a2:~/FLIF-master# base64 o/crashes/id\\:000001\\,sig\\:08\\,src\\:000000\\,op\\:flip1\\,pos\\:7 \r\nRkxJRjMxAAAAHoHz280HVfdJ5npjXrviUtU3tQFYKJtBFQorvILr\r\nroot@e0a3ba7ea8a2:~/FLIF-master# ./flif -d  o/crashes/id\\:000002*  /tmp/a.png\r\nWarning: expected file name extension \".flif\" for input file, trying anyway...\r\nInvalid tree. Aborting tree decoding.\r\nInvalid tree. Aborting tree decoding.\r\nInvalid tree. Aborting tree decoding.\r\nSegmentation fault (core dumped)\r\nroot@e0a3ba7ea8a2:~/FLIF-master# ./flif -d  o/crashes/id\\:000003*  /tmp/a.png\r\nWarning: expected file name extension \".flif\" for input file, trying anyway...\r\nInvalid tree. Aborting tree decoding.\r\nInvalid tree. Aborting tree decoding.\r\nterminate called after throwing an instance of 'std::bad_alloc'\r\n  what():  std::bad_alloc\r\nAborted (core dumped)\r\nroot@e0a3ba7ea8a2:~/FLIF-master# ./flif -d  o/crashes/id\\:000004*  /tmp/a.png\r\nWarning: expected file name extension \".flif\" for input file, trying anyway...\r\nSegmentation fault (core dumped)\r\nroot@e0a3ba7ea8a2:~/FLIF-master# ./flif -d  o/crashes/id\\:000005*  /tmp/a.png\r\nWarning: expected file name extension \".flif\" for input file, trying anyway...\r\nInvalid tree. Aborting tree decoding.\r\nSegmentation fault (core dumped)\r\nroot@e0a3ba7ea8a2:~/FLIF-master# ./flif -d  o/crashes/id\\:000006*  /tmp/a.png\r\nWarning: expected file name extension \".flif\" for input file, trying anyway...\r\nInvalid tree. Aborting tree decoding.\r\nInvalid tree. Aborting tree decoding.\r\nInvalid tree. Aborting tree decoding.\r\n*** Error in `./flif': free(): invalid next size (fast): 0x0000000000d88760 ***\r\nAborted (core dumped)\r\nroot@e0a3ba7ea8a2:~/FLIF-master# ./flif -d  o/crashes/id\\:000007*  /tmp/a.png\r\nWarning: expected file name extension \".flif\" for input file, trying anyway...\r\n*** Error in `./flif': free(): invalid next size (fast): 0x00000000027111b0 ***\r\nAborted (core dumped)\r\nroot@e0a3ba7ea8a2:~/FLIF-master# ./flif -d  o/crashes/id\\:000008*  /tmp/a.png\r\nWarning: expected file name extension \".flif\" for input file, trying anyway...\r\nFloating point exception (core dumped)\r\nroot@e0a3ba7ea8a2:~/FLIF-master# ./flif -d  o/crashes/id\\:000009*  /tmp/a.png\r\nWarning: expected file name extension \".flif\" for input file, trying anyway...\r\nInvalid tree. Aborting tree decoding.\r\nterminate called after throwing an instance of 'std::bad_alloc'\r\n  what():  std::bad_alloc\r\nAborted (core dumped)\r\n```\r\n\r\nYou can quickly reproduce the fuzzing by creating a file named Dockerfile in a separate directory. File should have the following contents:\r\n\r\n```\r\nFROM d33tah/afl-sid\r\nRUN cd /; wget --no-check-certificate \"https://github.com/jonsneyers/FLIF/archive/master.zip\"\r\nRUN apt-get update; apt-get install pkg-config libpng-dev unzip -y\r\nRUN . ~/.bashrc; cd / ; unzip master.zip ; cd FLIF-master ; make -j`nproc` \r\nRUN mkdir /i ; echo 'RkxJRjMxAAEAHoHz280HVfdJ5npjXrviUtU3tQFYKJtBFQorvILr' | base64 -d > /i/1\r\nCMD . ~/.bashrc; afl-fuzz -i /i -o /FLIF-master/o /FLIF-master/flif -d @@ /tmp/out.png\r\n```\r\n\r\nThen `cd` into this file and run: `sudo docker build -t flif-afl-sid . && sudo docker run -ti flif-afl-sid`. Let me know if you need help extracting the crashing files later."},"comment":{"url":"https://api.github.com/repos/FLIF-hub/FLIF/issues/comments/162156809","html_url":"https://github.com/FLIF-hub/FLIF/issues/57#issuecomment-162156809","issue_url":"https://api.github.com/repos/FLIF-hub/FLIF/issues/57","id":162156809,"user":{"login":"jonsneyers","id":15010068,"avatar_url":"https://avatars.githubusercontent.com/u/15010068?v=3","gravatar_id":"","url":"https://api.github.com/users/jonsneyers","html_url":"https://github.com/jonsneyers","followers_url":"https://api.github.com/users/jonsneyers/followers","following_url":"https://api.github.com/users/jonsneyers/following{/other_user}","gists_url":"https://api.github.com/users/jonsneyers/gists{/gist_id}","starred_url":"https://api.github.com/users/jonsneyers/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jonsneyers/subscriptions","organizations_url":"https://api.github.com/users/jonsneyers/orgs","repos_url":"https://api.github.com/users/jonsneyers/repos","events_url":"https://api.github.com/users/jonsneyers/events{/privacy}","received_events_url":"https://api.github.com/users/jonsneyers/received_events","type":"User","site_admin":false},"created_at":"2015-12-05T06:55:07Z","updated_at":"2015-12-05T06:55:07Z","body":"In case anyone wants to continue fuzzing:\r\n\r\nAs input files, you can just use one or more small images and small animations (e.g. greyscale, RGB and RGBA) and encode those with various encoder settings, in particular `-ia`, `-na`, `-ib`, `-nb`. `-R`, `-C` for still images and those plus `-l0`, `-l1`, `-l100`, `-F`.\r\nI don't think the exact input matters much, because simple bitflips in the header will quickly produce corrupt images with all kinds of encoder settings."}}