{"action":"closed","issue":{"url":"https://api.github.com/repos/cloudflare/jpegtran/issues/4","labels_url":"https://api.github.com/repos/cloudflare/jpegtran/issues/4/labels{/name}","comments_url":"https://api.github.com/repos/cloudflare/jpegtran/issues/4/comments","events_url":"https://api.github.com/repos/cloudflare/jpegtran/issues/4/events","html_url":"https://github.com/cloudflare/jpegtran/issues/4","id":110583769,"number":4,"title":"Malformed targa image file causes integer divide by zero in lt-cjpeg (SIGFPE)","user":{"login":"geeknik","id":466878,"avatar_url":"https://avatars.githubusercontent.com/u/466878?v=3","gravatar_id":"","url":"https://api.github.com/users/geeknik","html_url":"https://github.com/geeknik","followers_url":"https://api.github.com/users/geeknik/followers","following_url":"https://api.github.com/users/geeknik/following{/other_user}","gists_url":"https://api.github.com/users/geeknik/gists{/gist_id}","starred_url":"https://api.github.com/users/geeknik/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/geeknik/subscriptions","organizations_url":"https://api.github.com/users/geeknik/orgs","repos_url":"https://api.github.com/users/geeknik/repos","events_url":"https://api.github.com/users/geeknik/events{/privacy}","received_events_url":"https://api.github.com/users/geeknik/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-10-09T03:54:37Z","updated_at":"2015-10-12T08:15:08Z","closed_at":"2015-10-12T08:15:08Z","body":"While fuzzing jpegtran with American Fuzzy Lop, I was able to cause a SIGFPE in lt-cjpeg with a malformed targa image file.\r\n\r\n~/jpegtran/.libs/lt-cjpeg -targa -optimize -nosmooth -rgb1 test00.tga\r\n\r\n```\r\n==42641== Process terminating with default action of signal 8 (SIGFPE)\r\n==42641==  Integer divide by zero at address 0x80335CA1C\r\n==42641==    at 0x4F2B76B: alloc_sarray (jmemmgr.c:399)\r\n==42641==    by 0x40C737: start_input_tga (rdtarga.c:437)\r\n==42641==    by 0x401A24: main (cjpeg.c:626)\r\nFloating point exception\r\n\r\nProgram received signal SIGFPE, Arithmetic exception.\r\n0x00007ffff7bca76f in alloc_sarray ()\r\n   from /home/geeknik/jpegtran/.libs/libjpeg.so.9\r\n(gdb) bt\r\n#0  0x00007ffff7bca76f in alloc_sarray ()\r\n   from /home/geeknik/jpegtran/.libs/libjpeg.so.9\r\n#1  0x000000000040c738 in start_input_tga ()\r\n#2  0x0000000000401a25 in main () at cjpeg.c:626\r\n(gdb) i r\r\nrax            0x3b9ac9e8\t999999976\r\nrbx            0x61a010\t6397968\r\nrcx            0x1\t1\r\nrdx            0x0\t0\r\nrsi            0x1\t1\r\nrdi            0x7fffffffdff0\t140737488347120\r\nrbp            0x7fffffffdff0\t0x7fffffffdff0\r\nrsp            0x7fffffffde60\t0x7fffffffde60\r\nr8             0x30\t48\r\nr9             0x0\t0\r\nr10            0x7fffffffdf40\t140737488346944\r\nr11            0x7fffffffdf40\t140737488346944\r\nr12            0x7fffffffdff0\t140737488347120\r\nr13            0x30\t48\r\nr14            0x0\t0\r\nr15            0x0\t0\r\nrip            0x7ffff7bca76f\t0x7ffff7bca76f <alloc_sarray+111>\r\neflags         0x10246\t[ PF ZF IF RF ]\r\ncs             0x33\t51\r\nss             0x2b\t43\r\nds             0x0\t0\r\nes             0x0\t0\r\nfs             0x0\t0\r\ngs             0x0\t0\r\n```\r\n\r\nCrashing test case: https://dl.dropboxusercontent.com/u/6088006/test00.tga"}}