{"action":"created","issue":{"url":"https://api.github.com/repos/pornel/pngquant/issues/136","labels_url":"https://api.github.com/repos/pornel/pngquant/issues/136/labels{/name}","comments_url":"https://api.github.com/repos/pornel/pngquant/issues/136/comments","events_url":"https://api.github.com/repos/pornel/pngquant/issues/136/events","html_url":"https://github.com/pornel/pngquant/issues/136","id":56196209,"number":136,"title":"SIGSEGV on specially crafted png - ab9f6ec5","user":{"login":"jodiecunningham","id":1390085,"avatar_url":"https://avatars.githubusercontent.com/u/1390085?v=3","gravatar_id":"","url":"https://api.github.com/users/jodiecunningham","html_url":"https://github.com/jodiecunningham","followers_url":"https://api.github.com/users/jodiecunningham/followers","following_url":"https://api.github.com/users/jodiecunningham/following{/other_user}","gists_url":"https://api.github.com/users/jodiecunningham/gists{/gist_id}","starred_url":"https://api.github.com/users/jodiecunningham/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jodiecunningham/subscriptions","organizations_url":"https://api.github.com/users/jodiecunningham/orgs","repos_url":"https://api.github.com/users/jodiecunningham/repos","events_url":"https://api.github.com/users/jodiecunningham/events{/privacy}","received_events_url":"https://api.github.com/users/jodiecunningham/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-02-02T04:59:28Z","updated_at":"2015-02-03T02:26:13Z","closed_at":"2015-02-02T05:03:55Z","body":"Hi pornel,\r\n\r\nThrough some fuzzing I found a file that would cause this software to segfault. \r\n\r\nSource file:\r\n![ab9f6ec5](https://cloud.githubusercontent.com/assets/1390085/5996016/7df98152-aa65-11e4-9b99-a4c88129769e.png)\r\nalso found on https://www.dropbox.com/s/u72bfcir24o9iyd/ab9f6ec5?dl=0\r\n\r\nReproduce:\r\n    pngquant ab9f6ec5 -o /dev/null -f\r\n\r\nOutput:\r\n    Aborted\r\n\r\nBT (filename was different in BT for this one):\r\n```\r\n[New LWP 11074]\r\nCore was generated by `/home/jodicun/opt/pngquant/pngquant ../fuzzer1422851548/crashes/id:000000,sig:1'.\r\nProgram terminated with signal SIGSEGV, Segmentation fault.\r\n#0  __memcpy_sse2_unaligned () at ../sysdeps/x86_64/multiarch/memcpy-sse2-unaligned.S:35\r\n35      ../sysdeps/x86_64/multiarch/memcpy-sse2-unaligned.S: No such file or directory.\r\n#0  __memcpy_sse2_unaligned () at ../sysdeps/x86_64/multiarch/memcpy-sse2-unaligned.S:35\r\n#1  0x00000000004074b3 in memcpy (__len=0x1f2000d, __src=<optimized out>, __dest=<optimized out>) at /usr/include/x86_64-linux-gnu/bits/string3.h:51\r\n#2  read_chunk_callback (png_ptr=<optimized out>, in_chunk=0x642828) at rwpng.c:163\r\n#3  0x00007ffff7bbdf51 in ?? () from /lib/x86_64-linux-gnu/libpng12.so.0\r\n#4  0x00007ffff7bc4a01 in png_read_info () from /lib/x86_64-linux-gnu/libpng12.so.0\r\n#5  0x00000000004083ad in rwpng_read_image24_libpng (infile=0x642130, mainprog_ptr=0x7fffffffd780, verbose=<optimized out>) at rwpng.c:218\r\n#6  0x0000000000405a8c in read_image (options=0x6420b0, filename=0x7fffffffe2d5 \"../fuzzer1422851548/crashes/id:000000,sig:11,src:000000,op:havoc,rep:8\", using_stdin=<optimized out>, input_image_p=0x7fffffffd780, liq_image_p=0x7fffffffd770, keep_input_pixels=<optimized out>, verbose=0x0) at pngquant.c:797\r\n#7  0x0000000000405cde in pngquant_file (filename=filename@entry=0x7fffffffe2d5 \"../fuzzer1422851548/crashes/id:000000,sig:11,src:000000,op:havoc,rep:8\", outname=outname@entry=0x7fffffffe31f \"/dev/null\", options=options@entry=0x7fffffffde50) at pngquant.c:556\r\n#8  0x0000000000403c90 in main (argc=<optimized out>, argv=<optimized out>) at pngquant.c:506\r\n#9  0x00007ffff7509ec5 in __libc_start_main (main=0x4020e0 <main>, argc=0x5, argv=0x7fffffffe068, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe058) at libc-start.c:287\r\n#10 0x0000000000404d82 in _start ()\r\nexe = '/home/jodicun/opt/pngquant/pngquant ../fuzzer1422851548/crashes/id:000000,sig:1'\r\n```\r\n\r\nValgrind:\r\n```\r\n==20210== Use of uninitialised value of size 8\r\n==20210==    at 0x572B88F: crc32 (in /lib/x86_64-linux-gnu/libz.so.1.2.8)\r\n==20210==    by 0x4E3AD6C: ??? (in /lib/x86_64-linux-gnu/libpng12.so.0.50.0)\r\n==20210==    by 0x4E41047: ??? (in /lib/x86_64-linux-gnu/libpng12.so.0.50.0)\r\n==20210==    by 0x4E47A00: png_read_info (in /lib/x86_64-linux-gnu/libpng12.so.0.50.0)\r\n==20210==    by 0x4083AC: rwpng_read_image24_libpng (rwpng.c:218)\r\n==20210==    by 0x405A8B: read_image (pngquant.c:797)\r\n==20210==    by 0x405CDD: pngquant_file (pngquant.c:556)\r\n==20210==    by 0x403C8F: main (pngquant.c:506)\r\n```\r\n\r\nVersion tested:\r\nGit checkout cc39b47799a7ff2ef17b529f9415ff6e6b213b8f ( Dec 12 2014 ) \r\n\r\nSystem Details:\r\nAMD64\r\nDistributor ID: Ubuntu\r\nDescription: Ubuntu 14.04.1 LTS\r\nRelease: 14.04\r\nCodename: trusty\r\n\r\nFound with the fuzzer American Fuzzy Lop ( http://lcamtuf.coredump.cx/afl/ )"},"comment":{"url":"https://api.github.com/repos/pornel/pngquant/issues/comments/72580980","html_url":"https://github.com/pornel/pngquant/issues/136#issuecomment-72580980","issue_url":"https://api.github.com/repos/pornel/pngquant/issues/136","id":72580980,"user":{"login":"jodiecunningham","id":1390085,"avatar_url":"https://avatars.githubusercontent.com/u/1390085?v=3","gravatar_id":"","url":"https://api.github.com/users/jodiecunningham","html_url":"https://github.com/jodiecunningham","followers_url":"https://api.github.com/users/jodiecunningham/followers","following_url":"https://api.github.com/users/jodiecunningham/following{/other_user}","gists_url":"https://api.github.com/users/jodiecunningham/gists{/gist_id}","starred_url":"https://api.github.com/users/jodiecunningham/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jodiecunningham/subscriptions","organizations_url":"https://api.github.com/users/jodiecunningham/orgs","repos_url":"https://api.github.com/users/jodiecunningham/repos","events_url":"https://api.github.com/users/jodiecunningham/events{/privacy}","received_events_url":"https://api.github.com/users/jodiecunningham/received_events","type":"User","site_admin":false},"created_at":"2015-02-03T02:26:13Z","updated_at":"2015-02-03T02:26:13Z","body":"I dug just a little more into this. The fuzzer was running with a memory limit of 50MB. (`ulimit -Sv 50000`)\r\nWhile running this through ImageMagick ,  IM only used 5MB of RAM. But for some reason, pngquant is using 36+MB for the same image. The full valgrind has it looping over that \"==20210== Use of uninitialised value of size 8\" block over 10,000 times, after which valgrind gives up tracking it.\r\n\r\nRunning with the ulimit will crash, but running with the memory set to unlimited completes with just an error. The memory usage is still pretty curious. \r\n"}}