1184787 - Crash in gdk_pixbuf_scale decoding malformed bitmap

Status: RESOLVED DUPLICATE of bug 1184009

(Core :: Graphics, defect)

Description

[Al Billings [:abillings - ex-MoCo]]

Attachment: Example malformed bmp file

[e-mail] received the following email reporting a crash in gdk_pixbuf_scale while decoding a malformed bitmap:

Subject: Firefox crashes when attaching a malformed bmp image (Linux)
Date: Thu, 9 Jul 2015 17:59:12 +0200 (CEST)
From: Gustavo Grieco <[e-mail]>
To: [e-mail]

Hello!

We found that Firefox can be easily crashed just trying to attach an malformed bmp. This was tested on Firefox 38 and IceWeasel 31 in Ubuntu Trusty (x86_64) as well as Debian Wheezy (x86_64).
To test this bug, just download and uncompress it somewhere in your computer (it's just 82 bytes). Then try to open the .bmp (using Ctrl+O) or attach the image somewhere (e.g. https://www.google.com/imghp). Firefox aborts with a SIGTRAP if you try it. You can see here the backtrace:

(firefox:4211): GLib-ERROR **: /build/buildd/glib2.0-2.40.2/./glib/gmem.c:103: failed to allocate 6108401664 bytes

Program received signal SIGTRAP, Trace/breakpoint trap.
0x00007fffef387c13 in g_logv () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
(gdb) bt
#0 0x00007fffef387c13 in g_logv () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#1 0x00007fffef387d72 in g_log () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#2 0x00007fffef386644 in g_malloc () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#3 0x00007fffee09c004 in ?? () from /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0
#4 0x00007fffee09cee9 in ?? () from /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0
#5 0x00007fffee094a2d in gdk_pixbuf_scale () from /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0
#6 0x00007fffee09507a in gdk_pixbuf_scale_simple () from /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0
#7 0x00007fffee096340 in ?? () from /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0
#8 0x00007fffee091e88 in gdk_pixbuf_new_from_file_at_scale () from /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0
#9 0x00007ffff26dbfce in ?? () from /usr/lib/firefox/libxul.so
#10 0x00007fffef6503b8 in g_closure_invoke () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#11 0x00007fffef661d3d in ?? () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#12 0x00007fffef669a29 in g_signal_emit_valist () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#13 0x00007fffef66a212 in g_signal_emit_by_name () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#14 0x00007fffef6503b8 in g_closure_invoke () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#15 0x00007fffef661d3d in ?? () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#16 0x00007fffef669a29 in g_signal_emit_valist () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#17 0x00007fffef66a212 in g_signal_emit_by_name () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#18 0x00007fffef6503b8 in g_closure_invoke () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#19 0x00007fffef661d3d in ?? () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#20 0x00007fffef669a29 in g_signal_emit_valist () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#21 0x00007fffef66a212 in g_signal_emit_by_name () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#22 0x00007fffeedd20e7 in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0
#23 0x00007fffeedd53f0 in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0
#24 0x00007fffef6505e7 in ?? () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#25 0x00007fffef669088 in g_signal_emit_valist () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#26 0x00007fffef669ce2 in g_signal_emit () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#27 0x00007fffeef1d2be in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0
#28 0x00007fffeef21868 in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0
#29 0x00007fffeee29815 in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0
#30 0x00007fffef6503b8 in g_closure_invoke () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#31 0x00007fffef661afb in ?? () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#32 0x00007fffef6696f9 in g_signal_emit_valist () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#33 0x00007fffef669ce2 in g_signal_emit () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#34 0x00007fffeef39684 in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0
#35 0x00007fffeee27fc4 in gtk_propagate_event () from /usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0
#36 0x00007fffeee2837b in gtk_main_do_event () from /usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0
#37 0x00007fffee50e1ec in ?? () from /usr/lib/x86_64-linux-gnu/libgdk-x11-2.0.so.0

The bugs seems related with the lack of input validation of gdk_pixbuf_scale with a malformed bmp file. I know it is not really related with Firefox but it is clearly affected and i'm not sure it is impossible to take advantage of it somehow. Maybe this issue motivates a complete revision of the gtk functions used by libxul.so. Just to be sure, i'm reporting this issue (i never saw a reproducible Firefox crash, this is my first time!). Interestingly enough Chrome/Chromium is also affected.
This test case was found using QuickFuzz and zzuf.

Regards,
Gus.

Comment 1

[Al Billings [:abillings - ex-MoCo]]

Adding reporter to bug.