libtheora:fuzzer-decoder: Abrt in TheoraDecoder::writeImage

Copied from https://issues.oss-fuzz.com/issues/42502170

Detailed Report: https://oss-fuzz.com/testcase?key=4993851245330432

Project: libtheora Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-decoder Job Type: libfuzzer_asan_libtheora Platform Id: linux

Crash Type: Abrt Crash Address: 0x0539000d4794 Crash State: TheoraDecoder::writeImage TheoraDecoder::decodePacket TheoraDecoder::Run

Sanitizer: address (ASAN)

Regressed: https://oss-fuzz.com/revisions?job=libfuzzer_asan_libtheora&range=202109180610:202109190606

Reproducer Testcase: https://oss-fuzz.com/download?testcase_id=4993851245330432

Issue filed automatically.

See https://google.github.io/oss-fuzz/advanced-topics/reproducing for instructions to reproduce this bug locally. When you fix this bug, please

• mention the fix revision(s).
• state whether the bug was a short-lived regression or an old bug in any stable releases.
• add any other useful information. This information can help downstream consumers.

If you need to contact the OSS-Fuzz team with a question, concern, or any other feedback, please file an issue at https://github.com/google/oss-fuzz/issues. Comments on individual Monorail issues are not monitored.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse without an upstream patch, then the bug report will automatically become visible to the public.

Minified testcase: clusterfuzz-testcase-fuzzer-decoder-4993851245330432

added security label

changed the description

To reproduce:

# clone oss-fuzz
git clone git@github.com:google/oss-fuzz.git

# build asan fuzzer in the oss-fuzz directory
oss-fuzz$ python3 infra/helper.py build_fuzzers --sanitizer address libtheora 

# reproduce (requires downloading the testcase)
python3 infra/helper.py reproduce libtheora fuzzer-decoder ~/Downloads/clusterfuzz-testcase-fuzzer-decoder-4993851245330432

To build the fuzzer using your local clone of theora, for the fuzzer build step provide the patch of your local clone as the last argument:

oss-fuzz$ python3 infra/helper.py build_fuzzers --sanitizer address libtheora ~/theora

changed the description

mentioned in merge request !30 (merged)

Now I can actually debug a bit:

(gdb) print ti
$12 = {version_major = 0 '\000', version_minor = 96 '`', version_subminor = 20 '\024', frame_width = 512, frame_height = 848, pic_width = 266, pic_height = 0, pic_x = 0, 
  pic_y = 848, fps_numerator = 16772673, fps_denominator = 3035557632, aspect_numerator = 2297865, aspect_denominator = 5384704, colorspace = TH_CS_UNSPECIFIED, 
  pixel_fmt = TH_PF_420, target_bitrate = 0, quality = 0, keyframe_granule_shift = 0}

ti->pic_height == 0 is a bit suspect.

(gdb) print ycbcrbuf 
(const th_ycbcr_buffer &) @0x7ffff6014510: {{width = 512, height = 848, stride = 544, data = 0x7ffff5aa9440 '\200' <repeats 200 times>...}, {width = 256, height = 424, 
    stride = 272, data = 0x7ffff5b1c8c0 '\200' <repeats 200 times>...}, {width = 256, height = 424, stride = 272, data = 0x7ffff5b39c40 '\200' <repeats 200 times>...}}

(gdb) print h
$13 = 848

(gdb) print i
$14 = 456

i is the row (so looping < h).

This was opened to the public Dec 20, 2021 02:37PM so there's no sense in it being confidential here.

made the issue visible to everyone

For reference, to debug this I modified oss-fuzz with:

tmatth@bellini:/big-repos/oss-fuzz$ git diff
diff --git a/infra/helper.py b/infra/helper.py
index 1d03de9e8..bb54136ae 100755
--- a/infra/helper.py
+++ b/infra/helper.py
@@ -750,7 +750,7 @@ def docker_run(run_args, print_output=True, architecture='x86_64'):
 
 def docker_build(build_args):
   """Calls `docker build`."""
-  command = ['docker', 'build']
+  command = ['docker', 'build', "--no-cache"]
   command.extend(build_args)
   logger.info('Running: %s.', _get_command_string(command))
 
diff --git a/projects/libtheora/Dockerfile b/projects/libtheora/Dockerfile
index 549d3e8eb..83de68986 100644
--- a/projects/libtheora/Dockerfile
+++ b/projects/libtheora/Dockerfile
@@ -18,6 +18,6 @@ FROM gcr.io/oss-fuzz-base/base-builder
 RUN apt-get update && apt-get install -y make autoconf automake libtool
 RUN git clone --depth 1 https://gitlab.xiph.org/xiph/ogg.git
 RUN git clone --depth 1 https://gitlab.xiph.org/xiph/theora.git libtheora
-RUN git clone --depth 1 https://github.com/tmatth/oss-fuzz-fuzzers.git
+RUN git clone --depth 1 https://github.com/tmatth/oss-fuzz-fuzzers.git --branch init-buffer --single-branch
 RUN git clone --depth 1 https://github.com/guidovranken/fuzzing-headers.git
 COPY build.sh $SRC/
diff --git a/projects/libtheora/build.sh b/projects/libtheora/build.sh
index ec38e588c..f19f4ba2e 100755
--- a/projects/libtheora/build.sh
+++ b/projects/libtheora/build.sh
@@ -17,12 +17,12 @@
 
 if [[ $CFLAGS = *sanitize=address* ]]
 then
-    export CXXFLAGS="$CXXFLAGS -DASAN"
+    export CXXFLAGS="$CXXFLAGS -DASAN -ggdb3 -O0"
 fi
 
 if [[ $CFLAGS = *sanitize=memory* ]]
 then
-    export CXXFLAGS="$CXXFLAGS -DMSAN"
+    export CXXFLAGS="$CXXFLAGS -DMSAN -ggdb3 -O0"
 fi
 
 mkdir $SRC/libogg-install/

Fixed in https://github.com/tmatth/oss-fuzz-fuzzers/commit/11034a802e9c63a4b0aa4012fd0d3a6d515a4b33

closed