Package: libexempi3 Version: 2.2.1-2 Usertags: afl Exempi crashes on the attached file:
$ exempi -x crash.jpeg processing file crash.jpeg dump_xmp for file crash.jpeg Segmentation fault GDB says it's an out-of-bounds read: 0xf7f24128 in TrimTrailingSpaces (info=0xffffd33c) at ReconcileTIFF.cpp:217 217 if ( (*lastChar != ' ') && (*lastChar != 0) ) return; // Nothing to do. (gdb) print lastChar $1 = 0xed056bba <error: Cannot access memory at address 0xed056bba> (gdb) bt #0 0xf7f24128 in TrimTrailingSpaces (info=0xffffd33c) at ReconcileTIFF.cpp:217 #1 0xf7f249c1 in ImportSingleTIFF_ASCII (tagInfo=..., xmp=0x8056970, xmpNS=0xf7f4efcc "http://ns.adobe.com/tiff/1.0/";, xmpProp=0xf7f4f6f1 "Model") at ReconcileTIFF.cpp:465 #2 0xf7f25004 in ImportSingleTIFF (tagInfo=..., nativeEndian=true, xmp=0x8056970, xmpNS=0xf7f4efcc "http://ns.adobe.com/tiff/1.0/";, xmpProp=0xf7f4f6f1 "Model") at ReconcileTIFF.cpp:667 #3 0xf7f260ce in ImportTIFF_StandardMappings (ifd=0 '\000', tiff=..., xmp=0x8056970) at ReconcileTIFF.cpp:1213 #4 0xf7f27e36 in PhotoDataUtils::Import2WayExif (exif=..., xmp=0x8056970, iptcDigestState=1) at ReconcileTIFF.cpp:1823 #5 0xf7f23a24 in ImportPhotoData (exif=..., iptc=..., psir=..., iptcDigestState=1, xmp=0x8056970, options=4) at ReconcileLegacy.cpp:77 #6 0xf7ec410b in JPEG_MetaHandler::ProcessXMP (this=0x8056948) at JPEG_Handler.cpp:694 #7 0xf7eb29aa in XMPFiles::GetXMP (this=0x8056868, xmpObj=0xffffd594, xmpPacket=0xffffd580, xmpPacketLen=0xffffd584, packetInfo=0x0) at XMPFiles.cpp:1370 #8 0xf7eaee35 in WXMPFiles_GetXMP_1 (xmpObjRef=0x8056868, xmpRef=0x8056ae8, clientPacket=0x0, packetInfo=0x0, SetClientString=0xf7e6c6ca <TXMPFiles<std::string>::SetClientString(void*, char const*, unsigned int)>, wResult=0xffffd600) at WXMPFiles.cpp:238 #9 0xf7e6c2f1 in TXMPFiles<std::string>::GetXMP (this=0x8056858, xmpObj=0x8056ad8, xmpPacket=0x0, packetInfo=0x0) at ../public/include/client-glue/TXMPFiles.incl_cpp:295 #10 0xf7e65313 in xmp_files_get_new_xmp (xf=0x8056858) at exempi.cpp:322 #11 0x08049ea6 in get_xmp_from_file (filename=filename@entry=0xffffd9f5 "crash.jpeg", no_reconcile=no_reconcile@entry=false, is_an_xmp=is_an_xmp@entry=false) at main.cpp:239 #12 0x08049584 in dump_xmp (outio=<optimized out>, is_an_xmp=<optimized out>, no_reconcile=<optimized out>, filename=0xffffd9f5 "crash.jpeg") at main.cpp:251 #13 process_file (output="", prop_value="", value_name="", action=<optimized out>, dump_xml=<optimized out>, write_in_place=<optimized out>, is_an_xmp=<optimized out>, no_reconcile=<optimized out>, filename=0xffffd9f5 "crash.jpeg") at main.cpp:337 #14 main (argc=<optimized out>, argv=<optimized out>) at main.cpp:191 This bug was found using American fuzzy lop: http://lcamtuf.coredump.cx/afl/ -- System Information: Debian Release: stretch/sid APT prefers unstable APT policy: (990, 'unstable'), (500, 'experimental') Architecture: i386 (x86_64) Foreign Architectures: amd64 Kernel: Linux 3.2.0-4-amd64 (SMP w/2 CPU cores) Locale: LANG=C, LC_CTYPE=pl_PL.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: sysvinit (via /sbin/init) Versions of packages libexempi3 depends on: ii libc6 2.19-18 ii libexpat1 2.1.0-6+b3 ii libgcc1 1:5.1.1-4 ii libstdc++6 5.1.1-4 ii multiarch-support 2.19-18 ii zlib1g 1:1.2.8.dfsg-2+b1 -- Jakub Wilk
