Sploitus

Exploit for Out-of-bounds Write in Gnome Gthumb

githubexploit Β· 2020-01-03

Exploit Code

README67 lines
## https://sploitus.com/exploit?id=DE962B3E-A9DA-5BD3-BE21-1A2363DF5D56
# CVE-2019-20326

GNOME gThumb and Linux Mint Pix use the `cairo_io` module for displaying several image formats with the Cairo graphics library. In gThumb versions 1 When allocating a Cairo surface, for both the width and height, `_cairo_image_surface_create_from_jpeg()` picks the minimum of `CAIRO_MAX_IMAGE_SIZE` and the length specified in the SOF0 segment of the file. For example, if a JPEG file claims to have a size of 40000 x 30000, `cairo_io` will allocate a `cairo_surface_t` object valid for only 32767 x 30000 pixels.

In the snippet below, `srcinfo.output_width` and `srcinfo.output_height` are the original image dimensions, while `destination_width` and `destination_height` are the capped dimensions. The latter are the ones passed to `_cairo_image_surface_create()` for surface creation.2

```c
_cairo_image_surface_transform_get_steps (CAIRO_FORMAT_ARGB32,
						  MIN (srcinfo.output_width, CAIRO_MAX_IMAGE_SIZE),
						  MIN (srcinfo.output_height, CAIRO_MAX_IMAGE_SIZE),
						  orientation,
						  &destination_width,
						  &destination_height,
						  &line_start,
						  &line_step,
						  &pixel_step);
// ...
surface = _cairo_image_surface_create (CAIRO_FORMAT_ARGB32, destination_width, destination_height);
```

However, when writing pixel data into the allocated surface, `_cairo_image_surface_create_from_jpeg()` iterates over the original dimensions specified by the JPEG, `srcinfo.output_width` and `srcinfo.output_height`, instead of the appropriate `destination_width` and `destination_height`. The nested loop structure below occurs in five locations of `cairo-image-surface-jpeg.c` that each handle a different type of color space.3 4 5 6 7

```c
while (srcinfo.output_scanline 0x0fe9bfb830f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00[04]
  0x0fe9bfb83100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fe9bfb83110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fe9bfb83120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fe9bfb83130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fe9bfb83140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==20729==ABORTING
```

## References
1 

2 

3 

4 

5 

6 

7