## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-FYSAC-CVE-2019-20326
# CVE-2019-20326
GNOME gThumb 和 Linux Mint Pix 使用 `cairo_io` 模块通过 Cairo 图形库显示多种图像格式。在 gThumb 版本 < 3.8.3 和 Pix 版本 < 2.4.5 中，`cairo_io` 容易受到堆缓冲区溢出的影响，通过一个宽度或高度大于 32767 像素的 JPEG 图像。该漏洞存在于函数 `_cairo_image_surface_create_from_jpeg()` 中，位于 `extensions/cairo_io/cairo-image-surface-jpeg.c`。
`cairo_io` 支持的最大 JPEG 尺寸为 32767 x 32767 (`CAIRO_MAX_IMAGE_SIZE`)。1 在分配 Cairo surface 时，对于宽度和高度，`_cairo_image_surface_create_from_jpeg()` 会取 `CAIRO_MAX_IMAGE_SIZE` 与文件中 SOF0 段指定长度的较小值。例如，如果一个 JPEG 文件声称尺寸为 40000 x 30000，`cairo_io` 将分配一个只对 32767 x 30000 像素有效的 `cairo_surface_t` 对象。
在下面的代码片段中，`srcinfo.output_width` 和 `srcinfo.output_height` 是原始图像尺寸，而 `destination_width` 和 `destination_height` 是裁剪后的尺寸。后者被传递给 `_cairo_image_surface_create()` 用于 surface 创建。2
root@kitploit:~
_cairo_image_surface_transform_get_steps (CAIRO_FORMAT_ARGB32,
MIN (srcinfo.output_width, CAIRO_MAX_IMAGE_SIZE),
MIN (srcinfo.output_height, CAIRO_MAX_IMAGE_SIZE),
orientation,
&destination_width,
&destination_height,
&line_start,
&line_step,
&pixel_step);
// ...
surface = _cairo_image_surface_create (CAIRO_FORMAT_ARGB32, destination_width, destination_height);
然而，在向分配的 surface 写入像素数据时，`_cairo_image_surface_create_from_jpeg()` 迭代的是 JPEG 指定的原始尺寸 `srcinfo.output_width` 和 `srcinfo.output_height`，而不是适当的 `destination_width` 和 `destination_height`。下面的嵌套循环结构出现在 `cairo-image-surface-jpeg.c` 的五个位置，每个位置处理一种不同的颜色空间。3 4 5 6 7
root@kitploit:~
while (srcinfo.output_scanline < srcinfo.output_height) {
// ...
for (x = 0; x < srcinfo.output_width; x++) {
// ...
memcpy (p_surface, &pixel, sizeof (guint32));
由于原始 JPEG 尺寸可能大于为 surface 分配的内存区域，这种不一致性可能导致攻击者控制的像素数据被写入 `cairo_surface_t` 结构的 `data` 缓冲区边界之外。
## 漏洞验证
请参阅最小化测试用例 `poc.min.jpg`。该文件大小为 107 字节，指定尺寸为 1 x 33000。
## AddressSanitizer 输出（gThumb 3.8.2）
root@kitploit:~
$ gthumb ./poc.min.jpg
=================================================================
==20729==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f49fdc587fc at pc 0x7f4a12200534 bp 0x7f49fe46e240 sp 0x7f49fe46e230
WRITE of size 4 at 0x7f49fdc587fc thread T5 (pool-gthumb)
#0 0x7f4a12200533 in _cairo_image_surface_create_from_jpeg ../extensions/cairo_io/cairo-image-surface-jpeg.c:372
#1 0x55b8e24aad9b in load_image_thread ../gthumb/gth-image-loader.c:241
#2 0x7f4a1a1a5d21 (/lib/x86_64-linux-gnu/libgio-2.0.so.0+0xb2d21)
#3 0x7f4a1a34f853 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x7b853)
#4 0x7f4a1a34f110 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x7b110)
#5 0x7f4a19668668 in start_thread /build/glibc-4WA41p/glibc-2.30/nptl/pthread_create.c:479
#6 0x7f4a19590322 in clone (/lib/x86_64-linux-gnu/libc.so.6+0x122322)
0x7f49fdc587fc is located 0 bytes to the right of 131068-byte region [0x7f49fdc38800,0x7f49fdc587fc)
allocated by thread T5 (pool-gthumb) here:
#0 0x7f4a1a658ce6 in calloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dce6)
#1 0x7f4a18aba5a1 (/lib/x86_64-linux-gnu/libpixman-1.so.0+0x1a5a1)
Thread T5 (pool-gthumb) created by T0 here:
#0 0x7f4a1a585805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
#1 0x7f4a1a371a16 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x9da16)
SUMMARY: AddressSanitizer: heap-buffer-overflow ../extensions/cairo_io/cairo-image-surface-jpeg.c:372 in _cairo_image_surface_create_from_jpeg
Shadow bytes around the buggy address:
0x0fe9bfb830a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0fe9bfb830b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0fe9bfb830c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0fe9bfb830d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0fe9bfb830e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0fe9bfb830f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00[04]
0x0fe9bfb83100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0fe9bfb83110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0fe9bfb83120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0fe9bfb83130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0fe9bfb83140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==20729==ABORTING
## 参考链接
1 https://github.com/GNOME/gthumb/blob/0c0f0300d54d050ca87d23de4c734c24f37e8958/gthumb/cairo-utils.h#L32
2 https://github.com/GNOME/gthumb/blob/0c0f0300d54d050ca87d23de4c734c24f37e8958/extensions/cairo_io/cairo-image-surface-jpeg.c#L266
3 https://github.com/GNOME/gthumb/blob/0c0f0300d54d050ca87d23de4c734c24f37e8958/extensions/cairo_io/cairo-image-surface-jpeg.c#L307
4 https://github.com/GNOME/gthumb/blob/0c0f0300d54d050ca87d23de4c734c24f37e8958/extensions/cairo_io/cairo-image-surface-jpeg.c#L355
5 https://github.com/GNOME/gthumb/blob/0c0f0300d54d050ca87d23de4c734c24f37e8958/extensions/cairo_io/cairo-image-surface-jpeg.c#L387
6 https://github.com/GNOME/gthumb/blob/0c0f0300d54d050ca87d23de4c734c24f37e8958/extensions/cairo_io/cairo-image-surface-jpeg.c#L434
7 https://github.com/GNOME/gthumb/blob/0c0f0300d54d050ca87d23de4c734c24f37e8958/extensions/cairo_io/cairo-image-surface-jpeg.c#L489