HBO in CIccTagTextDescription::Release() at IccTagBasic.cpp:2350

[xsscx]

Maintainer Repro

2026-02-23 00:32:09 UTC

• 8cfeaec (HEAD -> master, origin/master, origin/HEAD) Add: Dockerfiles & Workflows (Add: Dockerfiles for Packages #597)

Host

Linux 6.6.87.2-microsoft-standard-WSL2

Step 1. wget https://github.com/xsscx/fuzz/raw/refs/heads/master/xml/icc/hbo-CIccTagTextDescription-Release-IccTagBasic_cpp-Line2350.xml

Step 2. iccFromXml hbo-CIccTagTextDescription-Release-IccTagBasic_cpp-Line2350.xml foo.bar

PoC Expected Output

=================================================================
==29788==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5020000006f1 at pc 0x588239acde0f bp 0x7fffc838ab10 sp 0x7fffc838a2d8
READ of size 2 at 0x5020000006f1 thread T0
    #0 0x588239acde0e in strlen (/home/h02332/po/research/iccdev/Build/Tools/IccFromXml/iccFromXml+0x46e0e) (BuildId: 089583e6cd7dc1e38a79b07fffa4f56fffa7d482)
    #1 0x709f15094b9a in CIccTagTextDescription::Release() /home/h02332/po/research/iccdev/IccProfLib/IccTagBasic.cpp:2350:42
    #2 0x709f15a47b56 in CIccTagXmlTextDescription::ParseXml(_xmlNode*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) /home/h02332/po/research/iccdev/IccXML/IccLibXML/IccTagXml.cpp:519:5
    #3 0x709f15a29b89 in CIccProfileXml::ParseTag(_xmlNode*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) /home/h02332/po/research/iccdev/IccXML/IccLibXML/IccProfileXml.cpp:697:33
    #4 0x709f15a2f877 in CIccProfileXml::ParseXml(_xmlNode*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) /home/h02332/po/research/iccdev/IccXML/IccLibXML/IccProfileXml.cpp:862:12
    #5 0x709f15a2feac in CIccProfileXml::LoadXml(char const*, char const*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*) /home/h02332/po/research/iccdev/IccXML/IccLibXML/IccProfileXml.cpp:919:13
    #6 0x588239b92f6e in main /home/h02332/po/research/iccdev/IccXML/CmdLine/IccFromXml/IccFromXml.cpp:69:18
    #7 0x709f13e2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #8 0x709f13e2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #9 0x588239ab6584 in _start (/home/h02332/po/research/iccdev/Build/Tools/IccFromXml/iccFromXml+0x2f584) (BuildId: 089583e6cd7dc1e38a79b07fffa4f56fffa7d482)

0x5020000006f1 is located 0 bytes after 1-byte region [0x5020000006f0,0x5020000006f1)
allocated by thread T0 here:
    #0 0x588239b513d3 in malloc (/home/h02332/po/research/iccdev/Build/Tools/IccFromXml/iccFromXml+0xca3d3) (BuildId: 089583e6cd7dc1e38a79b07fffa4f56fffa7d482)
    #1 0x709f1508d7d5 in CIccTagTextDescription::CIccTagTextDescription() /home/h02332/po/research/iccdev/IccProfLib/IccTagBasic.cpp:1943:23
    #2 0x709f15b098b8 in CIccTagXmlTextDescription::CIccTagXmlTextDescription() /home/h02332/po/research/iccdev/IccXML/IccLibXML/IccTagXml.h:185:33
    #3 0x709f15b06b5f in CIccTagXmlFactory::CreateTag(icTagTypeSignature) /home/h02332/po/research/iccdev/IccXML/IccLibXML/IccTagXmlFactory.cpp:149:16
    #4 0x709f15209ea1 in CIccTagCreator::DoCreateTag(icTagTypeSignature) /home/h02332/po/research/iccdev/IccProfLib/IccTagFactory.cpp:556:16
    #5 0x709f15143cbb in CIccTagCreator::CreateTag(icTagTypeSignature) /home/h02332/po/research/iccdev/IccProfLib/IccTagFactory.h:276:47
    #6 0x709f1507451f in CIccTag::Create(icTagTypeSignature) /home/h02332/po/research/iccdev/IccProfLib/IccTagBasic.cpp:145:10
    #7 0x709f15a29445 in CIccProfileXml::ParseTag(_xmlNode*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) /home/h02332/po/research/iccdev/IccXML/IccLibXML/IccProfileXml.cpp:685:14
    #8 0x709f15a2f877 in CIccProfileXml::ParseXml(_xmlNode*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) /home/h02332/po/research/iccdev/IccXML/IccLibXML/IccProfileXml.cpp:862:12
    #9 0x709f15a2feac in CIccProfileXml::LoadXml(char const*, char const*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*) /home/h02332/po/research/iccdev/IccXML/IccLibXML/IccProfileXml.cpp:919:13
    #10 0x588239b92f6e in main /home/h02332/po/research/iccdev/IccXML/CmdLine/IccFromXml/IccFromXml.cpp:69:18
    #11 0x709f13e2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #12 0x709f13e2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #13 0x588239ab6584 in _start (/home/h02332/po/research/iccdev/Build/Tools/IccFromXml/iccFromXml+0x2f584) (BuildId: 089583e6cd7dc1e38a79b07fffa4f56fffa7d482)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/h02332/po/research/iccdev/Build/Tools/IccFromXml/iccFromXml+0x46e0e) (BuildId: 089583e6cd7dc1e38a79b07fffa4f56fffa7d482) in strlen
Shadow bytes around the buggy address:
  0x502000000400: fa fa 00 00 fa fa 00 07 fa fa 00 07 fa fa 00 07
  0x502000000480: fa fa 00 01 fa fa 06 fa fa fa 07 fa fa fa 00 00
  0x502000000500: fa fa 00 00 fa fa 00 00 fa fa 07 fa fa fa 00 00
  0x502000000580: fa fa 00 00 fa fa 00 00 fa fa 07 fa fa fa 00 06
  0x502000000600: fa fa 00 00 fa fa 07 fa fa fa 00 00 fa fa 00 00
=>0x502000000680: fa fa 00 00 fa fa 05 fa fa fa 05 fa fa fa[01]fa
  0x502000000700: fa fa 02 fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000000780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000000800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000000880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000000900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==29788==ABORTING

[ChrisCoxArt]

Probably another unterminated string read in.
Nope, just a one byte string hit an edge case, and the NULL termination wasn't accounted for in the allocation.
Strlen read one byte over the end -- which leads to an access violation.