HBO in CIccTagTextDescription::Release() at IccTagBasic.cpp:2350

[xsscx]

Maintainer Repro

2026-02-23 14:38:57 UTC

8cfeaec (HEAD -> master, origin/master, origin/HEAD) Add: Dockerfiles & Workflows (Add: Dockerfiles for Packages #597)

Step 1. wget https://github.com/xsscx/fuzz/raw/refs/heads/master/xml/icc/hbo-CIccTagTextDescription-Release-IccTagBasic_cpp-Line2350.xml

Step 2. iccFromXml hbo-CIccTagTextDescription-Release-IccTagBasic_cpp-Line2350.xml foo.bar

PoC Expected Output

==33524==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000000651 at pc 0x5e135db9ce0f bp 0x7ffce37089f0 sp 0x7ffce37081b8
READ of size 2 at 0x502000000651 thread T0
    #0 0x5e135db9ce0e in strlen (Build/Tools/IccFromXml/iccFromXml+0x46e0e) (BuildId: 089583e6cd7dc1e38a79b07fffa4f56fffa7d482)
    #1 0x7e4db8494b9a in CIccTagTextDescription::Release() IccProfLib/IccTagBasic.cpp:2350:42
    #2 0x7e4db8e47b56 in CIccTagXmlTextDescription::ParseXml(_xmlNode*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) IccXML/IccLibXML/IccTagXml.cpp:519:5
    #3 0x7e4db8e29b89 in CIccProfileXml::ParseTag(_xmlNode*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) IccXML/IccLibXML/IccProfileXml.cpp:697:33
    #4 0x7e4db8e2f877 in CIccProfileXml::ParseXml(_xmlNode*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) IccXML/IccLibXML/IccProfileXml.cpp:862:12
    #5 0x7e4db8e2feac in CIccProfileXml::LoadXml(char const*, char const*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*) IccXML/IccLibXML/IccProfileXml.cpp:919:13
    #6 0x5e135dc61f6e in main IccXML/CmdLine/IccFromXml/IccFromXml.cpp:69:18
    #7 0x7e4db722a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #8 0x7e4db722a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #9 0x5e135db85584 in _start (Build/Tools/IccFromXml/iccFromXml+0x2f584) (BuildId: 089583e6cd7dc1e38a79b07fffa4f56fffa7d482)

0x502000000651 is located 0 bytes after 1-byte region [0x502000000650,0x502000000651)
allocated by thread T0 here:
    #0 0x5e135dc203d3 in malloc (Build/Tools/IccFromXml/iccFromXml+0xca3d3) (BuildId: 089583e6cd7dc1e38a79b07fffa4f56fffa7d482)
    #1 0x7e4db848d7d5 in CIccTagTextDescription::CIccTagTextDescription() IccProfLib/IccTagBasic.cpp:1943:23
    #2 0x7e4db8f098b8 in CIccTagXmlTextDescription::CIccTagXmlTextDescription() IccXML/IccLibXML/IccTagXml.h:185:33
    #3 0x7e4db8f06b5f in CIccTagXmlFactory::CreateTag(icTagTypeSignature) IccXML/IccLibXML/IccTagXmlFactory.cpp:149:16
    #4 0x7e4db8609ea1 in CIccTagCreator::DoCreateTag(icTagTypeSignature) IccProfLib/IccTagFactory.cpp:556:16
    #5 0x7e4db8543cbb in CIccTagCreator::CreateTag(icTagTypeSignature) IccProfLib/IccTagFactory.h:276:47
    #6 0x7e4db847451f in CIccTag::Create(icTagTypeSignature) IccProfLib/IccTagBasic.cpp:145:10
    #7 0x7e4db8e29445 in CIccProfileXml::ParseTag(_xmlNode*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) IccXML/IccLibXML/IccProfileXml.cpp:685:14
    #8 0x7e4db8e2f877 in CIccProfileXml::ParseXml(_xmlNode*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) IccXML/IccLibXML/IccProfileXml.cpp:862:12
    #9 0x7e4db8e2feac in CIccProfileXml::LoadXml(char const*, char const*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*) IccXML/IccLibXML/IccProfileXml.cpp:919:13
    #10 0x5e135dc61f6e in main IccXML/CmdLine/IccFromXml/IccFromXml.cpp:69:18
    #11 0x7e4db722a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #12 0x7e4db722a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #13 0x5e135db85584 in _start (Build/Tools/IccFromXml/iccFromXml+0x2f584) (BuildId: 089583e6cd7dc1e38a79b07fffa4f56fffa7d482)

SUMMARY: AddressSanitizer: heap-buffer-overflow (Build/Tools/IccFromXml/iccFromXml+0x46e0e) (BuildId: 089583e6cd7dc1e38a79b07fffa4f56fffa7d482) in strlen
Shadow bytes around the buggy address:
  0x502000000380: fa fa 00 07 fa fa 05 fa fa fa 02 fa fa fa 00 00
  0x502000000400: fa fa 00 06 fa fa 00 07 fa fa 00 07 fa fa 00 07
  0x502000000480: fa fa 00 01 fa fa 06 fa fa fa 07 fa fa fa 00 00
  0x502000000500: fa fa 00 fa fa fa 07 fa fa fa 00 00 fa fa 00 00
  0x502000000580: fa fa 00 00 fa fa 00 05 fa fa 00 00 fa fa 00 00
=>0x502000000600: fa fa 05 fa fa fa 05 fa fa fa[01]fa fa fa 02 fa
  0x502000000680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000000700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000000780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000000800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000000880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==33524==ABORTING

References: #609

• Note this is a different, fuzzed PoC with the same filename

[xsscx]

Maintainer Note

This Issue Opened due to a stale cache using the same build id iccFromXml+0x46e0e

The Issue Closes as a Duplicate Report now Resolved.