VULNERABILITY DETAILS

There is a heap buffer overflow vulnerability in Skia.

This bug exists in the deserialisation routines for SkImageFilter, which can be triggered on the host process from a renderer through IPC.


File src/core/SkColorSpace_ICC.cpp, line 1005:
--------------------------------------------------------------------------------
    size_t allocSize = sizeof(SkGammas) + gamma_alloc_size(rType, rData)     <--- Integer Overflow (32bit builds only)
                                        + gamma_alloc_size(gType, gData)
                                        + gamma_alloc_size(bType, bData);
    void* memory = sk_malloc_throw(allocSize);
    gammas = sk_sp<SkGammas>(new (memory) SkGammas());

    uint32_t offset = 0;
    gammas->fRedType = rType;
    offset += load_gammas(memory, offset, rType, &rData, rParams,
                          r->addr(base));
--------------------------------------------------------------------------------

In my testcase, the function `gamma_alloc_size` will return 0x5555554C.

Therefore, `0x24+0x5555554C+0x5555554C+0x5555554C` will integer overflow.

`sk_malloc_throw` call will allocate a buffer too small.


File src/core/SkColorSpace_ICC.cpp, line 584:
--------------------------------------------------------------------------------
static size_t load_gammas(void* memory, size_t offset, SkGammas::Type type,
                        SkGammas::Data* data, const SkGammas::Params& params,
                        const uint8_t* src) {
    void* storage = SkTAddOffset<void>(memory, offset + sizeof(SkGammas));

    switch (type) {
        ...
        case SkGammas::Type::kTable_Type: {
            data->fTable.fOffset = offset;

            float* outTable = (float*) storage;
            const uint16_t* inTable = (const uint16_t*) (src + 12);
            for (int i = 0; i < data->fTable.fSize; i++) {
                outTable[i] = (read_big_endian_u16((const uint8_t*) &inTable[i])) / 65535.0f;  <--- out-of-bounds write with user-controlled input.
            }

            return sizeof(float) * data->fTable.fSize;
        }
--------------------------------------------------------------------------------



VERSION
Chrome Version: 32-bit build of Chrome (All)
Operating System: All



REPRODUCTION CASE
Attached as `pocgen.py`
1. Download and Run python script for generating poc(poc.fil).
2. Use 32-bit build of filter_fuzz_stub to reproduce.



FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
Attached as `asan_trace.log`, `windbg_trace.log`

(170c.20d0): Access violation - code c0000005 (!!! second chance !!!)
*** WARNING: Unable to verify checksum for c:\G\chromium\src\out\Release_x86\skia.dll
eax=0000c141 ebx=0026f000 ecx=00004b51 edx=0069a2bc esi=00000008 edi=0040109b
eip=10129712 esp=0019e498 ebp=0019e4ac iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
skia!load_gammas+0xa2:
10129712 f30f11048a      movss   dword ptr [edx+ecx*4],xmm0 ds:002b:006ad000=????????
*** WARNING: Unable to verify checksum for c:\G\chromium\src\out\Release_x86\filter_fuzz_stub.exe
0:000> u
skia!load_gammas+0xa2 [c:\g\chromium\src\third_party\skia\src\core\skcolorspace_icc.cpp @ 600]:
10129712 f30f11048a      movss   dword ptr [edx+ecx*4],xmm0
10129717 ebbe            jmp     skia!load_gammas+0x67 (101296d7)
10129719 8b4514          mov     eax,dword ptr [ebp+14h]
1012971c 8b4004          mov     eax,dword ptr [eax+4]
1012971f c1e002          shl     eax,2
10129722 eb65            jmp     skia!load_gammas+0x119 (10129789)
10129724 8b4d14          mov     ecx,dword ptr [ebp+14h]
10129727 8b550c          mov     edx,dword ptr [ebp+0Ch]
0:000> dd edx+ecx*4-31
006acfcf  4141c13f 4141c13f 4141c13f 4141c13f
006acfdf  4141c13f 4141c13f 4141c13f 4141c13f
006acfef  4141c13f 4141c13f 4141c13f 4141c13f
006acfff  ???????? ???????? ???????? ????????

 

Deleted: pocgen.py 2.6 KB

pocgen.py 2.6 KB View Download

Deleted: asan_trace.log 4.7 KB

asan_trace.log 4.7 KB View Download

Deleted: windbg_trace.log 4.3 KB

windbg_trace.log 4.3 KB View Download