**VULNERABILITY DETAILS**
 
 Little-CMS third-party library is used in PDFium to support ICC profile. I have audited source code of lcms library and I have founded a vulnerability in cmsReadTag function. The attached icc profile could crash lcms when ASAN was enabled on Linux.
 
 ```
 =================================================================
==37311==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000000058 at pc 0x00000053bc7b bp 0x7ffcd1988bd0 sp 0x7ffcd1988bc8
READ of size 8 at 0x606000000058 thread T0
    #0 0x53bc7a in Type_S15Fixed16_Write /root/fuzzer/lcms2/Little-CMS/src/cmstypes.c:558:43
    #1 0x4f9769 in cmsReadRawTag /root/fuzzer/lcms2/Little-CMS/src/cmsio0.c:1873:10
    #2 0x4eae5b in ReadAllRAWTags /root/fuzzer/lcms2/Little-CMS/fuzz/fuzz.c:23:9
    #3 0x4eaf05 in main /root/fuzzer/lcms2/Little-CMS/fuzz/fuzz.c:31:4
    #4 0x7f5d4f0c082f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #5 0x41aa78 in _start (/root/fuzzer/lcms2/Little-CMS/fuzz/fuzz+0x41aa78)

0x606000000058 is located 0 bytes to the right of 56-byte region [0x606000000020,0x606000000058)
allocated by thread T0 here:
    #0 0x4bb1a3 in __interceptor_malloc /tmp/final/llvm.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:88:3
    #1 0x57fac4 in FXMEM_DefaultAlloc /root/fuzzer/lcms2/Little-CMS/src/cmserr.c:33:9
    #2 0x57fe18 in _cmsMallocZero /root/fuzzer/lcms2/Little-CMS/src/cmserr.c:97:15
    #3 0x57feb9 in _cmsCalloc /root/fuzzer/lcms2/Little-CMS/src/cmserr.c:109:12
    #4 0x53bae0 in Type_S15Fixed16_Read /root/fuzzer/lcms2/Little-CMS/src/cmstypes.c:534:40
    #5 0x4f65d3 in cmsReadTag /root/fuzzer/lcms2/Little-CMS/src/cmsio0.c:1597:25
    #6 0x4eadc5 in ReadAllTags /root/fuzzer/lcms2/Little-CMS/fuzz/fuzz.c:11:13
    #7 0x4eaefc in main /root/fuzzer/lcms2/Little-CMS/fuzz/fuzz.c:30:4
    #8 0x7f5d4f0c082f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-buffer-overflow /root/fuzzer/lcms2/Little-CMS/src/cmstypes.c:558:43 in Type_S15Fixed16_Write
Shadow bytes around the buggy address:
  0x0c0c7fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c0c7fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c0c7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c0c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c0c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c0c7fff8000: fa fa fa fa 00 00 00 00 00 00 00[fa]fa fa fa fa
  0x0c0c7fff8010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==37311==ABORTING
```

**VERSION**

Chrome Version: All

Operating System: All

Following code will trigger crash

```
#include <stdio.h>
#include <lcms2.h>

void ReadAllTags(cmsHPROFILE h) {
    cmsInt32Number i, n;
    cmsTagSignature sig;

    n = cmsGetTagCount(h);
    for (i=0; i < n; i++) {
        sig = cmsGetTagSignature(h, i);
        if (cmsReadTag(h, sig) == NULL) return;
    }
}

// Read all tags on a profile given by its handle
void ReadAllRAWTags(cmsHPROFILE h) {
    cmsInt32Number i, n;
    cmsTagSignature sig;

    n = cmsGetTagCount(h);
    for (i=0; i < n; i++) {
        sig = cmsGetTagSignature(h, i);
        cmsReadRawTag(h, sig, NULL, 0);
    }
}

int main(int argc, char* argv[]) {
   cmsHPROFILE h = cmsOpenProfileFromFile(argv[1], "rb");
   if (h == NULL) return 1;
   ReadAllTags(h);
   ReadAllRAWTags(h);
   cmsCloseProfile(h);
   return 0;
}
```
 
 
**ANALYSIS**

There are many tag types which are supported in lcms: https://cs.chromium.org/chromium/src/third_party/pdfium/third_party/lcms/src/cmstypes.c?type=cs&l=5418


```
// This is the list of built-in tags
static _cmsTagLinkedList SupportedTags[] = {
   //  .....
    { cmsSigChromaticAdaptationTag, { 9, 1, { cmsSigS15Fixed16ArrayType }, NULL}, &SupportedTags[15]},
   //  .....
};
```

Each type has `ElemCount`: https://cs.chromium.org/chromium/src/third_party/pdfium/third_party/lcms/include/lcms2_plugin.h?type=cs&g=0&l=425

```
// This is the tag plugin, which identifies tags. For writing, a pointer to function is provided.
// This function should return the desired type for this tag, given the version of profile
// and the data being serialized.
typedef struct {

    cmsUInt32Number     ElemCount;          // If this tag needs an array, how many elements should keep

    // For reading.
    cmsUInt32Number     nSupportedTypes;    // In how many types this tag can come (MAX_TYPES_IN_LCMS_PLUGIN maximum)
    cmsTagTypeSignature SupportedTypes[MAX_TYPES_IN_LCMS_PLUGIN];

    // For writting
    cmsTagTypeSignature (* DecideType)(cmsFloat64Number ICCVersion, const void *Data);

} cmsTagDescriptor;
```

Let's see cmsReadTag: https://cs.chromium.org/chromium/src/third_party/pdfium/third_party/lcms/src/cmsio0.c?l=1519

The number of elements, which is calculated from data, may be less than `ElemCount`: https://cs.chromium.org/chromium/src/third_party/pdfium/third_party/lcms/src/cmsio0.c?l=1612
```
// This is a weird error that may be a symptom of something more serious, the number of
    // stored item is actually less than the number of required elements.
    if (ElemCount < TagDescriptor ->ElemCount) {

        char String[5];

        _cmsTagSignature2String(String, sig);
        cmsSignalError(Icc ->ContextID, cmsERROR_CORRUPTION_DETECTED, "'%s' Inconsistent number of items: expected %d, got %d",
            String, TagDescriptor ->ElemCount, ElemCount);
    }
```
if ElemCount is less than TagDescriptor ->ElemCount, it is a malformed tag and it MUST be ignored.

 

Deleted: crash-cmsReadTag_min 180 bytes

crash-cmsReadTag_min 180 bytes View Download