Package: ufraw-batch Version: 0.22-1.1 Severity: normal Dear Maintainer,
Running ufraw-batch with the attached poc file raises a NULL dereference crash in ufraw_batch_messenger() function. Following gdb log shows the program crashing with segfault. jason@debian-amd64-stretch:~/report/source-latest/ufraw$ gdb ./ufraw-llvm/ufraw-batch -q Reading symbols from ./ufraw-llvm/ufraw-batch...done. (gdb) run --overwrite poc-null Starting program: /home/jason/report/source-latest/ufraw/ufraw-llvm/ufraw-batch --overwrite poc-null [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Program received signal SIGSEGV, Segmentation fault. strlen () at ../sysdeps/x86_64/strlen.S:106 106 ../sysdeps/x86_64/strlen.S: No such file or directory. (gdb) where #0 strlen () at ../sysdeps/x86_64/strlen.S:106 #1 0x000000000041eee9 in ufraw_batch_messenger (message=0x0) at ufraw_message.c:126 #2 0x000000000041f0b3 in ufraw_message (code=1, format=<optimized out>) at ufraw_message.c:190 #3 0x0000000000409f93 in ufraw_load_raw (uf=0x80ec60) at ufraw_ufraw.c:668 #4 0x00000000004090d4 in main (argc=<optimized out>, argv=<optimized out>) at ufraw-batch.c:85 (gdb) x/i $rip => 0x7ffff5683676 <strlen+38>: movdqu (%rax),%xmm4 (gdb) info reg rax rax 0x0 0 -- System Information: Debian Release: 9.1 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 4.9.0-3-amd64 (SMP w/1 CPU core) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages ufraw-batch depends on: ii libbz2-1.0 1.0.6-8.1 ii libc6 2.24-11+deb9u3 ii libexiv2-14 0.25-3.1 ii libgcc1 1:6.3.0-18+deb9u1 ii libglib2.0-0 2.50.3-2 ii libgomp1 6.3.0-18+deb9u1 ii libjpeg62-turbo 1:1.5.1-2 ii liblcms2-2 2.8-4 ii liblensfun1 0.3.2-3 ii libpng16-16 1.6.28-1 ii libstdc++6 6.3.0-18+deb9u1 ii libtiff5 4.0.8-2+deb9u2 ii zlib1g 1:1.2.8.dfsg-5 ufraw-batch recommends no packages. Versions of packages ufraw-batch suggests: pn ufraw <none> -- no debconf information
poc_null
Description: Binary data
