[BUG]An allocation-size-too-big bug at src/libOpenImageIO/imagebuf.cpp:682 in openimageio

[Frank-Z7]

Description

Dear developers,

We discovered an allocation-size-too-big bug in src/libOpenImageIO/imagebuf.cpp:682 while fuzzing oiiotool.

The latest version also has this vulnerability.

Version

# ./bin/oiiotool --version
3.1.0.0dev

# ./bin/iconvert -v
iconvert: Must have both an input and output filename specified.
iconvert -- copy images with format conversions and other alterations
OpenImageIO 3.1.0.0dev http://www.openimageio.org

PoC

poc4oiio: https://github.com/Frank-Z7/z-vulnerabilitys/blob/main/poc4oiio

Reproduction

git clone https://github.com/AcademySoftwareFoundation/OpenImageIO.git openimageio
cd openimageio
mkdir build1
cd build1
CFLAGS="-g3 -fsanitize=address -O0 -fno-omit-frame-pointer" CXXFLAGS="-g3 -fsanitize=address -O0 -fno-omit-frame-pointer" LDFLAGS="-fsanitize=address" cmake .. -DCMAKE_CXX_STANDARD=17 -DOpenImageIO_BUILD_MISSING_DEPS=all
make -j20

./bin/oiiotool -i poc4oiio poc4oiio --over -o tmp10.jpg

Address Sanitizer log

=================================================================
==660267==ERROR: AddressSanitizer: requested allocation size 0x1fdfffffc04 (0x1fe00000c08 after adjustments for alignment, red zones etc.) exceeds maximum supported size of 0x10000000000 (thread T0)
    #0 0x7f387a85e357 in operator new[](unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:102
    #1 0x7f3877aa2f77 in OpenImageIO_v3_1_0::ImageBufImpl::new_pixels(unsigned long, void const*) /openimageio/src/libOpenImageIO/imagebuf.cpp:682
    #2 0x7f3877aa5273 in OpenImageIO_v3_1_0::ImageBufImpl::realloc() /openimageio/src/libOpenImageIO/imagebuf.cpp:998
    #3 0x7f3877aa5cd8 in OpenImageIO_v3_1_0::ImageBufImpl::alloc(OpenImageIO_v3_1_0::ImageSpec const&, OpenImageIO_v3_1_0::ImageSpec const*) /openimageio/src/libOpenImageIO/imagebuf.cpp:1039
    #4 0x7f3877aa6aee in OpenImageIO_v3_1_0::ImageBufImpl::reset(OpenImageIO_v3_1_0::basic_string_view<char, std::char_traits<char> >, OpenImageIO_v3_1_0::ImageSpec const&, OpenImageIO_v3_1_0::ImageSpec const*, OpenImageIO_v3_1_0::span<std::byte, 18446744073709551615ul>, void const*, bool, long, long, long) /openimageio/src/libOpenImageIO/imagebuf.cpp:944
    #5 0x7f3877ac09f0 in OpenImageIO_v3_1_0::ImageBuf::reset(OpenImageIO_v3_1_0::ImageSpec const&, OpenImageIO_v3_1_0::InitializePixels) /openimageio/src/libOpenImageIO/imagebuf.cpp:956
    #6 0x7f38770f3be3 in OpenImageIO_v3_1_0::ImageBufAlgo::IBAprep(OpenImageIO_v3_1_0::ROI&, OpenImageIO_v3_1_0::ImageBuf*, OpenImageIO_v3_1_0::ImageBuf const*, OpenImageIO_v3_1_0::ImageBuf const*, OpenImageIO_v3_1_0::ImageBuf const*, OpenImageIO_v3_1_0::ImageSpec*, int) /openimageio/src/libOpenImageIO/imagebufalgo.cpp:258
    #7 0x7f387732a900 in OpenImageIO_v3_1_0::ImageBufAlgo::IBAprep(OpenImageIO_v3_1_0::ROI&, OpenImageIO_v3_1_0::ImageBuf*, OpenImageIO_v3_1_0::ImageBuf const*, OpenImageIO_v3_1_0::ImageBuf const*, OpenImageIO_v3_1_0::ImageSpec*, int) /openimageio/src/include/OpenImageIO/imagebufalgo_util.h:216
    #8 0x7f387732a900 in OpenImageIO_v3_1_0::ImageBufAlgo::over(OpenImageIO_v3_1_0::ImageBuf&, OpenImageIO_v3_1_0::ImageBuf const&, OpenImageIO_v3_1_0::ImageBuf const&, OpenImageIO_v3_1_0::ROI, int) /openimageio/src/libOpenImageIO/imagebufalgo_pixelmath.cpp:1754
    #9 0x55917b196247 in operator() /openimageio/src/oiiotool/oiiotool.cpp:4779
    #10 0x55917b196247 in __invoke_impl<bool, action_over(OpenImageIO_v3_1_0::OiioTool::Oiiotool&, OpenImageIO_v3_1_0::cspan<char const*>)::<lambda(OpenImageIO_v3_1_0::OiioTool::OiiotoolOp&, OpenImageIO_v3_1_0::span<OpenImageIO_v3_1_0::ImageBuf*>)>&, OpenImageIO_v3_1_0::OiioTool::OiiotoolOp&, OpenImageIO_v3_1_0::span<OpenImageIO_v3_1_0::ImageBuf*, 18446744073709551615> > /usr/include/c++/11/bits/invoke.h:61
    #11 0x55917b196247 in __invoke_r<bool, action_over(OpenImageIO_v3_1_0::OiioTool::Oiiotool&, OpenImageIO_v3_1_0::cspan<char const*>)::<lambda(OpenImageIO_v3_1_0::OiioTool::OiiotoolOp&, OpenImageIO_v3_1_0::span<OpenImageIO_v3_1_0::ImageBuf*>)>&, OpenImageIO_v3_1_0::OiioTool::OiiotoolOp&, OpenImageIO_v3_1_0::span<OpenImageIO_v3_1_0::ImageBuf*, 18446744073709551615> > /usr/include/c++/11/bits/invoke.h:114
    #12 0x55917b196247 in _M_invoke /usr/include/c++/11/bits/std_function.h:290
    #13 0x55917b2c5bc4 in std::function<bool (OpenImageIO_v3_1_0::OiioTool::OiiotoolOp&, OpenImageIO_v3_1_0::span<OpenImageIO_v3_1_0::ImageBuf*, 18446744073709551615ul>)>::operator()(OpenImageIO_v3_1_0::OiioTool::OiiotoolOp&, OpenImageIO_v3_1_0::span<OpenImageIO_v3_1_0::ImageBuf*, 18446744073709551615ul>) const /usr/include/c++/11/bits/std_function.h:590
    #14 0x55917b2c5bc4 in OpenImageIO_v3_1_0::OiioTool::OiiotoolOp::impl(OpenImageIO_v3_1_0::span<OpenImageIO_v3_1_0::ImageBuf*, 18446744073709551615ul>) /openimageio/src/oiiotool/oiiotool.h:933
    #15 0x55917b2c5bc4 in OpenImageIO_v3_1_0::OiioTool::OiiotoolOp::traverse_subimages(int) /openimageio/src/oiiotool/oiiotool.h:900
    #16 0x55917b2c5bc4 in OpenImageIO_v3_1_0::OiioTool::OiiotoolOp::operator()() /openimageio/src/oiiotool/oiiotool.h:865
    #17 0x55917b2e556e in action_over /openimageio/src/oiiotool/oiiotool.cpp:4779
    #18 0x55917b342f93 in std::function<void (OpenImageIO_v3_1_0::span<char const* const, 18446744073709551615ul>)>::operator()(OpenImageIO_v3_1_0::span<char const* const, 18446744073709551615ul>) const /usr/include/c++/11/bits/std_function.h:590
    #19 0x55917b342f93 in OpenImageIO_v3_1_0::ArgParse::Arg::action(std::function<void (OpenImageIO_v3_1_0::span<char const* const, 18446744073709551615ul>)>&&)::{lambda(OpenImageIO_v3_1_0::ArgParse::Arg&, OpenImageIO_v3_1_0::span<char const* const, 18446744073709551615ul>)#1}::operator()(OpenImageIO_v3_1_0::ArgParse::Arg&, OpenImageIO_v3_1_0::span<char const* const, 18446744073709551615ul>) const /openimageio/src/include/OpenImageIO/argparse.h:536
    #20 0x55917b342f93 in void std::__invoke_impl<void, OpenImageIO_v3_1_0::ArgParse::Arg::action(std::function<void (OpenImageIO_v3_1_0::span<char const* const, 18446744073709551615ul>)>&&)::{lambda(OpenImageIO_v3_1_0::ArgParse::Arg&, OpenImageIO_v3_1_0::span<char const* const, 18446744073709551615ul>)#1}&, OpenImageIO_v3_1_0::ArgParse::Arg&, OpenImageIO_v3_1_0::span<char const* const, 18446744073709551615ul> >(std::__invoke_other, OpenImageIO_v3_1_0::ArgParse::Arg::action(std::function<void (OpenImageIO_v3_1_0::span<char const* const, 18446744073709551615ul>)>&&)::{lambda(OpenImageIO_v3_1_0::ArgParse::Arg&, OpenImageIO_v3_1_0::span<char const* const, 18446744073709551615ul>)#1}&, OpenImageIO_v3_1_0::ArgParse::Arg&, OpenImageIO_v3_1_0::span<char const* const, 18446744073709551615ul>&&) /usr/include/c++/11/bits/invoke.h:61
    #21 0x55917b342f93 in std::enable_if<is_invocable_r_v<void, OpenImageIO_v3_1_0::ArgParse::Arg::action(std::function<void (OpenImageIO_v3_1_0::span<char const* const, 18446744073709551615ul>)>&&)::{lambda(OpenImageIO_v3_1_0::ArgParse::Arg&, OpenImageIO_v3_1_0::span<char const* const, 18446744073709551615ul>)#1}&, OpenImageIO_v3_1_0::ArgParse::Arg&, OpenImageIO_v3_1_0::span<char const* const, 18446744073709551615ul> >, void>::type std::__invoke_r<void, OpenImageIO_v3_1_0::ArgParse::Arg::action(std::function<void (OpenImageIO_v3_1_0::span<char const* const, 18446744073709551615ul>)>&&)::{lambda(OpenImageIO_v3_1_0::ArgParse::Arg&, OpenImageIO_v3_1_0::span<char const* const, 18446744073709551615ul>)#1}&, OpenImageIO_v3_1_0::ArgParse::Arg&, OpenImageIO_v3_1_0::span<char const* const, 18446744073709551615ul> >(OpenImageIO_v3_1_0::ArgParse::Arg::action(std::function<void (OpenImageIO_v3_1_0::span<char const* const, 18446744073709551615ul>)>&&)::{lambda(OpenImageIO_v3_1_0::ArgParse::Arg&, OpenImageIO_v3_1_0::span<char const* const, 18446744073709551615ul>)#1}&, OpenImageIO_v3_1_0::ArgParse::Arg&, OpenImageIO_v3_1_0::span<char const* const, 18446744073709551615ul>&&) /usr/include/c++/11/bits/invoke.h:111
    #22 0x55917b342f93 in std::_Function_handler<void (OpenImageIO_v3_1_0::ArgParse::Arg&, OpenImageIO_v3_1_0::span<char const* const, 18446744073709551615ul>), OpenImageIO_v3_1_0::ArgParse::Arg::action(std::function<void (OpenImageIO_v3_1_0::span<char const* const, 18446744073709551615ul>)>&&)::{lambda(OpenImageIO_v3_1_0::ArgParse::Arg&, OpenImageIO_v3_1_0::span<char const* const, 18446744073709551615ul>)#1}>::_M_invoke(std::_Any_data const&, OpenImageIO_v3_1_0::ArgParse::Arg&, OpenImageIO_v3_1_0::span<char const* const, 18446744073709551615ul>&&) /usr/include/c++/11/bits/std_function.h:290
    #23 0x7f387677aabc in std::function<void (OpenImageIO_v3_1_0::ArgParse::Arg&, OpenImageIO_v3_1_0::span<char const* const, 18446744073709551615ul>)>::operator()(OpenImageIO_v3_1_0::ArgParse::Arg&, OpenImageIO_v3_1_0::span<char const* const, 18446744073709551615ul>) const /usr/include/c++/11/bits/std_function.h:590
    #24 0x7f387677aabc in OpenImageIO_v3_1_0::ArgParse::Impl::parse_args(int, char const**) /openimageio/src/libutil/argparse.cpp:514
    #25 0x7f387677e2db in OpenImageIO_v3_1_0::ArgParse::parse_args(int, char const**) /openimageio/src/libutil/argparse.cpp:429
    #26 0x55917b33401b in OpenImageIO_v3_1_0::OiioTool::Oiiotool::getargs(int, char**) /openimageio/src/oiiotool/oiiotool.cpp:6979
    #27 0x55917b0b95a1 in main /openimageio/src/oiiotool/oiiotool.cpp:7338
    #28 0x7f38761ddd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

==660267==HINT: if you don't care about these errors you may set allocator_may_return_null=1
SUMMARY: AddressSanitizer: allocation-size-too-big ../../../../src/libsanitizer/asan/asan_new_delete.cpp:102 in operator new[](unsigned long)
==660267==ABORTING

Environment

ubuntu:22.04
gcc version 11.4.0 (Ubuntu 11.4.0-1ubuntu1~22.04)
clang version 14.0.0-1ubuntu1.1
afl-fuzz++4.22a

Thanks for your time!