Segmentation fault (ASAN: memcpy-param-overlap)

[strongcourage]

Hi,

Our fuzzer found a crash due to a memory param overlap bug on the function cmft::imageTransformArg. I built cmft (the latest commit 06a3516 on master) using the configuration "release64" on Ubuntu 16.04 (64-bit).

PoC_mpo: https://github.com/strongcourage/PoCs/blob/master/cmft_06a3516/PoC_mpo

cmftRelease --input PoC_mpo --output0 /dev/null
Segmentation fault

ASAN says:

cmftRelease-asan --input PoC_mpo --output0 /dev/null
=================================================================
==32654==ERROR: AddressSanitizer: memcpy-param-overlap: memory ranges [0x7f38896b4864,0x7f38896d5878) and [0x7f38896bfc88, 0x7f38896e0c9c) overlap
    #0 0x7f38886df662 in __asan_memcpy (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x8c662)
    #1 0x42885f in memcpy /usr/include/x86_64-linux-gnu/bits/string3.h:53
    #2 0x42885f in swap ../../src/cmft/common/utils.h:132
    #3 0x42885f in cmft::imageTransformArg(cmft::Image&, __va_list_tag*) ../../src/cmft/image.cpp:2485
    #4 0x429a91 in cmft::imageTransformUseMacroInstead(cmft::Image*, ...) ../../src/cmft/image.cpp:2321
    #5 0x4340d2 in cmft::imageLoadTga(cmft::Image&, cmft::Rw*, cmft::AllocatorI*) ../../src/cmft/image.cpp:4972
    #6 0x4344b3 in cmft::imageLoad(cmft::Image&, cmft::Rw*, cmft::TextureFormat::Enum, cmft::AllocatorI*) ../../src/cmft/image.cpp:5039
    #7 0x4348a9 in cmft::imageLoad(cmft::Image&, char const*, cmft::TextureFormat::Enum, cmft::AllocatorI*) ../../src/cmft/image.cpp:5062
    #8 0x475600 in cmftMain(int, char const* const*) ../../src/cmft_cli/cmft_cli.h:895
    #9 0x7f38873df82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #10 0x403608 in _start (/home/dungnguyen/PoCs/cmft_06a3516/cmftRelease-asan+0x403608)

0x7f38896b4864 is located 675940 bytes inside of 1533184-byte region [0x7f388960f800,0x7f3889785d00)
allocated by thread T0 here:
    #0 0x7f38886eb602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
    #1 0x433f18 in cmft::imageLoadTga(cmft::Image&, cmft::Rw*, cmft::AllocatorI*) ../../src/cmft/image.cpp:4899

0x7f38896bfc88 is located 722056 bytes inside of 1533184-byte region [0x7f388960f800,0x7f3889785d00)
allocated by thread T0 here:
    #0 0x7f38886eb602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
    #1 0x433f18 in cmft::imageLoadTga(cmft::Image&, cmft::Rw*, cmft::AllocatorI*) ../../src/cmft/image.cpp:4899

SUMMARY: AddressSanitizer: memcpy-param-overlap ??:0 __asan_memcpy
==32654==ABORTING

Thanks,
Manh Dung