Merge pull request #3 from Gh05t-1337/main

Team Blue Omega, libpng

Author: zardus

what-is-a-bug/libpng-cve-2017-12652/challenge/.dockerignore

@@ -0,0 +1 @@
+Dockerfile

what-is-a-bug/libpng-cve-2017-12652/challenge/DESCRIPTION.md

@@ -0,0 +1 @@
+CVE-2017-12652 in [libpng](https://github.com/pnggroup/libpng) version <=1.6.32beta06.

what-is-a-bug/libpng-cve-2017-12652/challenge/Dockerfile

@@ -0,0 +1,26 @@
+FROM ubuntu:24.04
+RUN apt-get update && apt-get install -y cmake build-essential python3-pwntools git
+ADD --chown=0:0 --chmod=6755 http://github.com/pwncollege/exec-suid/releases/latest/download/exec-suid /usr/bin/exec-suid
+COPY challenge.c crash_to_flag.c /challenge/
+RUN <<END
+    set -e
+    mkdir -p /challenge/bin
+    cd /challenge
+
+    git clone https://github.com/pnggroup/libpng
+    git config --global user.email "you@example.com"
+    git config --global user.name "Your Name"
+    git -C libpng checkout 2b37d46564b48efa0298f57134c6a555c223ee44
+    git -C libpng revert 2b37d46564b48efa0298f57134c6a555c223ee44
+    git -C libpng diff 347538e 2b37d465 > /challenge/patch.diff
+
+    mkdir /challenge/libpng/build
+    cd /challenge/libpng/build
+    cmake -DCMAKE_INSTALL_PREFIX=/challenge -DCMAKE_BUILD_TYPE=Release ../
+    make
+    make install
+    git -C /challenge/libpng clean -fxxd
+
+    gcc -I/challenge/include /challenge/*.c /challenge/lib/libpng.a -lz -lm -o /challenge/bin/challenge
+    chmod 6755 /challenge/bin/challenge
+END

what-is-a-bug/libpng-cve-2017-12652/challenge/challenge.c

@@ -0,0 +1,111 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <dlfcn.h>  // <--- needed for dlsym and RTLD_NEXT
+#include <png.h>
+#include <setjmp.h>
+
+#ifndef RTLD_NEXT
+#define RTLD_NEXT ((void *) -1l)
+#endif
+
+#define MAX_MALLOC_SIZE 0x7fffffff
+#define MAX_PNG_SIZE 0x10000        // Maximum allowed PNG size in bytes
+
+void* malloc(size_t size) {
+    static void* (*real_malloc)(size_t) = NULL;
+    if (!real_malloc) {
+        real_malloc = (void* (*)(size_t))dlsym(RTLD_NEXT, "malloc");
+    }
+
+    if (size > MAX_MALLOC_SIZE) {
+        printf("Wow! that's a big malloc you've got there! can't handle that.\n");
+        // Force a segfault
+        *(volatile int*)0 = 0;
+    }
+
+    return real_malloc(size);
+}
+
+// Warning handler: prints the message and stops processing
+void png_warning_handler(png_structp png_ptr, png_const_charp msg) {
+    fprintf(stderr, "libpng warning: %s\n", msg);
+    longjmp(png_jmpbuf(png_ptr), 1); // jump back to main
+}
+
+int main(int argc, char *argv[]) {
+    if (argc != 2) {
+        fprintf(stderr, "Usage: %s <input.png>\n", argv[0]);
+        return EXIT_FAILURE;
+    }
+
+    const char *filename = argv[1];
+    FILE *fp = fopen(filename, "rb");
+    if (!fp) {
+        perror("fopen");
+        return EXIT_FAILURE;
+    }
+
+    // check if file is small enough
+    fseek(fp, 0, SEEK_END);
+    long filesize = ftell(fp);
+    fseek(fp, 0, SEEK_SET);
+
+    if (filesize > MAX_PNG_SIZE) {
+        fprintf(stderr, "Error: PNG file is too large (%ld bytes). Maximum allowed is %d bytes.\n",
+                filesize, MAX_PNG_SIZE);
+        fclose(fp);
+        return EXIT_FAILURE;
+    }
+
+    png_structp png_ptr = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, NULL, NULL);
+    if (!png_ptr) {
+        fprintf(stderr, "png_create_read_struct failed\n");
+        fclose(fp);
+        return EXIT_FAILURE;
+    }
+
+    png_infop info_ptr = png_create_info_struct(png_ptr);
+    if (!info_ptr) {
+        fprintf(stderr, "png_create_info_struct failed\n");
+        png_destroy_read_struct(&png_ptr, NULL, NULL);
+        fclose(fp);
+        return EXIT_FAILURE;
+    }
+
+    // Set custom warning handler; leave error handler NULL to keep default
+    png_set_error_fn(png_ptr, NULL, NULL, png_warning_handler);
+
+    // Setup setjmp to catch warnings and errors
+    if (setjmp(png_jmpbuf(png_ptr))) {
+        fprintf(stderr, "Stopped due to a warning/error.\n");
+        png_destroy_read_struct(&png_ptr, &info_ptr, NULL);
+        fclose(fp);
+        return EXIT_FAILURE;
+    }
+
+    // Initialize libpng IO and read header
+    png_init_io(png_ptr, fp);
+    png_read_info(png_ptr, info_ptr);
+
+    // Extract PNG info
+    png_uint_32 width, height;
+    int bit_depth, color_type, interlace_type, compression_type, filter_method;
+
+    png_get_IHDR(png_ptr, info_ptr,
+                 &width, &height,
+                 &bit_depth, &color_type,
+                 &interlace_type, &compression_type, &filter_method);
+
+    printf("Image width: %u\n", width);
+    printf("Image height: %u\n", height);
+    printf("Bit depth: %d\n", bit_depth);
+    printf("Color type: %d\n", color_type);
+
+    // Cleanup
+    png_destroy_read_struct(&png_ptr, &info_ptr, NULL);
+    fclose(fp);
+
+    return EXIT_SUCCESS;
+}
+

what-is-a-bug/libpng-cve-2017-12652/challenge/crash_to_flag.c.j2

@@ -0,0 +1 @@
+{% extends "base_templates/crash_to_flag.c" %}

what-is-a-bug/libpng-cve-2017-12652/tests_private/cve-2017-12652-test.png

@@ -0,0 +1,4 @@
+#!/bin/sh -e
+
+/challenge/bin/challenge /challenge/libpng/tests/badadler.png
+