root@ubuntu:/home/tim/libsixel/converters# ../../libsixel-asan/converters/img2sixel -I overflows/smile.gif-out_of_bound-idx\:0xa34-0x0
=================================================================
==57335==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f84cfa29e9c at pc 0x55fd2c49e55d bp 0x7ffe53350470 sp 0x7ffe53350460
WRITE of size 1 at 0x7f84cfa29e9c thread T0
#0 0x55fd2c49e55c in gif_init_frame /home/tim/libsixel-asan/src/fromgif.c:250
#1 0x55fd2c4a0cba in load_gif /home/tim/libsixel-asan/src/fromgif.c:644
#2 0x55fd2c49a9d0 in load_with_builtin /home/tim/libsixel-asan/src/loader.c:888
#3 0x55fd2c49b3a5 in sixel_helper_load_image_file /home/tim/libsixel-asan/src/loader.c:1392
#4 0x55fd2c44bd0c in sixel_encoder_encode /home/tim/libsixel-asan/src/encoder.c:1737
#5 0x55fd2c441e3b in main /home/tim/libsixel-asan/converters/img2sixel.c:457
#6 0x7f852961bb6a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x26b6a)
#7 0x55fd2c43f7a9 in _start (/home/tim/libsixel-asan/converters/img2sixel+0x397a9)
0x7f84cfa29e9c is located 0 bytes to the right of 58156700-byte region [0x7f84cc2b3800,0x7f84cfa29e9c)
allocated by thread T0 here:
#0 0x7f8529af4448 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10c448)
#1 0x55fd2c44204a in rpl_malloc /home/tim/libsixel-asan/converters/malloc_stub.c:45
#2 0x55fd2c44c995 in sixel_allocator_malloc /home/tim/libsixel-asan/src/allocator.c:155
#3 0x55fd2c49e1c5 in gif_init_frame /home/tim/libsixel-asan/src/fromgif.c:239
#4 0x55fd2c4a0cba in load_gif /home/tim/libsixel-asan/src/fromgif.c:644
#5 0x55fd2c49a9d0 in load_with_builtin /home/tim/libsixel-asan/src/loader.c:888
#6 0x55fd2c49b3a5 in sixel_helper_load_image_file /home/tim/libsixel-asan/src/loader.c:1392
#7 0x55fd2c44bd0c in sixel_encoder_encode /home/tim/libsixel-asan/src/encoder.c:1737
#8 0x55fd2c441e3b in main /home/tim/libsixel-asan/converters/img2sixel.c:457
#9 0x7f852961bb6a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x26b6a)
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/tim/libsixel-asan/src/fromgif.c:250 in gif_init_frame
Shadow bytes around the buggy address:
0x0ff119f3d380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ff119f3d390: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ff119f3d3a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ff119f3d3b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ff119f3d3c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0ff119f3d3d0: 00 00 00[04]fa fa fa fa fa fa fa fa fa fa fa fa
0x0ff119f3d3e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0ff119f3d3f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0ff119f3d400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0ff119f3d410: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0ff119f3d420: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==57335==ABORTING
root@ubuntu:/home/tim/libsixel/converters#
img2sixel -I $POC
smile.zip
asan output