Crash when parsing malformed KCT file

[retpoline]

Hi folks,

A simple ABRT crash was found while fuzz testing of the kctreemgr binary which can be triggered via a malformed cabinet file.

crash.kct.txt

(not a txt file, but renamed the extension for github upload)

$ kctreemgr load crash.kct 
kctreemgr: [WARN]: ./kchashdb.h: 2717: reorganize_file: -: reorganizing the database
terminate called after throwing an instance of 'std::bad_alloc'
  what():  std::bad_alloc
Aborted (core dumped)

$ gdb -q `which kctreemgr`
Reading symbols from /usr/local/bin/kctreemgr...
(gdb) r load crash.kct
Starting program: /usr/local/bin/kctreemgr load crash.kct
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
/usr/local/bin/kctreemgr: [WARN]: ./kchashdb.h: 2717: reorganize_file: -: reorganizing the database
terminate called after throwing an instance of 'std::bad_alloc'
  what():  std::bad_alloc

Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50

(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007ffff797e859 in __GI_abort () at abort.c:79
#2  0x00007ffff7d53911 in ?? () from /lib/x86_64-linux-gnu/libstdc++.so.6
#3  0x00007ffff7d5f38c in ?? () from /lib/x86_64-linux-gnu/libstdc++.so.6
#4  0x00007ffff7d5f3f7 in std::terminate() () from /lib/x86_64-linux-gnu/libstdc++.so.6
#5  0x00007ffff7d5f6a9 in __cxa_throw () from /lib/x86_64-linux-gnu/libstdc++.so.6
#6  0x00007ffff7d53522 in ?? () from /lib/x86_64-linux-gnu/libstdc++.so.6
#7  0x000055555557b0b5 in kyotocabinet::HashDB::read_record_body (this=0x7fffffffdcd0, rec=0x7fffffffd600) at ./kchashdb.h:3120
#8  0x0000555555598c77 in kyotocabinet::HashDB::copy_records (dest=0x7fffffffd700, this=0x7fffffffdcd0) at ./kchashdb.h:2756
#9  kyotocabinet::HashDB::reorganize_file (this=0x7fffffffdcd0, path="crash.kct") at ./kchashdb.h:2720
#10 0x00005555555998f1 in kyotocabinet::HashDB::open (this=0x7fffffffdcd0, path="crash.kct", mode=6) at ./kchashdb.h:871
#11 0x000055555559ec4e in kyotocabinet::PlantDB<kyotocabinet::HashDB, (unsigned char)49>::open (this=0x7fffffffdcb0, path="crash.kct", mode=6) at ./kcthread.h:383
#12 0x000055555556faad in procload (path=0x7fffffffe6c6 "crash.kct", file=0x0, oflags=<optimized out>, zcomp=<optimized out>) at /usr/include/c++/9/ext/new_allocator.h:80
#13 0x000055555556bdcf in runload (argv=<optimized out>, argc=<optimized out>) at kctreemgr.cc:664
#14 main (argc=<optimized out>, argv=0x7fffffffe448) at kctreemgr.cc:98