Description:
libsndfile is a C library for reading and writing files containing sampled sound.
The complete ASan output of the issue:
# sndfile-convert $FILE out.wav ==26966==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x621000001110 at pc 0x7fd12fe865e6 bp 0x7ffea55e99f0 sp 0x7ffea55e99e8 READ of size 4 at 0x621000001110 thread T0 #0 0x7fd12fe865e5 in flac_buffer_copy /tmp/portage/media-libs/libsndfile-1.0.28/work/libsndfile-1.0.28/src/flac.c:267:41 #1 0x7fd12fe86ef4 in flac_read_loop /tmp/portage/media-libs/libsndfile-1.0.28/work/libsndfile-1.0.28/src/flac.c:928:3 #2 0x7fd12fe721fb in flac_read_flac2i /tmp/portage/media-libs/libsndfile-1.0.28/work/libsndfile-1.0.28/src/flac.c:979:13 #3 0x7fd12fdca3a2 in sf_readf_int /tmp/portage/media-libs/libsndfile-1.0.28/work/libsndfile-1.0.28/src/sndfile.c:1835:10 #4 0x514b5d in sfe_copy_data_int /tmp/portage/media-libs/libsndfile-1.0.28/work/libsndfile-1.0.28/programs/common.c:87:16 #5 0x5138d1 in main /tmp/portage/media-libs/libsndfile-1.0.28/work/libsndfile-1.0.28/programs/sndfile-convert.c:340:3 #6 0x7fd12ed6578f in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289 #7 0x419e18 in _init (/usr/bin/sndfile-convert+0x419e18) 0x621000001110 is located 0 bytes to the right of 4112-byte region [0x621000000100,0x621000001110) allocated by thread T0 here: #0 0x4d94e8 in malloc /tmp/portage/sys-libs/compiler-rt-sanitizers-4.0.0/work/compiler-rt-4.0.0.src/lib/asan/asan_malloc_linux.cc:66 #1 0x7fd12eb2d492 in safe_malloc_muladd2_ /tmp/portage/media-libs/flac-1.3.2-r1/work/flac-1.3.2/include/share/alloc.h:153 #2 0x7fd12eb2d492 in allocate_output_ /tmp/portage/media-libs/flac-1.3.2-r1/work/flac-1.3.2/src/libFLAC/stream_decoder.c:1294 #3 0x7fd12eb2d492 in read_frame_ /tmp/portage/media-libs/flac-1.3.2-r1/work/flac-1.3.2/src/libFLAC/stream_decoder.c:2035 SUMMARY: AddressSanitizer: heap-buffer-overflow /tmp/portage/media-libs/libsndfile-1.0.28/work/libsndfile-1.0.28/src/flac.c:267:41 in flac_buffer_copy Shadow bytes around the buggy address: 0x0c427fff81d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c427fff81e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c427fff81f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c427fff8200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c427fff8210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c427fff8220: 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c427fff8230: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c427fff8240: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c427fff8250: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c427fff8260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c427fff8270: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==26966==ABORTING
Affected version:
1.0.28
Fixed version:
N/A
Commit fix:
https://github.com/erikd/libsndfile/commit/fd0484aba8e51d16af1e3a880f9b8b857b385eb3
Credit:
This bug was discovered by Agostino Sarubbo of Gentoo.
CVE:
CVE-2017-8363
Reproducer:
https://github.com/asarubbo/poc/blob/master/00266-libsndfile-heapoverflow-flac_buffer_copy
Timeline:
2017-04-12: bug discovered and reported to upstream
2017-04-12: upstream released a patch
2017-04-29: blog post about the issue
2017-04-30: CVE assigned
Note:
This bug was found with American Fuzzy Lop.
Permalink:
libsndfile: heap-based buffer overflow in flac_buffer_copy (flac.c)
Pingback: libsndfile flac_buffer_copy函数拒绝服务漏洞(CVE-2017-8361) | Heikuo ' Blog