{"id":1569,"date":"2017-04-01T17:40:37","date_gmt":"2017-04-01T15:40:37","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=1569"},"modified":"2017-04-10T09:18:18","modified_gmt":"2017-04-10T07:18:18","slug":"libaacplus-signed-integer-overflow-left-shift-and-assertion-failure","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2017\/04\/01\/libaacplus-signed-integer-overflow-left-shift-and-assertion-failure\/","title":{"rendered":"libaacplus: signed integer overflow, left shift and assertion failure"},"content":{"rendered":"

Description<\/strong>:
\nlibaacplus<\/a> is a HE-AAC+ v2 library, based on the reference implementation.<\/p>\n

While fuzzing it I found some crashes. Upstream was poked on 2017-03-12, but no response from him.<\/p>\n

# aacplusenc $FILE out.aac 24000 s\r\nau_channel.h:31:91: runtime error: signed integer overflow: 2147483647 + 8 cannot be represented in type 'int'\r\n<\/font><\/pre>\n
Affected version:<\/strong>
\n2.0.2
\nFixed version:<\/strong>
\nN\/A
\nCommit fix:<\/strong>
\nN\/A
\nReproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00254-libaacplus-signedintoverflow<\/a>
\nCVE:<\/strong>
\nCVE-2017-7603<\/p>\n
##############################################<\/p>\n
# aacplusenc $FILE out.aac 24000 s\r\nau_channel.h:31:83: runtime error: left shift of 241 by 24 places cannot be represented in type 'int'\r\n<\/font><\/pre>\n
Affected version:<\/strong>
\n2.0.2
\nFixed version:<\/strong>
\nN\/A
\nCommit fix:<\/strong>
\nN\/A
\nReproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00255-libaacplus-leftshift<\/a>
\nCVE:<\/strong>
\nCVE-2017-7604<\/p>\n
##############################################<\/p>\n
# aacplusenc $FILE out.aac 24000 s\r\naacplusenc: aacplusenc.c:67: aacplusEncHandle aacplusEncOpen(unsigned long, unsigned int, unsigned long *, unsigned long *): Assertion `numChannels <= MAX_CHANNELS' failed.\r\n<\/font><\/pre>\n
Affected version:<\/strong>
\n2.0.2
\nFixed version:<\/strong>
\nN\/A
\nCommit fix:<\/strong>
\nN\/A
\nReproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00256-libaacplus-assertion-failure<\/a>
\nCVE:<\/strong>
\nCVE-2017-7605<\/p>\n
##############################################<\/p>\n
Credit:<\/strong>
\nThese bugs were discovered by Agostino Sarubbo of Gentoo.<\/p>\n
Timeline:<\/strong>
\n2017-03-12: bug discovered and poked upstream about
\n2017-04-01: blog post about the issue
\n2017-04-09: CVE assigned<\/p>\n
Note:<\/strong>
\nThis bug was found with American Fuzzy Lop<\/a>.<\/p>\n
Permalink:<\/strong><\/p>\n
libaacplus: signed integer overflow, left shift and assertion failure<\/a><\/p><\/blockquote>\n