{"id":1883,"date":"2017-06-17T16:52:08","date_gmt":"2017-06-17T14:52:08","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=1883"},"modified":"2017-06-28T13:51:51","modified_gmt":"2017-06-28T11:51:51","slug":"lame-heap-based-buffer-overflow-in-fill_buffer_resample-util-c","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2017\/06\/17\/lame-heap-based-buffer-overflow-in-fill_buffer_resample-util-c\/","title":{"rendered":"lame: heap-based buffer overflow in fill_buffer_resample (util.c)"},"content":{"rendered":"<p><strong>Description<\/strong>:<br \/>\n<a href=\"http:\/\/lame.sourceforge.net\/\">lame<\/a> is a high quality MPEG Audio Layer III (MP3) encoder licensed under the LGPL.<\/p>\n<p>Few notes before the details of this bug. Time ago a fuzz was done by Brian Carpenter and Jakub Wilk which posted the results on the debian bugtracker. In cases like this, when upstream is not active and people do not post on the upstream bugzilla is easy discover duplicates, so I downloaded all available testcases, and noone of the bug you will see on my blog is a duplicate of an existing issue. Upstream seems a bit dead, latest release was into 2011, so this blog post will probably forwarded on the upstream bugtracker just for the record.<\/p>\n<p>The complete ASan output of the issue:<\/p>\n<pre><font size=\"2\"># lame -f -V 9 $FILE out.wav\r\n==29263==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60c00000003c at pc 0x7f60ef5a8c12 bp 0x7ffe7420b940 sp 0x7ffe7420b938\r\nREAD of size 4 at 0x60c00000003c thread T0\r\n    #0 0x7f60ef5a8c11 in fill_buffer_resample \/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/util.c\r\n    #1 0x7f60ef5a8c11 in fill_buffer \/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/util.c:677\r\n    #2 0x7f60ef47866b in lame_encode_buffer_sample_t \/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/lame.c:1736:9\r\n    #3 0x7f60ef47866b in lame_encode_buffer_template \/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/lame.c:1891\r\n    #4 0x7f60ef47e83a in lame_encode_buffer \/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/lame.c:1902:12\r\n    #5 0x7f60ef47e83a in lame_encode_flush \/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/lame.c:2134\r\n    #6 0x50fa2c in lame_encoder_loop \/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/frontend\/lame_main.c:487:16\r\n    #7 0x50fa2c in lame_encoder \/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/frontend\/lame_main.c:531\r\n    #8 0x50c43f in lame_main \/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/frontend\/lame_main.c:707:15\r\n    #9 0x510793 in c_main \/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/frontend\/main.c:470:15\r\n    #10 0x510793 in main \/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/frontend\/main.c:438\r\n    #11 0x7f60ee1c7680 in __libc_start_main \/tmp\/portage\/sys-libs\/glibc-2.23-r3\/work\/glibc-2.23\/csu\/..\/csu\/libc-start.c:289\r\n    #12 0x41c998 in _init (\/usr\/bin\/lame+0x41c998)\r\n\r\n0x60c00000003c is located 4 bytes to the left of 128-byte region [0x60c000000040,0x60c0000000c0)\r\nallocated by thread T0 here:\r\n    #0 0x4d2540 in calloc \/tmp\/portage\/sys-libs\/compiler-rt-sanitizers-4.0.0\/work\/compiler-rt-4.0.0.src\/lib\/asan\/asan_malloc_linux.cc:74\r\n    #1 0x7f60ef5a3575 in fill_buffer_resample \/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/util.c:558:29\r\n    #2 0x7f60ef5a3575 in fill_buffer \/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/util.c:677\r\n    #3 0x7f60ef47866b in lame_encode_buffer_sample_t \/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/lame.c:1736:9\r\n    #4 0x7f60ef47866b in lame_encode_buffer_template \/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/lame.c:1891\r\n    #5 0x7f60ef47e83a in lame_encode_buffer \/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/lame.c:1902:12\r\n    #6 0x7f60ef47e83a in lame_encode_flush \/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/lame.c:2134\r\n    #7 0x50fa2c in lame_encoder_loop \/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/frontend\/lame_main.c:487:16\r\n    #8 0x50fa2c in lame_encoder \/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/frontend\/lame_main.c:531\r\n    #9 0x50c43f in lame_main \/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/frontend\/lame_main.c:707:15\r\n    #10 0x510793 in c_main \/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/frontend\/main.c:470:15\r\n    #11 0x510793 in main \/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/frontend\/main.c:438\r\n    #12 0x7f60ee1c7680 in __libc_start_main \/tmp\/portage\/sys-libs\/glibc-2.23-r3\/work\/glibc-2.23\/csu\/..\/csu\/libc-start.c:289\r\n\r\nSUMMARY: AddressSanitizer: heap-buffer-overflow \/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/util.c in fill_buffer_resample\r\nShadow bytes around the buggy address:\r\n  0x0c187fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0c187fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0c187fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0c187fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0c187fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0c187fff8000: fa fa fa fa fa fa fa[fa]00 00 00 00 00 00 00 00\r\n  0x0c187fff8010: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa\r\n  0x0c187fff8020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0c187fff8030: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00\r\n  0x0c187fff8040: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa\r\n  0x0c187fff8050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\nShadow byte legend (one shadow byte represents 8 application bytes):\r\n  Addressable:           00\r\n  Partially addressable: 01 02 03 04 05 06 07 \r\n  Heap left redzone:       fa\r\n  Freed heap region:       fd\r\n  Stack left redzone:      f1\r\n  Stack mid redzone:       f2\r\n  Stack right redzone:     f3\r\n  Stack after return:      f5\r\n  Stack use after scope:   f8\r\n  Global redzone:          f9\r\n  Global init order:       f6\r\n  Poisoned by user:        f7\r\n  Container overflow:      fc\r\n  Array cookie:            ac\r\n  Intra object redzone:    bb\r\n  ASan internal:           fe\r\n  Left alloca redzone:     ca\r\n  Right alloca redzone:    cb\r\n==29263==ABORTING\r\n<\/font><\/pre>\n<p><strong>Affected version:<\/strong><br \/>\n3.99.5<\/p>\n<p><strong>Fixed version:<\/strong><br \/>\nN\/A<\/p>\n<p><strong>Commit fix:<\/strong><br \/>\nN\/A<\/p>\n<p><strong>Credit:<\/strong><br \/>\nThis bug was discovered by Agostino Sarubbo of Gentoo.<\/p>\n<p><strong>CVE:<\/strong><br \/>\nCVE-2015-9101<\/p>\n<p><strong>Reproducer:<\/strong><br \/>\n<a href=\"https:\/\/github.com\/asarubbo\/poc\/blob\/master\/00292-lame-heapoverflow-fill_buffer_resample\">https:\/\/github.com\/asarubbo\/poc\/blob\/master\/00292-lame-heapoverflow-fill_buffer_resample<\/a><\/p>\n<p><strong>Timeline:<\/strong><br \/>\n2017-06-01: bug discovered<br \/>\n2017-06-17: blog post about the issue<br \/>\n2017-06-25: CVE assigned<\/p>\n<p><strong>Note:<\/strong><br \/>\nThis bug was found with <a href=\"http:\/\/lcamtuf.coredump.cx\/afl\">American Fuzzy Lop<\/a>.<br \/>\nMitre decided that this bug can share the same CVE id of <a href=\"https:\/\/bugs.debian.org\/cgi-bin\/bugreport.cgi?bug=777161\">https:\/\/bugs.debian.org\/cgi-bin\/bugreport.cgi?bug=777161<\/a><\/p>\n<p><strong>Permalink:<\/strong><\/p>\n<blockquote data-secret=\"KEHRXpwBOf\" class=\"wp-embedded-content\"><p><a href=\"http:\/\/blogs.gentoo.org\/ago\/2017\/06\/17\/lame-heap-based-buffer-overflow-in-fill_buffer_resample-util-c\/\">lame: heap-based buffer overflow in fill_buffer_resample (util.c)<\/a><\/p><\/blockquote>\n<p><iframe class=\"wp-embedded-content\" sandbox=\"allow-scripts\" security=\"restricted\" style=\"position: absolute; clip: rect(1px, 1px, 1px, 1px);\" src=\"http:\/\/blogs.gentoo.org\/ago\/2017\/06\/17\/lame-heap-based-buffer-overflow-in-fill_buffer_resample-util-c\/embed\/#?secret=KEHRXpwBOf\" data-secret=\"KEHRXpwBOf\" width=\"600\" height=\"338\" title=\"&#8220;lame: heap-based buffer overflow in fill_buffer_resample (util.c)&#8221; &#8212; agostino&#039;s blog\" frameborder=\"0\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\"><\/iframe><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Description: lame is a high quality MPEG Audio Layer III (MP3) encoder licensed under the LGPL. Few notes before the details of this bug. Time ago a fuzz was done by Brian Carpenter and Jakub Wilk which posted the results &hellip; <a href=\"https:\/\/blogs.gentoo.org\/ago\/2017\/06\/17\/lame-heap-based-buffer-overflow-in-fill_buffer_resample-util-c\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":140,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true},"categories":[12,10],"tags":[],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p2EaBc-un","_links":{"self":[{"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/posts\/1883"}],"collection":[{"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/users\/140"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/comments?post=1883"}],"version-history":[{"count":5,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/posts\/1883\/revisions"}],"predecessor-version":[{"id":1920,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/posts\/1883\/revisions\/1920"}],"wp:attachment":[{"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/media?parent=1883"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/categories?post=1883"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/tags?post=1883"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}