{"id":1899,"date":"2017-06-17T16:52:26","date_gmt":"2017-06-17T14:52:26","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=1899"},"modified":"2017-06-17T16:52:26","modified_gmt":"2017-06-17T14:52:26","slug":"lame-multiple-left-shift","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2017\/06\/17\/lame-multiple-left-shift\/","title":{"rendered":"lame: multiple left shift"},"content":{"rendered":"<p><strong>Description<\/strong>:<br \/>\n<a href=\"http:\/\/lame.sourceforge.net\/\">lame<\/a> is a high quality MPEG Audio Layer III (MP3) encoder licensed under the LGPL.<\/p>\n<p>Few notes before the details of this bug. Time ago a fuzz was done by Brian Carpenter and Jakub Wilk which posted the results on the debian bugtracker. In cases like this, when upstream is not active and people do not post on the upstream bugzilla is easy discover duplicates, so I downloaded all available testcases, and noone of the bug you will see on my blog is a duplicate of an existing issue. Upstream seems a bit dead, latest release was into 2011, so this blog post will probably forwarded on the upstream bugtracker just for the record.<\/p>\n<p>The complete ASan output of the issue:<\/p>\n<pre><font size=\"2\"># lame -f -V 9 $FILE out.wav\r\n\/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/VbrTag.c:263:5: runtime error: left shift of negative value -1\r\n\/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/VbrTag.c:265:5: runtime error: left shift of negative value -1\r\n\/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/VbrTag.c:266:5: runtime error: left shift of negative value -1\r\n\/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/VbrTag.c:267:5: runtime error: left shift of negative value -1\r\n\/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/VbrTag.c:268:5: runtime error: left shift of negative value -1\r\n\/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/VbrTag.c:269:5: runtime error: left shift of negative value -1\r\n\/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/VbrTag.c:271:5: runtime error: left shift of negative value -1\r\n\/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/VbrTag.c:272:5: runtime error: left shift of negative value -1\r\n\/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/VbrTag.c:273:5: runtime error: left shift of negative value -1\r\n\/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/VbrTag.c:274:5: runtime error: left shift of negative value -1\r\n\/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/VbrTag.c:276:5: runtime error: left shift of negative value -1\r\n\/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/VbrTag.c:277:5: runtime error: left shift of negative value -1\r\n\/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/VbrTag.c:278:5: runtime error: left shift of negative value -1\r\n\/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/VbrTag.c:279:5: runtime error: left shift of negative value -1\r\n\/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/VbrTag.c:280:5: runtime error: left shift of negative value -1\r\n\/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/frontend\/get_audio.c:845:48: runtime error: left shift of negative value -18\r\n\/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/frontend\/get_audio.c:848:52: runtime error: left shift of negative value -10\r\n<\/font><\/pre>\n<p><strong>Reproducer:<\/strong><br \/>\n<a href=\"https:\/\/github.com\/asarubbo\/poc\/blob\/master\/00295-lame-leftshift1\">https:\/\/github.com\/asarubbo\/poc\/blob\/master\/00295-lame-leftshift1<\/a><br \/>\n<strong>CVE:<\/strong><br \/>\nN\/A<\/p>\n<p>#######################################<\/p>\n<pre><font size=\"2\"># lame -f -V 9 $FILE out.wav\r\n\/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/frontend\/get_audio.c:848:52: runtime error: left shift of negative value -29398\r\n\/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/libmp3lame\/bitstream.c:181:50: runtime error: left shift of 45389699 by 6 places cannot be represented in type 'int'\r\n<\/font><\/pre>\n<p><strong>Reproducer:<\/strong><br \/>\n<a href=\"https:\/\/github.com\/asarubbo\/poc\/blob\/master\/00296-lame-leftshift2\">https:\/\/github.com\/asarubbo\/poc\/blob\/master\/00296-lame-leftshift2<\/a><br \/>\n<strong>CVE:<\/strong><br \/>\nN\/A<\/p>\n<p>#######################################<\/p>\n<pre><font size=\"2\"># lame -f -V 9 $FILE out.wav\r\n\/var\/tmp\/portage\/media-sound\/lame-3.99.5-r1\/work\/lame-3.99.5\/frontend\/get_audio.c:1195:52: runtime error: left shift of 255 by 24 places cannot be represented in type 'int'\r\n<\/font><\/pre>\n<p><strong>Reproducer:<\/strong><br \/>\n<a href=\"https:\/\/github.com\/asarubbo\/poc\/blob\/master\/00297-lame-leftshift3\">https:\/\/github.com\/asarubbo\/poc\/blob\/master\/00297-lame-leftshift3<\/a><br \/>\n<strong>CVE:<\/strong><br \/>\nN\/A<\/p>\n<p>#######################################<\/p>\n<p><strong>Affected version:<\/strong><br \/>\n3.99.5<\/p>\n<p><strong>Fixed version:<\/strong><br \/>\nN\/A<\/p>\n<p><strong>Commit fix:<\/strong><br \/>\nN\/A<\/p>\n<p><strong>Credit:<\/strong><br \/>\nThese bugs were discovered by Agostino Sarubbo of Gentoo.<\/p>\n<p><strong>Timeline:<\/strong><br \/>\n2017-06-01: bug discovered<br \/>\n2017-06-17: blog post about the issue<\/p>\n<p><strong>Note:<\/strong><br \/>\nThese bugs were found with <a href=\"http:\/\/lcamtuf.coredump.cx\/afl\">American Fuzzy Lop<\/a>.<\/p>\n<p><strong>Permalink:<\/strong><\/p>\n<blockquote data-secret=\"xrEcNhnsMX\" class=\"wp-embedded-content\"><p><a href=\"https:\/\/blogs.gentoo.org\/ago\/2017\/06\/17\/lame-multiple-left-shift\/\">lame: multiple left shift<\/a><\/p><\/blockquote>\n<p><iframe class=\"wp-embedded-content\" sandbox=\"allow-scripts\" security=\"restricted\" style=\"position: absolute; clip: rect(1px, 1px, 1px, 1px);\" src=\"https:\/\/blogs.gentoo.org\/ago\/2017\/06\/17\/lame-multiple-left-shift\/embed\/#?secret=xrEcNhnsMX\" data-secret=\"xrEcNhnsMX\" width=\"600\" height=\"338\" title=\"&#8220;lame: multiple left shift&#8221; &#8212; agostino&#039;s blog\" frameborder=\"0\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\"><\/iframe><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Description: lame is a high quality MPEG Audio Layer III (MP3) encoder licensed under the LGPL. Few notes before the details of this bug. Time ago a fuzz was done by Brian Carpenter and Jakub Wilk which posted the results &hellip; <a href=\"https:\/\/blogs.gentoo.org\/ago\/2017\/06\/17\/lame-multiple-left-shift\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":140,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true},"categories":[12,10],"tags":[],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p2EaBc-uD","_links":{"self":[{"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/posts\/1899"}],"collection":[{"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/users\/140"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/comments?post=1899"}],"version-history":[{"count":2,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/posts\/1899\/revisions"}],"predecessor-version":[{"id":1905,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/posts\/1899\/revisions\/1905"}],"wp:attachment":[{"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/media?parent=1899"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/categories?post=1899"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/tags?post=1899"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}