{"id":2162,"date":"2017-09-08T16:33:22","date_gmt":"2017-09-08T14:33:22","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=2162"},"modified":"2017-09-13T22:52:33","modified_gmt":"2017-09-13T20:52:33","slug":"mp3gain-null-pointer-dereference-in-sync_buffer-mpglibdblinterface-c","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2017\/09\/08\/mp3gain-null-pointer-dereference-in-sync_buffer-mpglibdblinterface-c\/","title":{"rendered":"mp3gain: NULL pointer dereference in sync_buffer (mpglibDBL\/interface.c)"},"content":{"rendered":"

Description<\/strong>:
\nmp3gain<\/a> is a program to analyze and adjust MP3 files to same volume.<\/p>\n

The fuzz was done via the aacgain command-line tool which uses mp3gain which bundles an old-modified version of mpg123 called mpglibDBL.
\nThe upstream project seems to be dead, so the issue wasn\u2019t communicated to them.<\/p>\n

The complete ASan output of the issue:<\/p>\n

# aacgain -f $FILE\r\nASAN:DEADLYSIGNAL                                                                                                                                                                                                 \r\n=================================================================                                                                                                                                                 \r\n==23063==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x0000008aafe0 bp 0x7ffe06c66450 sp 0x7ffe06c663f0 T0)\r\n    #0 0x8aafdf in sync_buffer \/var\/tmp\/portage\/media-sound\/aacgain-1.9\/work\/aacgain-1.9\/mp3gain\/mpglibDBL\/interface.c:393\r\n    #1 0x8ae64c in decodeMP3 \/var\/tmp\/portage\/media-sound\/aacgain-1.9\/work\/aacgain-1.9\/mp3gain\/mpglibDBL\/interface.c:665\r\n    #2 0x43e767 in main \/var\/tmp\/portage\/media-sound\/aacgain-1.9\/work\/aacgain-1.9\/mp3gain\/mp3gain.c:2262\r\n    #3 0x7fa37f734680 in __libc_start_main (\/lib64\/libc.so.6+0x20680)\r\n    #4 0x4426c8 in _start (\/usr\/bin\/aacgain+0x4426c8)\r\n\r\nAddressSanitizer can not provide additional info.\r\nSUMMARY: AddressSanitizer: SEGV \/var\/tmp\/portage\/media-sound\/aacgain-1.9\/work\/aacgain-1.9\/mp3gain\/mpglibDBL\/interface.c:393 in sync_buffer\r\n==23063==ABORTING\r\n<\/font><\/pre>\n
Affected version:<\/strong>
\n1.5.2<\/p>\n
Fixed version:<\/strong>
\nN\/A<\/p>\n
Commit fix:<\/strong>
\nN\/A<\/p>\n
Credit:<\/strong>
\nThis bug was discovered by Agostino Sarubbo of Gentoo.<\/p>\n
CVE:<\/strong>
\nCVE-2017-14406<\/p>\n
Reproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00347-aacgain-NULLptr-sync_buffer<\/a><\/p>\n
Timeline:<\/strong>
\n2017-08-28: bug discovered
\n2017-09-08: blog post about the issue
\n2017-09-13: CVE Assigned<\/p>\n
Note:<\/strong>
\nThis bug was found with American Fuzzy Lop<\/a>.
\nThis bug was identified with bare metal servers donated by Packet<\/a>. This work is also supported by the Core Infrastructure Initiative<\/a>.<\/p>\n
Permalink:<\/strong><\/p>\n
mp3gain: NULL pointer dereference in sync_buffer (mpglibDBL\/interface.c)<\/a><\/p><\/blockquote>\n