{"id":2165,"date":"2017-09-08T16:44:31","date_gmt":"2017-09-08T14:44:31","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=2165"},"modified":"2017-09-14T09:04:34","modified_gmt":"2017-09-14T07:04:34","slug":"mp3gain-memcpy-param-overlap-in-set_pointer-mpglibdblcommon-c","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2017\/09\/08\/mp3gain-memcpy-param-overlap-in-set_pointer-mpglibdblcommon-c\/","title":{"rendered":"mp3gain: memcpy-param-overlap in set_pointer (mpglibDBL\/common.c)"},"content":{"rendered":"

Description<\/strong>:
\nmp3gain<\/a> is a program to analyze and adjust MP3 files to same volume.<\/p>\n

The fuzz was done via the aacgain command-line tool which uses mp3gain which bundles an old-modified version of mpg123 called mpglibDBL.
\nThe upstream project seems to be dead, so the issue wasn\u2019t communicated to them.<\/p>\n

The complete ASan output of the issue:<\/p>\n

# aacgain -f $FILE\r\n==23175==ERROR: AddressSanitizer: memcpy-param-overlap: memory ranges [0x7f004fb593ff,0x7f004fb594fd) and [0x7f004fb59381, 0x7f004fb5947f) overlap\r\n    #0 0x7f00532d5906  (\/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/6.4.0\/libasan.so.3+0x5c906)\r\n    #1 0x8e9b25 in set_pointer \/var\/tmp\/portage\/media-sound\/aacgain-1.9\/work\/aacgain-1.9\/mp3gain\/mpglibDBL\/common.c:328\r\n    #2 0x8cd58d in do_layer3 \/var\/tmp\/portage\/media-sound\/aacgain-1.9\/work\/aacgain-1.9\/mp3gain\/mpglibDBL\/layer3.c:1582\r\n    #3 0x8ac2f9 in decodeMP3 \/var\/tmp\/portage\/media-sound\/aacgain-1.9\/work\/aacgain-1.9\/mp3gain\/mpglibDBL\/interface.c:643\r\n    #4 0x43e767 in main \/var\/tmp\/portage\/media-sound\/aacgain-1.9\/work\/aacgain-1.9\/mp3gain\/mp3gain.c:2262\r\n    #5 0x7f00525ee680 in __libc_start_main (\/lib64\/libc.so.6+0x20680)\r\n    #6 0x4426c8 in _start (\/usr\/bin\/aacgain+0x4426c8)\r\n\r\nAddress 0x7f004fb593ff is located in stack of thread T0 at offset 21503 in frame\r\n    #0 0x4341ff in main \/var\/tmp\/portage\/media-sound\/aacgain-1.9\/work\/aacgain-1.9\/mp3gain\/mp3gain.c:1411\r\n\r\n  This frame has 7 object(s):\r\n    [32, 33) 'maxgain'\r\n    [96, 97) 'mingain'\r\n    [160, 164) 'nprocsamp'\r\n    [224, 232) 'maxsample'\r\n    [288, 9504) 'lsamples'\r\n    [9536, 18752) 'rsamples'\r\n    [18784, 50704) 'mp' <== Memory access at offset 21503 is inside this variable\r\nHINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext\r\n      (longjmp and C++ exceptions *are* supported)\r\nAddress 0x7f004fb59381 is located in stack of thread T0 at offset 21377 in frame\r\n    #0 0x4341ff in main \/var\/tmp\/portage\/media-sound\/aacgain-1.9\/work\/aacgain-1.9\/mp3gain\/mp3gain.c:1411\r\n\r\n  This frame has 7 object(s):\r\n    [32, 33) 'maxgain'\r\n    [96, 97) 'mingain'\r\n    [160, 164) 'nprocsamp'\r\n    [224, 232) 'maxsample'\r\n    [288, 9504) 'lsamples'\r\n    [9536, 18752) 'rsamples'\r\n    [18784, 50704) 'mp' <== Memory access at offset 21377 is inside this variable\r\nHINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext\r\n      (longjmp and C++ exceptions *are* supported)\r\nSUMMARY: AddressSanitizer: memcpy-param-overlap (\/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/6.4.0\/libasan.so.3+0x5c906) \r\n==23175==ABORTING\r\n<\/font><\/pre>\n
Affected version:<\/strong>
\n1.5.2<\/p>\n
Fixed version:<\/strong>
\nN\/A<\/p>\n
Commit fix:<\/strong>
\nN\/A<\/p>\n
Credit:<\/strong>
\nThis bug was discovered by Agostino Sarubbo of Gentoo.<\/p>\n
Reproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00349-aacgain-memcpyparamoverlap-set_pointer<\/a><\/p>\n
Timeline:<\/strong>
\n2017-08-28: bug discovered
\n2017-09-08: blog post about the issue<\/p>\n
Note:<\/strong>
\nThis bug was found with American Fuzzy Lop<\/a>.
\nThis bug was identified with bare metal servers donated by Packet<\/a>. This work is also supported by the Core Infrastructure Initiative<\/a>.<\/p>\n
Permalink:<\/strong><\/p>\n
mp3gain: memcpy-param-overlap in set_pointer (mpglibDBL\/common.c)<\/a><\/p><\/blockquote>\n