{"id":342,"date":"2016-08-20T19:08:21","date_gmt":"2016-08-20T17:08:21","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=342"},"modified":"2016-09-11T11:27:10","modified_gmt":"2016-09-11T09:27:10","slug":"libav-stack-based-buffer-overflow-in-aac_sync-aac_parser-c","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2016\/08\/20\/libav-stack-based-buffer-overflow-in-aac_sync-aac_parser-c\/","title":{"rendered":"libav: stack-based buffer overflow in aac_sync (aac_parser.c)"},"content":{"rendered":"<p><strong>Description<\/strong>:<br \/>\n<a href=\"https:\/\/libav.org\/\">Libav<\/a> is an open source set of tools for audio and video processing.<\/p>\n<p>A crafted file causes a stack-based buffer overflow. The ASan report may be confused because it mentions get_bits, but the issue is in aac_sync.<br \/>\nThis issue was discovered the past year, I reported it to Luca Barbato privately and I didn&#8217;t follow the state.<br \/>\nBefore I made the report, the bug was noticed by Janne Grunau because the fate test reported a failure, then he fixed it, but at that time there wasn&#8217;t stable release(s) that included the fix.<\/p>\n<p>The complete ASan output:<\/p>\n<pre><font size=\"2\">~ # avconv -i $FILE -f null -\r\n==20736==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd3bd34f4a at pc 0x7f0805611189 bp 0x7ffd3bd34e20 sp 0x7ffd3bd34e18\r\nREAD of size 4 at 0x7ffd3bd34f4a thread T0\r\n    #0 0x7f0805611188 in get_bits \/var\/tmp\/portage\/media-video\/libav-11.3\/work\/libav-11.3\/libavcodec\/get_bits.h:244:5\r\n    #1 0x7f0805611188 in avpriv_aac_parse_header \/var\/tmp\/portage\/media-video\/libav-11.3\/work\/libav-11.3\/libavcodec\/aacadtsdec.c:58\r\n    #2 0x7f080560f19e in aac_sync \/var\/tmp\/portage\/media-video\/libav-11.3\/work\/libav-11.3\/libavcodec\/aac_parser.c:43:17\r\n    #3 0x7f080560a87b in ff_aac_ac3_parse \/var\/tmp\/portage\/media-video\/libav-11.3\/work\/libav-11.3\/libavcodec\/aac_ac3_parser.c:48:25\r\n    #4 0x7f0806fcd8e6 in av_parser_parse2 \/var\/tmp\/portage\/media-video\/libav-11.3\/work\/libav-11.3\/libavcodec\/parser.c:157:13\r\n    #5 0x7f0808efd4dd in parse_packet \/var\/tmp\/portage\/media-video\/libav-11.3\/work\/libav-11.3\/libavformat\/utils.c:794:15\r\n    #6 0x7f0808edae64 in read_frame_internal \/var\/tmp\/portage\/media-video\/libav-11.3\/work\/libav-11.3\/libavformat\/utils.c:960:24\r\n    #7 0x7f0808ee8783 in avformat_find_stream_info \/var\/tmp\/portage\/media-video\/libav-11.3\/work\/libav-11.3\/libavformat\/utils.c:2156:15\r\n    #8 0x4f62f6 in open_input_file \/var\/tmp\/portage\/media-video\/libav-11.3\/work\/libav-11.3\/avconv_opt.c:726:11\r\n    #9 0x4f474f in open_files \/var\/tmp\/portage\/media-video\/libav-11.3\/work\/libav-11.3\/avconv_opt.c:2127:15\r\n    #10 0x4f3f62 in avconv_parse_options \/var\/tmp\/portage\/media-video\/libav-11.3\/work\/libav-11.3\/avconv_opt.c:2164:11\r\n    #11 0x528727 in main \/var\/tmp\/portage\/media-video\/libav-11.3\/work\/libav-11.3\/avconv.c:2629:11\r\n    #12 0x7f0803c83aa4 in __libc_start_main \/var\/tmp\/portage\/sys-libs\/glibc-2.20-r2\/work\/glibc-2.20\/csu\/libc-start.c:289\r\n    #13 0x43a5d6 in _start (\/usr\/bin\/avconv+0x43a5d6)\r\n\r\nAddress 0x7ffd3bd34f4a is located in stack of thread T0 at offset 170 in frame\r\n    #0 0x7f080560ee3f in aac_sync \/var\/tmp\/portage\/media-video\/libav-11.3\/work\/libav-11.3\/libavcodec\/aac_parser.c:31\r\n\r\n  This frame has 3 object(s):\r\n    [32, 64) 'bits'\r\n    [96, 116) 'hdr'\r\n    [160, 168) 'tmp' 0x10002779e9e0: 00 00 04 f2 f2 f2 f2 f2 00[f3]f3 f3 00 00 00 00                                                                                                                                                                                                              \r\n  0x10002779e9f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                                                                                                                                                                                                              \r\n  0x10002779ea00: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1                                                                                                                                                                                                              \r\n  0x10002779ea10: 00 f2 f2 f2 04 f2 04 f3 00 00 00 00 00 00 00 00                                                                                                                                                                                                              \r\n  0x10002779ea20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                                                                                                                                                                                                              \r\n  0x10002779ea30: f1 f1 f1 f1 00 f3 f3 f3 00 00 00 00 00 00 00 00                                                                                                                                                                                                              \r\nShadow byte legend (one shadow byte represents 8 application bytes):                                                                                                                                                                                                           \r\n  Addressable:           00                                                                                                                                                                                                                                                    \r\n  Partially addressable: 01 02 03 04 05 06 07                                                                                                                                                                                                                                  \r\n  Heap left redzone:       fa                                                                                                                                                                                                                                                  \r\n  Heap right redzone:      fb                                                                                                                                                                                                                                                  \r\n  Freed heap region:       fd                                                                                                                                                                                                                                                  \r\n  Stack left redzone:      f1                                                                                                                                                                                                                                                  \r\n  Stack mid redzone:       f2                                                                                                                                                                                                                                                  \r\n  Stack right redzone:     f3                                                                                                                                                                                                                                                  \r\n  Stack partial redzone:   f4                                                                                                                                                                                                                                                  \r\n  Stack after return:      f5                                                                                                                                                                                                                                                  \r\n  Stack use after scope:   f8                                                                                                                                                                                                                                                  \r\n  Global redzone:          f9                                                                                                                                                                                                                                                  \r\n  Global init order:       f6                                                                                                                                                                                                                                                  \r\n  Poisoned by user:        f7                                                                                                                                                                                                                                                  \r\n  Container overflow:      fc                                                                                                                                                                                                                                                  \r\n  Array cookie:            ac                                                                                                                                                                                                                                                  \r\n  Intra object redzone:    bb                                                                                                                                                                                                                                                  \r\n  ASan internal:           fe                                                                                                                                                                                                                                                  \r\n  Left alloca redzone:     ca                                                                                                                                                                                                                                                  \r\n  Right alloca redzone:    cb                                                                                                                                                                                                                                                  \r\n==20736==ABORTING                                                                                                                                                                                                                                                              \r\n<\/font><\/pre>\n<p><strong>Affected version:<\/strong><br \/>\n11.3 (and maybe past versions)<\/p>\n<p><strong>Fixed version:<\/strong><br \/>\n11.5<\/p>\n<p><strong>Commit fix:<\/strong><br \/>\n<a href=\"https:\/\/git.libav.org\/?p=libav.git;a=commit;h=fb1473080223a634b8ac2cca48a632d037a0a69d\">https:\/\/git.libav.org\/?p=libav.git;a=commit;h=fb1473080223a634b8ac2cca48a632d037a0a69d<\/a><\/p>\n<p><strong>Credit:<\/strong><br \/>\nThis bug was discovered by Agostino Sarubbo of Gentoo.<br \/>\nThis bug was also discovered by Janne Grunau.<\/p>\n<p><strong>CVE:<\/strong><br \/>\nCVE-2016-7393<\/p>\n<p><strong>Timeline:<\/strong><br \/>\n2015-07-27: bug discovered<br \/>\n2015-07-28: bug reported privately to upstream<br \/>\n2016-08-20: blog post about the issue<br \/>\n2016-09-10: CVE sssigned<\/p>\n<p><strong>Note:<\/strong><br \/>\nThis bug was found with <a href=\"http:\/\/lcamtuf.coredump.cx\/afl\">American Fuzzy Lop<\/a>.<br \/>\nThis bug does not affect <a href=\"http:\/\/ffmpeg.org\/\">ffmpeg<\/a>.<br \/>\nA same fix, was applied to another part of (similar) code in the <a href=\"https:\/\/git.libav.org\/?p=libav.git;a=commit;h=09447f2b0fafac6d9565aab82a4c5f16fc99ee5e\">ac3_parser.c<\/a> file.<\/p>\n<p><strong>Permalink:<\/strong><\/p>\n<blockquote data-secret=\"zWbWzexGAB\" class=\"wp-embedded-content\"><p><a href=\"http:\/\/blogs.gentoo.org\/ago\/2016\/08\/20\/libav-stack-based-buffer-overflow-in-aac_sync-aac_parser-c\/\">libav: stack-based buffer overflow in aac_sync (aac_parser.c)<\/a><\/p><\/blockquote>\n<p><iframe class=\"wp-embedded-content\" sandbox=\"allow-scripts\" security=\"restricted\" style=\"position: absolute; clip: rect(1px, 1px, 1px, 1px);\" src=\"http:\/\/blogs.gentoo.org\/ago\/2016\/08\/20\/libav-stack-based-buffer-overflow-in-aac_sync-aac_parser-c\/embed\/#?secret=zWbWzexGAB\" data-secret=\"zWbWzexGAB\" width=\"600\" height=\"338\" title=\"&#8220;libav: stack-based buffer overflow in aac_sync (aac_parser.c)&#8221; &#8212; agostino&#039;s blog\" frameborder=\"0\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\"><\/iframe><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Description: Libav is an open source set of tools for audio and video processing. A crafted file causes a stack-based buffer overflow. The ASan report may be confused because it mentions get_bits, but the issue is in aac_sync. This issue &hellip; <a href=\"https:\/\/blogs.gentoo.org\/ago\/2016\/08\/20\/libav-stack-based-buffer-overflow-in-aac_sync-aac_parser-c\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":140,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true},"categories":[12,10],"tags":[],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p2EaBc-5w","_links":{"self":[{"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/posts\/342"}],"collection":[{"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/users\/140"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/comments?post=342"}],"version-history":[{"count":11,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/posts\/342\/revisions"}],"predecessor-version":[{"id":502,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/posts\/342\/revisions\/502"}],"wp:attachment":[{"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/media?parent=342"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/categories?post=342"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/tags?post=342"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}