{"id":556,"date":"2016-09-17T00:08:52","date_gmt":"2016-09-16T22:08:52","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=556"},"modified":"2016-10-08T21:11:34","modified_gmt":"2016-10-08T19:11:34","slug":"libav-null-pointer-dereference-in-put_no_rnd_pixels8_xy2_mmx-rnd_template-c","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2016\/09\/17\/libav-null-pointer-dereference-in-put_no_rnd_pixels8_xy2_mmx-rnd_template-c\/","title":{"rendered":"libav: invalid memory access in put_no_rnd_pixels8_xy2_mmx (rnd_template.c)"},"content":{"rendered":"

Description<\/strong>:
\nLibav<\/a> is an open source set of tools for audio and video processing.<\/p>\n

A fuzzing with an mp3 file as input discovered an invalid memory access in put_no_rnd_pixels8_xy2_mmx.<\/p>\n

The complete ASan output:<\/p>\n

# avconv -i $FILE -f null -\r\navconv version 11.7, Copyright (c) 2000-2016 the Libav developers\r\n  built on Aug 16 2016 15:34:42 with clang version 3.8.1 (tags\/RELEASE_381\/final)\r\n[h263 @ 0x61a00001f280] Format detected only with low score of 25, misdetection possible!\r\n[IMGUTILS @ 0x7ff589955420] Picture size 0x0 is invalid\r\n[h263 @ 0x619000000580] header damaged\r\n[h263 @ 0x619000000580] Syntax-based Arithmetic Coding (SAC) not supported\r\n[h263 @ 0x619000000580] Independent Segment Decoding not supported\r\n[h263 @ 0x619000000580] warning: first frame is no keyframe\r\n[h263 @ 0x619000000580] cbpc damaged at 0 0\r\n[h263 @ 0x619000000580] Error at MB: 0\r\n[h263 @ 0x619000000580] concealing 1584 DC, 1584 AC, 1584 MV errors\r\n[h263 @ 0x61a00001f280] Estimating duration from bitrate, this may be inaccurate\r\nInput #0, h263, from '9.crashes':\r\n  Duration: N\/A, bitrate: N\/A\r\n    Stream #0.0: Video: h263, yuv420p, 704x576 [PAR 12:11 DAR 4:3], 25 fps, 25 tbn, 18.73 tbc\r\nOutput #0, null, to 'pipe:':\r\n  Metadata:\r\n    encoder         : Lavf56.1.0\r\n    Stream #0.0: Video: rawvideo, yuv420p, 704x576 [PAR 12:11 DAR 4:3], q=2-31, 200 kb\/s, 25 tbn, 25 tbc\r\n    Metadata:\r\n      encoder         : Lavc56.1.0 rawvideo\r\nStream mapping:\r\n  Stream #0:0 -> #0:0 (h263 (native) -> rawvideo (native))\r\nPress ctrl-c to stop encoding\r\n[h263 @ 0x61900001ea80] warning: first frame is no keyframe\r\nASAN:DEADLYSIGNAL\r\n=================================================================\r\n==26790==ERROR: AddressSanitizer: SEGV on unknown address 0x7ff584ddb77f (pc 0x7ff5910cdeee bp 0x7ffdc464d7f0 sp 0x7ffdc464d780 T0)\r\n    #0 0x7ff5910cdeed in put_no_rnd_pixels8_xy2_mmx \/var\/tmp\/portage\/media-video\/libav-11.7\/work\/libav-11.7\/libavcodec\/x86\/rnd_template.c:37:5\r\n    #1 0x7ff590209de0 in hpel_motion \/var\/tmp\/portage\/media-video\/libav-11.7\/work\/libav-11.7\/libavcodec\/mpegvideo_motion.c:224:5\r\n    #2 0x7ff590209de0 in apply_8x8 \/var\/tmp\/portage\/media-video\/libav-11.7\/work\/libav-11.7\/libavcodec\/mpegvideo_motion.c:798\r\n    #3 0x7ff590209de0 in mpv_motion_internal \/var\/tmp\/portage\/media-video\/libav-11.7\/work\/libav-11.7\/libavcodec\/mpegvideo_motion.c:877\r\n    #4 0x7ff590209de0 in ff_mpv_motion \/var\/tmp\/portage\/media-video\/libav-11.7\/work\/libav-11.7\/libavcodec\/mpegvideo_motion.c:981\r\n    #5 0x7ff59013659b in mpv_decode_mb_internal \/var\/tmp\/portage\/media-video\/libav-11.7\/work\/libav-11.7\/libavcodec\/mpegvideo.c:2223:21\r\n    #6 0x7ff59013659b in ff_mpv_decode_mb \/var\/tmp\/portage\/media-video\/libav-11.7\/work\/libav-11.7\/libavcodec\/mpegvideo.c:2358\r\n    #7 0x7ff58f048c95 in decode_slice \/var\/tmp\/portage\/media-video\/libav-11.7\/work\/libav-11.7\/libavcodec\/h263dec.c:273:13\r\n    #8 0x7ff58f0442cd in ff_h263_decode_frame \/var\/tmp\/portage\/media-video\/libav-11.7\/work\/libav-11.7\/libavcodec\/h263dec.c:575:11\r\n    #9 0x7ff5909cf906 in avcodec_decode_video2 \/var\/tmp\/portage\/media-video\/libav-11.7\/work\/libav-11.7\/libavcodec\/utils.c:1600:19\r\n    #10 0x5647eb in decode_video \/var\/tmp\/portage\/media-video\/libav-11.7\/work\/libav-11.7\/avconv.c:1259:11\r\n    #11 0x5647eb in process_input_packet \/var\/tmp\/portage\/media-video\/libav-11.7\/work\/libav-11.7\/avconv.c:1398\r\n    #12 0x550e63 in process_input \/var\/tmp\/portage\/media-video\/libav-11.7\/work\/libav-11.7\/avconv.c:2440:11\r\n    #13 0x550e63 in transcode \/var\/tmp\/portage\/media-video\/libav-11.7\/work\/libav-11.7\/avconv.c:2488\r\n    #14 0x550e63 in main \/var\/tmp\/portage\/media-video\/libav-11.7\/work\/libav-11.7\/avconv.c:2647\r\n    #15 0x7ff58cd6461f in __libc_start_main \/var\/tmp\/portage\/sys-libs\/glibc-2.22-r4\/work\/glibc-2.22\/csu\/libc-start.c:289\r\n    #16 0x41d098 in _init (\/usr\/bin\/avconv+0x41d098)\r\n\r\nAddressSanitizer can not provide additional info.\r\nSUMMARY: AddressSanitizer: SEGV \/var\/tmp\/portage\/media-video\/libav-11.7\/work\/libav-11.7\/libavcodec\/x86\/rnd_template.c:37:5 in put_no_rnd_pixels8_xy2_mmx\r\n==26790==ABORTING\r\n<\/font><\/pre>\n
Affected version:<\/strong>
\n11.7<\/p>\n
Fixed version:<\/strong>
\nN\/A<\/p>\n
Commit fix:<\/strong>
\nhttps:\/\/git.libav.org\/?p=libav.git;a=commit;h=136f55207521f0b03194ef5b55ba70f1635d6aee<\/a><\/p>\n
Credit:<\/strong>
\nThis bug was discovered by Agostino Sarubbo of Gentoo.<\/p>\n
CVE:<\/strong>
\nCVE-2016-7424<\/p>\n
Timeline:<\/strong>
\n2016-08-15: bug discovered
\n2016-08-16: bug reported to upstream
\n2016-09-16: upstream released a patch
\n2016-09-17: blog post about the issue
\n2016-09-17: CVE Assigned<\/p>\n
Note:<\/strong>
\nThis bug was found with American Fuzzy Lop<\/a>.
\nThis bug was reported F4B3CD@STARLAB on 2016-09-12 via libav-security while it was already public since
\n2016-08-15 on the upstream bugtracker.
\nAfter an investigation it looks like an invalid memory access (read), so I’m changing a bit the description but I’m keeping the permalink as-is.<\/p>\n
Permalink:<\/strong><\/p>\n
libav: invalid memory access in put_no_rnd_pixels8_xy2_mmx (rnd_template.c)<\/a><\/p><\/blockquote>\n