{"id":970,"date":"2016-12-01T15:26:16","date_gmt":"2016-12-01T13:26:16","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=970"},"modified":"2017-01-16T14:02:29","modified_gmt":"2017-01-16T12:02:29","slug":"libav-multiple-crashes-from-the-undefined-behavior-sanitizer","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2016\/12\/01\/libav-multiple-crashes-from-the-undefined-behavior-sanitizer\/","title":{"rendered":"libav: multiple crashes from the Undefined Behavior Sanitizer"},"content":{"rendered":"

Description<\/strong>:
\nLibav<\/a> is an open source set of tools for audio and video processing.<\/p>\n

A fuzzing on an updated stable releases with the Undefined Behavior Sanitizer enabled, revealed multiple crashes. At the date I’m releasing this post, upstream didn’t give a response\/feedback about.<\/p>\n

All issues are reproducible with: <\/p>\n

avconv -i $FILE -f null -<\/font><\/pre>\n
More details about:<\/p>\n
Affected version \/ Tested on<\/strong>:
\n11.8
\nOutput\/failure<\/strong>:
\n\/tmp\/portage\/media-video\/libav-11.8\/work\/libav-11.8\/libavcodec\/mpegvideo.c:2381:65: runtime error: left shift of negative value -1
\n\/tmp\/portage\/media-video\/libav-11.8\/work\/libav-11.8\/libavcodec\/mpegvideo.c:2382:65: runtime error: left shift of negative value -1
\n\/tmp\/portage\/media-video\/libav-11.8\/work\/libav-11.8\/libavcodec\/mpegvideo.c:2383:65: runtime error: left shift of negative value -1
\nCommit fix<\/strong>:
\nN\/A
\nFixed version<\/strong>:
\nN\/A
\nTestcase<\/strong>:
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00036-libav-leftshift-mpegvideo<\/a>
\nCVE:<\/strong>
\nCVE-2016-9819<\/p>\n
######################################<\/p>\n
Affected version \/ Tested on<\/strong>:
\n11.8
\nOutput\/failure<\/strong>:
\n\/tmp\/portage\/media-video\/libav-11.8\/work\/libav-11.8\/libavcodec\/mpegvideo_motion.c:323:47: runtime error: left shift of negative value -1
\n\/tmp\/portage\/media-video\/libav-11.8\/work\/libav-11.8\/libavcodec\/mpegvideo_motion.c:331:55: runtime error: left shift of negative value -1
\n\/tmp\/portage\/media-video\/libav-11.8\/work\/libav-11.8\/libavcodec\/mpegvideo_motion.c:336:55: runtime error: left shift of negative value -1
\nCommit fix<\/strong>:
\nN\/A
\nFixed version<\/strong>:
\nN\/A
\nTestcase<\/strong>:
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00036-libav-leftshift-mpegvideo<\/a>
\nCVE:<\/strong>
\nCVE-2016-9820<\/p>\n
######################################<\/p>\n
Affected version \/ Tested on<\/strong>:
\n11.8
\nOutput\/failure<\/strong>:
\n\/tmp\/portage\/media-video\/libav-11.8\/work\/libav-11.8\/libavcodec\/mpegvideo_parser.c:91:65: runtime error: signed integer overflow: 28573696 * 400 cannot be represented in type ‘int’
\nCommit fix<\/strong>:
\nN\/A
\nFixed version<\/strong>:
\nN\/A
\nTestcase<\/strong>:
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00037-libav-signedintoverflow-mpegvideo_parser<\/a>
\nCVE:<\/strong>
\nCVE-2016-9821<\/p>\n
######################################<\/p>\n
Affected version \/ Tested on<\/strong>:
\n11.8
\nOutput\/failure<\/strong>:
\n\/tmp\/portage\/media-video\/libav-11.8\/work\/libav-11.8\/libavcodec\/mpeg12dec.c:1401:41: runtime error: signed integer overflow: 28573696 * 400 cannot be represented in type ‘int’
\nCommit fix<\/strong>:
\nN\/A
\nFixed version<\/strong>:
\nN\/A
\nTestcase<\/strong>:
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00037-libav-signedintoverflow-mpegvideo_parser<\/a>
\nCVE:<\/strong>
\nCVE-2016-9822<\/p>\n
######################################<\/p>\n
Affected version \/ Tested on<\/strong>:
\n11.8
\nOutput\/failure<\/strong>:
\n\/tmp\/portage\/media-video\/libav-11.8\/work\/libav-11.8\/libavcodec\/x86\/mpegvideo.c:53:18: runtime error: index -1 out of bounds for type ‘uint8_t [64]’
\nCommit fix<\/strong>:
\nN\/A
\nFixed version<\/strong>:
\nN\/A
\nTestcase<\/strong>:
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00038-libav-uint8_t64-outofbounds-mpegvideo<\/a>
\nCVE:<\/strong>
\nCVE-2016-9823<\/p>\n
######################################<\/p>\n
Affected version \/ Tested on<\/strong>:
\n11.8
\nOutput\/failure<\/strong>:
\n\/tmp\/portage\/media-video\/libav-11.8\/work\/libav-11.8\/libswscale\/x86\/swscale.c:189:64: runtime error: signed integer overflow: 65463 * 65537 cannot be represented in type ‘int’
\nCommit fix<\/strong>:
\nN\/A
\nFixed version<\/strong>:
\nN\/A
\nTestcase<\/strong>:
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00039-libav-signedintoverflow-swscale_c<\/a>
\nCVE:<\/strong>
\nCVE-2016-9824<\/p>\n
######################################<\/p>\n
Affected version \/ Tested on<\/strong>:
\n11.8
\nOutput\/failure<\/strong>:
\n\/tmp\/portage\/media-video\/libav-11.8\/work\/libav-11.8\/libswscale\/utils.c:340:30: runtime error: left shift of negative value -1
\nCommit fix<\/strong>:
\nN\/A
\nFixed version<\/strong>:
\nN\/A
\nTestcase<\/strong>:
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00040-libav-leftshift-utils_c<\/a>
\nCVE:<\/strong>
\nCVE-2016-9825<\/p>\n
######################################<\/p>\n
Affected version \/ Tested on<\/strong>:
\n11.8
\nOutput\/failure<\/strong>:
\n\/tmp\/portage\/media-video\/libav-11.8\/work\/libav-11.8\/libavcodec\/ituh263dec.c:645:34: runtime error: left shift of negative value -16
\nCommit fix<\/strong>:
\nN\/A
\nFixed version<\/strong>:
\nN\/A
\nTestcase<\/strong>:
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00041-libav-leftshift-ituh263dec_c<\/a>
\nCVE:<\/strong>
\nCVE-2016-9826<\/p>\n
######################################<\/p>\n
Affected version \/ Tested on<\/strong>:
\n11.8
\nOutput\/failure<\/strong>:
\n\/tmp\/portage\/media-video\/libav-11.8\/work\/libav-11.8\/libavcodec\/get_bits.h:530:5: runtime error: load of null pointer of type ‘int16_t’ (aka ‘short’)
\nCommit fix<\/strong>:
\nN\/A
\nFixed version<\/strong>:
\nN\/A
\nTestcase<\/strong>:
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00042-libav-loadnullptr-get_bits_h<\/a>
\nCVE:<\/strong>
\nCVE-2016-8676 (see https:\/\/blogs.gentoo.org\/ago\/2016\/09\/07\/libav-null-pointer-dereference-in-get_vlc2_get_bits_h<\/a><\/p>\n
Credit:<\/strong>
\nThese bugs were discovered by Agostino Sarubbo of Gentoo.<\/p>\n
Timeline:<\/strong>
\n2016-11-08: bug discovered and reported to upstream
\n2016-12-01: blog post about the issue
\n2016-12-05: CVE assigned<\/p>\n
Note:<\/strong>
\nThese bugs were found with American Fuzzy Lop<\/a>.<\/p>\n
Permalink:<\/strong><\/p>\n
libav: multiple crashes from the Undefined Behavior Sanitizer<\/a><\/p><\/blockquote>\n