Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

A heap buffer flow has occurred when running mp4dump. #298

Open
swtkiwi opened this issue Jul 23, 2018 · 0 comments
Open

A heap buffer flow has occurred when running mp4dump. #298

swtkiwi opened this issue Jul 23, 2018 · 0 comments
Assignees
@barbibulle
Labels
fuzzing

Comments

@swtkiwi
Copy link

swtkiwi commented Jul 23, 2018

A heap buffer flow has occurred when running mp4dump.

=================================================================
==19001==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60300000ed2c at pc 0x00000059e426 bp 0x7fff8afcf260 sp 0x7fff8afcf250
READ of size 1 at 0x60300000ed2c thread T0
    #0 0x59e425 in AP4_AvccAtom::Create(unsigned int, AP4_ByteStream&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AvccAtom.cpp:88
    #1 0x45a23c in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:477
    #2 0x4563e9 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:220
    #3 0x54e023 in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #4 0x4825da in AP4_SampleEntry::Read(AP4_ByteStream&, AP4_AtomFactory&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4SampleEntry.cpp:115
    #5 0x48853b in AP4_VisualSampleEntry::AP4_VisualSampleEntry(unsigned int, unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4SampleEntry.cpp:742
    #6 0x48a646 in AP4_AvcSampleEntry::AP4_AvcSampleEntry(unsigned int, unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4SampleEntry.cpp:994
    #7 0x457687 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:305
    #8 0x4563e9 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:220
    #9 0x5311ca in AP4_StsdAtom::AP4_StsdAtom(unsigned int, unsigned char, unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4StsdAtom.cpp:101
    #10 0x5308c8 in AP4_StsdAtom::Create(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4StsdAtom.cpp:57
    #11 0x4598f5 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:422
    #12 0x4563e9 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:220
    #13 0x54e023 in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #14 0x54d776 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #15 0x54d05b in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:88
    #16 0x45c603 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:755
    #17 0x4563e9 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:220
    #18 0x54e023 in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #19 0x54d776 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #20 0x54d05b in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:88
    #21 0x45c603 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:755
    #22 0x4563e9 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:220
    #23 0x54e023 in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #24 0x54d776 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #25 0x54d05b in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:88
    #26 0x45c603 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:755
    #27 0x4563e9 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:220
    #28 0x54e023 in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #29 0x54d776 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #30 0x4fc7ca in AP4_TrakAtom::AP4_TrakAtom(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4TrakAtom.cpp:165
    #31 0x45e3ef in AP4_TrakAtom::Create(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4TrakAtom.h:58
    #32 0x459238 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:377
    #33 0x4563e9 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:220
    #34 0x54e023 in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #35 0x54d776 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #36 0x510645 in AP4_MoovAtom::AP4_MoovAtom(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4MoovAtom.cpp:80
    #37 0x45e31f in AP4_MoovAtom::Create(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4MoovAtom.h:56
    #38 0x458ee4 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:357
    #39 0x4563e9 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:220
    #40 0x4557cb in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:150
    #41 0x452bb0 in main /home/mfc_fuzz/Bento4/Source/C++/Apps/Mp4Dump/Mp4Dump.cpp:342
    #42 0x7f828459e82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #43 0x450938 in _start (/home/sandy/swt_fuzz/Bento4/cmakebuild/mp4dump+0x450938)

0x60300000ed2c is located 0 bytes to the right of 28-byte region [0x60300000ed10,0x60300000ed2c)
allocated by thread T0 here:
    #0 0x7f8284f796b2 in operator new[](unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x996b2)
    #1 0x52a4fe in AP4_DataBuffer::AP4_DataBuffer(unsigned int) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4DataBuffer.cpp:55
    #2 0x59e0ed in AP4_AvccAtom::Create(unsigned int, AP4_ByteStream&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AvccAtom.cpp:69
    #3 0x45a23c in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:477
    #4 0x4563e9 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:220
    #5 0x54e023 in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #6 0x4825da in AP4_SampleEntry::Read(AP4_ByteStream&, AP4_AtomFactory&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4SampleEntry.cpp:115
    #7 0x48853b in AP4_VisualSampleEntry::AP4_VisualSampleEntry(unsigned int, unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4SampleEntry.cpp:742
    #8 0x48a646 in AP4_AvcSampleEntry::AP4_AvcSampleEntry(unsigned int, unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4SampleEntry.cpp:994
    #9 0x457687 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:305
    #10 0x4563e9 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:220
    #11 0x5311ca in AP4_StsdAtom::AP4_StsdAtom(unsigned int, unsigned char, unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4StsdAtom.cpp:101
    #12 0x5308c8 in AP4_StsdAtom::Create(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4StsdAtom.cpp:57
    #13 0x4598f5 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:422
    #14 0x4563e9 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:220
    #15 0x54e023 in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #16 0x54d776 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #17 0x54d05b in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:88
    #18 0x45c603 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:755
    #19 0x4563e9 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:220
    #20 0x54e023 in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #21 0x54d776 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #22 0x54d05b in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:88
    #23 0x45c603 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:755
    #24 0x4563e9 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:220
    #25 0x54e023 in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #26 0x54d776 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #27 0x54d05b in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:88
    #28 0x45c603 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:755
    #29 0x4563e9 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:220

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/mfc_fuzz/Bento4/Source/C++/Core/Ap4AvccAtom.cpp:88 AP4_AvccAtom::Create(unsigned int, AP4_ByteStream&)
Shadow bytes around the buggy address:
  0x0c067fff9d50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff9d60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff9d70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff9d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff9d90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c067fff9da0: fa fa 00 00 00[04]fa fa 00 00 00 fa fa fa 00 00
  0x0c067fff9db0: 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa
  0x0c067fff9dc0: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa
  0x0c067fff9dd0: fa fa 00 00 00 04 fa fa 00 00 00 fa fa fa 00 00
  0x0c067fff9de0: 00 fa fa fa 00 00 00 fa fa fa 00 00 00 00 fa fa
  0x0c067fff9df0: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==19001==ABORTING

The testing program is mp4dump.
And the input file has been put at:
https://github.com/fCorleone/fuzz_programs/blob/master/Bento4/test6
@barbibulle barbibulle self-assigned this Aug 30, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@barbibulle barbibulle

Labels
fuzzing
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@barbibulle @swtkiwi