Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

A heap-buffer-overflow has occurred when running mp42ts. #299

Open
swtkiwi opened this issue Jul 23, 2018 · 0 comments
Open

A heap-buffer-overflow has occurred when running mp42ts. #299

swtkiwi opened this issue Jul 23, 2018 · 0 comments
Assignees
@barbibulle
Labels
fuzzing

Comments

@swtkiwi
Copy link

swtkiwi commented Jul 23, 2018

A heap-buffer-overflow has occurred when running mp42ts.

=================================================================
==10098==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000ef71 at pc 0x0000004f0fdd bp 0x7ffee6c6ed10 sp 0x7ffee6c6ed00
READ of size 1 at 0x60200000ef71 thread T0
    #0 0x4f0fdc in AP4_BytesToUInt16BE(unsigned char const*) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4Utils.h:113
    #1 0x4f0fdc in AP4_Stz2Atom::AP4_Stz2Atom(unsigned int, unsigned char, unsigned int, AP4_ByteStream&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4Stz2Atom.cpp:117
    #2 0x4f1522 in AP4_Stz2Atom::Create(unsigned int, AP4_ByteStream&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4Stz2Atom.cpp:52
    #3 0x4a72b1 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:447
    #4 0x4ae5d7 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:220
    #5 0x5830ab in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #6 0x5830ab in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #7 0x583c5e in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:88
    #8 0x4a99ee in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:755
    #9 0x4ae5d7 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:220
    #10 0x49cabf in AP4_DrefAtom::AP4_DrefAtom(unsigned int, unsigned char, unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4DrefAtom.cpp:84
    #11 0x49cfb4 in AP4_DrefAtom::Create(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4DrefAtom.cpp:50
    #12 0x4aa3d2 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:533
    #13 0x4ae5d7 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:220
    #14 0x5830ab in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #15 0x5830ab in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #16 0x583c5e in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:88
    #17 0x4a99ee in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:755
    #18 0x4ae5d7 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:220
    #19 0x5830ab in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #20 0x5830ab in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #21 0x4604c2 in AP4_TrakAtom::AP4_TrakAtom(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4TrakAtom.cpp:165
    #22 0x4a96db in AP4_TrakAtom::Create(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4TrakAtom.h:58
    #23 0x4a96db in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:377
    #24 0x4ae5d7 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:220
    #25 0x5830ab in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #26 0x5830ab in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #27 0x48bc2c in AP4_MoovAtom::AP4_MoovAtom(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4MoovAtom.cpp:80
    #28 0x4a9fec in AP4_MoovAtom::Create(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4MoovAtom.h:56
    #29 0x4a9fec in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:357
    #30 0x4ad785 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:220
    #31 0x4ad785 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:150
    #32 0x45a2af in AP4_File::ParseStream(AP4_ByteStream&, AP4_AtomFactory&, bool) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4File.cpp:104
    #33 0x45a2af in AP4_File::AP4_File(AP4_ByteStream&, bool) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4File.cpp:78
    #34 0x44086c in main /home/swt_fuzz/Bento4/Source/C++/Apps/Mp42Ts/Mp42Ts.cpp:499
    #35 0x7eff3d68e82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #36 0x446f08 in _start (/home/swt_fuzz/Bento4/cmakebuild/mp42ts+0x446f08)

0x60200000ef71 is located 0 bytes to the right of 1-byte region [0x60200000ef70,0x60200000ef71)
allocated by thread T0 here:
    #0 0x7eff3e0696b2 in operator new[](unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x996b2)
    #1 0x4ef49c in AP4_Stz2Atom::AP4_Stz2Atom(unsigned int, unsigned char, unsigned int, AP4_ByteStream&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4Stz2Atom.cpp:92
    #2 0x705ca9  (/home/swt_fuzz/Bento4/cmakebuild/mp42ts+0x705ca9)

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/swt_fuzz/Bento4/Source/C++/Core/Ap4Utils.h:113 AP4_BytesToUInt16BE(unsigned char const*)
Shadow bytes around the buggy address:
  0x0c047fff9d90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9da0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9db0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9dc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9dd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c047fff9de0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa[01]fa
  0x0c047fff9df0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9e20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9e30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==10098==ABORTING

The testing program is mp42ts.
And the input file has been put at:
https://github.com/fCorleone/fuzz_programs/blob/master/Bento4/test7.dms
@barbibulle barbibulle self-assigned this Aug 30, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@barbibulle barbibulle

Labels
fuzzing
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@barbibulle @swtkiwi