Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

A heap-buffer-overflow has occurred when running program mp4info. #304

Open
swtkiwi opened this issue Jul 23, 2018 · 0 comments
Open

A heap-buffer-overflow has occurred when running program mp4info. #304

swtkiwi opened this issue Jul 23, 2018 · 0 comments
Assignees
@barbibulle
Labels
fuzzing

Comments

@swtkiwi
Copy link

swtkiwi commented Jul 23, 2018

A heap-buffer-overflow has occurred when running program mp4info.

=================================================================
==10135==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60400000defe at pc 0x0000005dca17 bp 0x7ffe1bd32e50 sp 0x7ffe1bd32e40
READ of size 1 at 0x60400000defe thread T0
    #0 0x5dca16 in AP4_AvccAtom::Create(unsigned int, AP4_ByteStream&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AvccAtom.cpp:88
    #1 0x5e5611 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:477
    #2 0x5eb917 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:220
    #3 0x4c65e8 in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #4 0x6a8d31 in AP4_SampleEntry::Read(AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4SampleEntry.cpp:115
    #5 0x6a8d31 in AP4_VisualSampleEntry::AP4_VisualSampleEntry(unsigned int, unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4SampleEntry.cpp:742
    #6 0x6a8d31 in AP4_AvcSampleEntry::AP4_AvcSampleEntry(unsigned int, unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4SampleEntry.cpp:994
    #7 0x5e56fc in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:305
    #8 0x5eb917 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:220
    #9 0x689025 in AP4_StsdAtom::AP4_StsdAtom(unsigned int, unsigned char, unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4StsdAtom.cpp:101
    #10 0x68af58 in AP4_StsdAtom::Create(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4StsdAtom.cpp:57
    #11 0x5e6e6e in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:422
    #12 0x5eb917 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:220
    #13 0x4c48cb in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #14 0x4c48cb in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #15 0x4c547e in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:88
    #16 0x5e6d2e in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:755
    #17 0x5eb917 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:220
    #18 0x4c48cb in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #19 0x4c48cb in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #20 0x4c547e in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:88
    #21 0x5e6d2e in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:755
    #22 0x5eb917 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:220
    #23 0x4c48cb in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #24 0x4c48cb in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #25 0x4c547e in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:88
    #26 0x5e6d2e in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:755
    #27 0x5eb917 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:220
    #28 0x4c48cb in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #29 0x4c48cb in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #30 0x5604e2 in AP4_TrakAtom::AP4_TrakAtom(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4TrakAtom.cpp:165
    #31 0x5e6a1b in AP4_TrakAtom::Create(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4TrakAtom.h:58
    #32 0x5e6a1b in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:377
    #33 0x5eb917 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:220
    #34 0x4c48cb in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #35 0x4c48cb in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #36 0x5aa11c in AP4_MoovAtom::AP4_MoovAtom(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4MoovAtom.cpp:80
    #37 0x5e732c in AP4_MoovAtom::Create(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4MoovAtom.h:56
    #38 0x5e732c in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:357
    #39 0x5eaac5 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:220
    #40 0x5eaac5 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, AP4_Atom*&) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:150
    #41 0x541abf in AP4_File::ParseStream(AP4_ByteStream&, AP4_AtomFactory&, bool) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4File.cpp:104
    #42 0x541abf in AP4_File::AP4_File(AP4_ByteStream&, bool) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4File.cpp:78
    #43 0x43fa16 in main /home/swt_fuzz/Bento4/Source/C++/Apps/Mp4Info/Mp4Info.cpp:1571
    #44 0x7f5135bea82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #45 0x446508 in _start (/home/swt_fuzz/Bento4/cmakebuild/mp4info+0x446508)

0x60400000defe is located 0 bytes to the right of 46-byte region [0x60400000ded0,0x60400000defe)
allocated by thread T0 here:
    #0 0x7f51365c56b2 in operator new[](unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x996b2)
    #1 0x538a56 in AP4_DataBuffer::AP4_DataBuffer(unsigned int) /home/swt_fuzz/Bento4/Source/C++/Core/Ap4DataBuffer.cpp:55
    #2 0x2d  (<unknown module>)

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/swt_fuzz/Bento4/Source/C++/Core/Ap4AvccAtom.cpp:88 AP4_AvccAtom::Create(unsigned int, AP4_ByteStream&)
Shadow bytes around the buggy address:
  0x0c087fff9b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff9b90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff9ba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff9bb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff9bc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c087fff9bd0: fa fa fa fa fa fa fa fa fa fa 00 00 00 00 00[06]
  0x0c087fff9be0: fa fa 00 00 00 00 00 00 fa fa fd fd fd fd fd fd
  0x0c087fff9bf0: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
  0x0c087fff9c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff9c10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff9c20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==10135==ABORTING

The testing program is mp4info.
And the input file has been put at:
https://github.com/fCorleone/fuzz_programs/blob/master/Bento4/test12.dms
@barbibulle barbibulle self-assigned this Aug 30, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@barbibulle barbibulle

Labels
fuzzing
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@barbibulle @swtkiwi