Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Integer overflow at Source/C++/Core/Ap4CttsAtom.cpp:80 and buffer overflow at Source/C++/Core/Ap4CttsAtom.cpp:89 #390

Open
lvtao-sec opened this issue Apr 26, 2019 · 0 comments

Comments

@lvtao-sec
Copy link

cmd: mp42hls $poc
poc can download here
version: master head
vuln type: integer and buffer overflow

There is an integer overflow at Source/C++/Core/Ap4CttsAtom.cpp:80 , which then causes an buffer overflow read bugs at Source/C++/Core/Ap4CttsAtom.cpp:89.

//buggy code integer overflow
//entry_count can be 0x8000000a when debug, then 0x8000000a*8=0x400000050
//however entry_count is an unsigned int, so the multify result will be 0x50
unsigned char* buffer = new unsigned char[entry_count*8];

//buggy code buffer overflow read, when it read buffer more than 0x50, a buffer overflow read exception will throw by asan.
    for (unsigned i=0; i<entry_count; i++) {
        m_Entries[i].m_SampleCount  = AP4_BytesToUInt32BE(&buffer[i*8  ]);
        AP4_UI32 offset             = AP4_BytesToUInt32BE(&buffer[i*8+4]);
        //if (offset & 0x80000000) {
        //    use_quicktime_format = true;
        //    AP4_SI32 noffset = (AP4_SI32)offset;
        //    if (noffset < quicktime_min_offset) quicktime_min_offset = noffset;
        //}
        m_Entries[i].m_SampleOffset = offset;
    }

The following is the debug process.
Integer overflow:

──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── source:/home/lt/vuln-f[...].cpp+80 ────
     75      m_LookupCache.entry_index = 0;
     76
     77      AP4_UI32 entry_count;
     78      stream.ReadUI32(entry_count);
     79      m_Entries.SetItemCount(entry_count);
             // buffer=0x00007fffffffc4e8  →  [...]  →  <AP4_StdcFileByteStream::~AP4_StdcFileByteStream()+0> push rbp
 →   80      unsigned char* buffer = new unsigned char[entry_count*8];
     81      AP4_Result result = stream.Read(buffer, entry_count*8);
     82      if (AP4_FAILED(result)) {
     83          delete[] buffer;
     84          return;
     85      }
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── threads ────
[#0] Id 1, Name: "mp42hls", stopped, reason: BREAKPOINT
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── trace ────
[#0] 0x490fc8 → AP4_CttsAtom::AP4_CttsAtom(this=0x60700000dc30, size=0x60, version=0x0, flags=0x0, stream=@0x60400000dfd0)
[#1] 0x490c5a → AP4_CttsAtom::Create(size=0x60, stream=@0x60400000dfd0)
[#2] 0x48ccc3 → AP4_AtomFactory::CreateAtomFromStream(this=0x7fffffffe180, stream=@0x60400000dfd0, type=0x63747473, size_32=0x60, size_64=0x60, atom=@0x7fffffffc990)
[#3] 0x48b20f → AP4_AtomFactory::CreateAtomFromStream(this=0x7fffffffe180, stream=@0x60400000dfd0, bytes_available=@0x7fffffffc9d0, atom=@0x7fffffffc990)
[#4] 0x51319c → AP4_ContainerAtom::ReadChildren(this=0x60700000dd10, atom_factory=@0x7fffffffe180, stream=@0x60400000dfd0, size=0x1c2)
[#5] 0x512c51 → AP4_ContainerAtom::AP4_ContainerAtom(this=0x60700000dd10, type=0x7374626c, size=0x1ca, force_64=0x0, stream=@0x60400000dfd0, atom_factory=@0x7fffffffe180)
[#6] 0x5127de → AP4_ContainerAtom::Create(type=0x7374626c, size=0x1ca, is_full=0x0, force_64=0x0, stream=@0x60400000dfd0, atom_factory=@0x7fffffffe180)
[#7] 0x48e257 → AP4_AtomFactory::CreateAtomFromStream(this=0x7fffffffe180, stream=@0x60400000dfd0, type=0x7374626c, size_32=0x1ca, size_64=0x1ca, atom=@0x7fffffffcf40)
[#8] 0x48b20f → AP4_AtomFactory::CreateAtomFromStream(this=0x7fffffffe180, stream=@0x60400000dfd0, bytes_available=@0x7fffffffcf80, atom=@0x7fffffffcf40)
[#9] 0x51319c → AP4_ContainerAtom::ReadChildren(this=0x60700000de60, atom_factory=@0x7fffffffe180, stream=@0x60400000dfd0, size=0x202)
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
gef➤  p entry_count
$7 = 0x8000000a
gef➤  p entry_count * 8
$8 = 0x50
gef➤

Buffer overflow crash

==10519==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60700000dc10 at pc 0x000000460f40 bp 0x7fffffffc480 sp 0x7fffffffc470
READ of size 1 at 0x60700000dc10 thread T0
    #0 0x460f3f in AP4_BytesToUInt32BE(unsigned char const*) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4Utils.h:78
    #1 0x49108a in AP4_CttsAtom::AP4_CttsAtom(unsigned int, unsigned char, unsigned int, AP4_ByteStream&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4CttsAtom.cpp:89
    #2 0x490c59 in AP4_CttsAtom::Create(unsigned int, AP4_ByteStream&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4CttsAtom.cpp:52
    #3 0x48ccc2 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:470
    #4 0x48b20e in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:232
    #5 0x51319b in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #6 0x512c50 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #7 0x5127dd in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:88
    #8 0x48e256 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:775
    #9 0x48b20e in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:232
    #10 0x51319b in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #11 0x512c50 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #12 0x5127dd in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:88
    #13 0x48e256 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:775
    #14 0x48b20e in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:232
    #15 0x51319b in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #16 0x512c50 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #17 0x5127dd in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:88
    #18 0x48e256 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:775
    #19 0x48b20e in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:232
    #20 0x51319b in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #21 0x512c50 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #22 0x530a80 in AP4_TrakAtom::AP4_TrakAtom(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4TrakAtom.cpp:165
    #23 0x48eea1 in AP4_TrakAtom::Create(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4TrakAtom.h:58
    #24 0x48c6bb in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:390
    #25 0x48b20e in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:232
    #26 0x48aabd in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, AP4_Atom*&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:152
    #27 0x4c9031 in AP4_File::ParseStream(AP4_ByteStream&, AP4_AtomFactory&, bool) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4File.cpp:105
    #28 0x4c8c96 in AP4_File::AP4_File(AP4_ByteStream&, bool) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4File.cpp:78
    #29 0x45eebd in main /home/lt/vuln-fuzz/program/Bento4/Source/C++/Apps/Mp42Hls/Mp42Hls.cpp:1846
    #30 0x7ffff652882f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #31 0x4549e8 in _start (/home/lt/vuln-fuzz/program/Bento4/asan-build/mp42hls+0x4549e8)

0x60700000dc10 is located 0 bytes to the right of 80-byte region [0x60700000dbc0,0x60700000dc10)
allocated by thread T0 here:
    #0 0x7ffff6f036b2 in operator new[](unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x996b2)
    #1 0x490fd8 in AP4_CttsAtom::AP4_CttsAtom(unsigned int, unsigned char, unsigned int, AP4_ByteStream&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4CttsAtom.cpp:80
    #2 0x490c59 in AP4_CttsAtom::Create(unsigned int, AP4_ByteStream&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4CttsAtom.cpp:52
    #3 0x48ccc2 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:470
    #4 0x48b20e in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:232
    #5 0x51319b in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #6 0x512c50 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #7 0x5127dd in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:88
    #8 0x48e256 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:775
    #9 0x48b20e in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:232
    #10 0x51319b in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #11 0x512c50 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #12 0x5127dd in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:88
    #13 0x48e256 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:775
    #14 0x48b20e in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:232
    #15 0x51319b in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #16 0x512c50 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #17 0x5127dd in AP4_ContainerAtom::Create(unsigned int, unsigned long long, bool, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:88
    #18 0x48e256 in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:775
    #19 0x48b20e in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:232
    #20 0x51319b in AP4_ContainerAtom::ReadChildren(AP4_AtomFactory&, AP4_ByteStream&, unsigned long long) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:194
    #21 0x512c50 in AP4_ContainerAtom::AP4_ContainerAtom(unsigned int, unsigned long long, bool, AP4_ByteStream&, AP4_AtomFactory&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4ContainerAtom.cpp:139
    #22 0x530a80 in AP4_TrakAtom::AP4_TrakAtom(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4TrakAtom.cpp:165
    #23 0x48eea1 in AP4_TrakAtom::Create(unsigned int, AP4_ByteStream&, AP4_AtomFactory&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4TrakAtom.h:58
    #24 0x48c6bb in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned int, unsigned int, unsigned long long, AP4_Atom*&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:390
    #25 0x48b20e in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, unsigned long long&, AP4_Atom*&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:232
    #26 0x48aabd in AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream&, AP4_Atom*&) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4AtomFactory.cpp:152
    #27 0x4c9031 in AP4_File::ParseStream(AP4_ByteStream&, AP4_AtomFactory&, bool) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4File.cpp:105
    #28 0x4c8c96 in AP4_File::AP4_File(AP4_ByteStream&, bool) /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4File.cpp:78
    #29 0x45eebd in main /home/lt/vuln-fuzz/program/Bento4/Source/C++/Apps/Mp42Hls/Mp42Hls.cpp:1846

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/lt/vuln-fuzz/program/Bento4/Source/C++/Core/Ap4Utils.h:78 AP4_BytesToUInt32BE(unsigned char const*)
Shadow bytes around the buggy address:
  0x0c0e7fff9b30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0e7fff9b40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0e7fff9b50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0e7fff9b60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0e7fff9b70: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
=>0x0c0e7fff9b80: 00 00[fa]fa fa fa 00 00 00 00 00 00 00 00 00 fa
  0x0c0e7fff9b90: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 fa fa
  0x0c0e7fff9ba0: fa fa 00 00 00 00 00 00 00 00 00 00 fa fa fa fa
  0x0c0e7fff9bb0: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa 00 00
  0x0c0e7fff9bc0: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00
  0x0c0e7fff9bd0: 00 00 00 00 00 00 fa fa fa fa 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==10519==ABORTING
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant