Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Invalid free in gf_sg_command_del() #1980

Closed
3 tasks done
AiDaiP opened this issue Dec 11, 2021 · 0 comments
Closed
3 tasks done

Invalid free in gf_sg_command_del() #1980

AiDaiP opened this issue Dec 11, 2021 · 0 comments

Comments

@AiDaiP
Copy link

AiDaiP commented Dec 11, 2021

Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/

An invalid free was discovered in gf_sg_command_del(). The vulnerability causes a segmentation fault and application crash.

Version:

MP4Box - GPAC version 1.1.0-DEV-revUNKNOWN_REV
(c) 2000-2021 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
        GPAC Filters: https://doi.org/10.1145/3339825.3394929
        GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration:
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_JPEG GPAC_HAS_PNG GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D

System information
Ubuntu 20.04 focal, AMD EPYC 7742 64-Core @ 16x 2.25GHz

command:

./MP4Box -bt ./poc/poc_17

poc_17.zip

Result

[iso file] extra box maxr found in hinf, deleting
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type 80rak in parent moov
[iso file] Unknown box type prl  in parent dref
[iso file] Incomplete box mdat - start 11495 size 860323
[iso file] Incomplete file while reading for dump - aborting parsing
[iso file] extra box maxr found in hinf, deleting
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type 80rak in parent moov
[iso file] Unknown box type prl  in parent dref
[iso file] Incomplete box mdat - start 11495 size 860323
[iso file] Incomplete file while reading for dump - aborting parsing
MPEG-4 LASeR Scene Parsing
[LASeR] memory overread - corrupted decoding
[LASeR] memory overread - corrupted decoding
[MP4 Loading] decoding sample 1 from track ID 8 failed
free(): invalid pointer
[1]    3334251 abort      ./MP4Box -bt ./poc/poc_17

gdb

free(): invalid pointer

Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50      ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
───────────────────────────────[ REGISTERS ]────────────────────────────────
 RAX  0x0
 RBX  0x7ffff72bf040 ◂— 0x7ffff72bf040
 RCX  0x7ffff758218b (raise+203) ◂— mov    rax, qword ptr [rsp + 0x108]
 RDX  0x0
 RDI  0x2
 RSI  0x7fffffff6f20 ◂— 0x0
 R8   0x0
 R9   0x7fffffff6f20 ◂— 0x0
 R10  0x8
 R11  0x246
 R12  0x7fffffff7190 ◂— 0x0
 R13  0x10
 R14  0x7ffff7ffb000 ◂— 0x6565726600001000
 R15  0x1
 RBP  0x7fffffff7270 —▸ 0x5555555df1e0 —▸ 0x5555555d4370 ◂— 0x0
 RSP  0x7fffffff6f20 ◂— 0x0
 RIP  0x7ffff758218b (raise+203) ◂— mov    rax, qword ptr [rsp + 0x108]
───────────────────────────────────────[ DISASM ]────────────────────────────────────────
 ► 0x7ffff758218b <raise+203>    mov    rax, qword ptr [rsp + 0x108]
   0x7ffff7582193 <raise+211>    xor    rax, qword ptr fs:[0x28]
   0x7ffff758219c <raise+220>    jne    raise+260                <raise+260>
    ↓
   0x7ffff75821c4 <raise+260>    call   __stack_chk_fail                <__stack_chk_fail>

   0x7ffff75821c9                nop    dword ptr [rax]
   0x7ffff75821d0 <killpg>       endbr64
   0x7ffff75821d4 <killpg+4>     test   edi, edi
   0x7ffff75821d6 <killpg+6>     js     killpg+16                <killpg+16>

   0x7ffff75821d8 <killpg+8>     neg    edi
   0x7ffff75821da <killpg+10>    jmp    kill                <kill>

   0x7ffff75821df <killpg+15>    nop
────────────────────────────────────────[ STACK ]────────────────────────────────────────
00:0000│ rsi r9 rsp 0x7fffffff6f20 ◂— 0x0
01:0008│            0x7fffffff6f28 —▸ 0x7ffff77534c8 ◂— 0xe001200003748 /* 'H7' */
02:0010│            0x7fffffff6f30 —▸ 0x7fffffff72f0 —▸ 0x5555555d47a0 —▸ 0x5555555d4370 ◂— 0x0
03:0018│            0x7fffffff6f38 —▸ 0x7ffff7fe7c2e ◂— mov    r11, rax
04:0020│            0x7fffffff6f40 ◂— 0x0
05:0028│            0x7fffffff6f48 ◂— 0x0
06:0030│            0x7fffffff6f50 —▸ 0x5555555df390 —▸ 0x5555555df3f0 —▸ 0x5555555df0f0 ◂— 0x0
07:0038│            0x7fffffff6f58 ◂— 0x0
──────────────────────────────────────[ BACKTRACE ]──────────────────────────────────────
 ► f 0   0x7ffff758218b raise+203
   f 1   0x7ffff7561859 abort+299
   f 2   0x7ffff75cc3ee __libc_message+670
   f 3   0x7ffff75d447c
   f 4   0x7ffff75d5cac _int_free+748
   f 5   0x7ffff784f461 gf_sg_command_del+353
   f 6   0x7ffff7a88203 gf_sm_del+195
   f 7   0x555555584423 dump_isom_scene+627
─────────────────────────────────────────────────────────────────────────────────────────

break gf_svg_delete_attribute_value

pwndbg>
0x00007ffff784f45c in gf_sg_command_del () from /root/fuckit/test/gpac1210/bin/gcc/libgpac.so.10
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
───────────────────────────────[ REGISTERS ]────────────────────────────────
 RAX  0x0
 RBX  0x0
 RCX  0x5555555df310 ◂— 0x0
*RDX  0x5555555d4370 ◂— 0x0
 RDI  0x0
 RSI  0x5555555df300 ◂— 0x0
 R8   0x2
 R9   0xfffffff6
 R10  0x7ffff775ba72 ◂— 'gf_node_unregister_children'
 R11  0x7ffff784a6d0 (gf_node_unregister_children) ◂— endbr64
 R12  0x5555555df2e0 ◂— 0x0
 R13  0x5555555d47a0 —▸ 0x5555555d4370 ◂— 0x0
 R14  0x5555555d4370 ◂— 0x0
 R15  0x0
 RBP  0x5555555df1e0 —▸ 0x5555555d4370 ◂— 0x0
 RSP  0x7fffffff7310 ◂— 0x1
*RIP  0x7ffff784f45c (gf_sg_command_del+348) ◂— call   0x7ffff78c7fb0
───────────────────────────────────────[ DISASM ]────────────────────────────────────────
   0x7ffff784f449 <gf_sg_command_del+329>    mov    rsi, qword ptr [r12 + 8]
   0x7ffff784f44e <gf_sg_command_del+334>    test   rsi, rsi
   0x7ffff784f451 <gf_sg_command_del+337>    je     gf_sg_command_del+255
<gf_sg_command_del+255>

   0x7ffff784f453 <gf_sg_command_del+339>    mov    edi, dword ptr [r12 + 4]
   0x7ffff784f458 <gf_sg_command_del+344>    mov    rdx, qword ptr [rbp]
 ► 0x7ffff784f45c <gf_sg_command_del+348>    call   gf_svg_delete_attribute_value                <gf_svg_delete_attribute_value>
        rdi: 0x0
        rsi: 0x5555555df300 ◂— 0x0
        rdx: 0x5555555d4370 ◂— 0x0
        rcx: 0x5555555df310 ◂— 0x0

   0x7ffff784f461 <gf_sg_command_del+353>    jmp    gf_sg_command_del+255
<gf_sg_command_del+255>

   0x7ffff784f463 <gf_sg_command_del+355>    nop    dword ptr [rax + rax]
   0x7ffff784f468 <gf_sg_command_del+360>    mov    rdi, qword ptr [r12 + 8]
   0x7ffff784f46d <gf_sg_command_del+365>    test   rdi, rdi
   0x7ffff784f470 <gf_sg_command_del+368>    je     gf_sg_command_del+384
<gf_sg_command_del+384>
────────────────────────────────────────[ STACK ]────────────────────────────────────────
00:0000│ rsp 0x7fffffff7310 ◂— 0x1
01:0008│     0x7fffffff7318 ◂— 0x5cf4ff747866de00
02:0010│     0x7fffffff7320 —▸ 0x7fffffff7340 —▸ 0x5555555df1e0 —▸ 0x5555555d4370 ◂— 0x0
03:0018│     0x7fffffff7328 —▸ 0x5555555defe0 ◂— 0x8
04:0020│     0x7fffffff7330 —▸ 0x5555555df130 ◂— 0x0
05:0028│     0x7fffffff7338 —▸ 0x7ffff7a88203 (gf_sm_del+195) ◂— jmp    0x7ffff7a881c8
06:0030│     0x7fffffff7340 —▸ 0x5555555df1e0 —▸ 0x5555555d4370 ◂— 0x0
07:0038│     0x7fffffff7348 ◂— 0x5cf4ff747866de00
──────────────────────────────────────[ BACKTRACE ]──────────────────────────────────────
 ► f 0   0x7ffff784f45c gf_sg_command_del+348
   f 1   0x7ffff7a88203 gf_sm_del+195
   f 2   0x555555584423 dump_isom_scene+627
   f 3   0x55555557b42c mp4boxMain+9228
   f 4   0x7ffff75630b3 __libc_start_main+243
─────────────────────────────────────────────────────────────────────────────────────────
pwndbg>
free(): invalid pointer

Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50      ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
───────────────────────────────[ REGISTERS ]────────────────────────────────
 RAX  0x0
*RBX  0x7ffff72bf040 ◂— 0x7ffff72bf040
*RCX  0x7ffff758218b (raise+203) ◂— mov    rax, qword ptr [rsp + 0x108]
*RDX  0x0
*RDI  0x2
*RSI  0x7fffffff6f20 ◂— 0x0
*R8   0x0
*R9   0x7fffffff6f20 ◂— 0x0
*R10  0x8
*R11  0x246
*R12  0x7fffffff7190 ◂— 0x0
*R13  0x10
*R14  0x7ffff7ffb000 ◂— 0x6565726600001000
*R15  0x1
*RBP  0x7fffffff7270 —▸ 0x5555555df1e0 —▸ 0x5555555d4370 ◂— 0x0
*RSP  0x7fffffff6f20 ◂— 0x0
*RIP  0x7ffff758218b (raise+203) ◂— mov    rax, qword ptr [rsp + 0x108]
───────────────────────────────────────[ DISASM ]────────────────────────────────────────
 ► 0x7ffff758218b <raise+203>    mov    rax, qword ptr [rsp + 0x108]
   0x7ffff7582193 <raise+211>    xor    rax, qword ptr fs:[0x28]
   0x7ffff758219c <raise+220>    jne    raise+260                <raise+260>
    ↓
   0x7ffff75821c4 <raise+260>    call   __stack_chk_fail                <__stack_chk_fail>

   0x7ffff75821c9                nop    dword ptr [rax]
   0x7ffff75821d0 <killpg>       endbr64
   0x7ffff75821d4 <killpg+4>     test   edi, edi
   0x7ffff75821d6 <killpg+6>     js     killpg+16                <killpg+16>

   0x7ffff75821d8 <killpg+8>     neg    edi
   0x7ffff75821da <killpg+10>    jmp    kill                <kill>

   0x7ffff75821df <killpg+15>    nop
────────────────────────────────────────[ STACK ]────────────────────────────────────────
00:0000│ rsi r9 rsp 0x7fffffff6f20 ◂— 0x0
01:0008│            0x7fffffff6f28 —▸ 0x7ffff77534c8 ◂— 0xe001200003748 /* 'H7' */
02:0010│            0x7fffffff6f30 —▸ 0x7fffffff72f0 —▸ 0x5555555d47a0 —▸ 0x5555555d4370 ◂— 0x0
03:0018│            0x7fffffff6f38 —▸ 0x7ffff7fe7c2e ◂— mov    r11, rax
04:0020│            0x7fffffff6f40 ◂— 0x0
05:0028│            0x7fffffff6f48 ◂— 0x0
06:0030│            0x7fffffff6f50 —▸ 0x5555555df390 —▸ 0x5555555df3f0 —▸ 0x5555555df0f0 ◂— 0x0
07:0038│            0x7fffffff6f58 ◂— 0x0
──────────────────────────────────────[ BACKTRACE ]──────────────────────────────────────
 ► f 0   0x7ffff758218b raise+203
   f 1   0x7ffff7561859 abort+299
   f 2   0x7ffff75cc3ee __libc_message+670
   f 3   0x7ffff75d447c
   f 4   0x7ffff75d5cac _int_free+748
   f 5   0x7ffff784f461 gf_sg_command_del+353
   f 6   0x7ffff7a88203 gf_sm_del+195
   f 7   0x555555584423 dump_isom_scene+627
@jeanlf jeanlf closed this as completed in ef86a8e Dec 13, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant