Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Invalid memory address dereference in lt_prediction(in libfaad/lt_predict.c:108) #31

Closed
fantasy7082 opened this issue Dec 17, 2018 · 3 comments

Comments

@fantasy7082
Copy link

Hi, i found a issue in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. It crashed in function lt_prediction .the details are below(ASAN):

./faad faad_res/010-invalid-def-lt_predict_108 -o out.wav
 *********** Ahead Software MPEG-4 AAC Decoder V2.8.8 ******************

 Build: Dec 13 2018
 Copyright 2002-2004: Ahead Software AG
 http://www.audiocoding.com
 bug tracking: https://sourceforge.net/p/faac/bugs/
 Floating point version

 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License.

 **************************************************************************

faad_res/010-invalid-def-lt_predict_108 file info:
RAW

  ---------------------
 | Config:  1.1 Ch     |
  ---------------------
 | Ch |    Position    |
  ---------------------
 | 00 | Center front   |
 | 01 | Left front     |
  ---------------------

ASAN:SIGSEGV faad_res/010-invalid-def-lt_predict_108.
=================================================================
==7092==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000fd0 (pc 0x7f09d10c9532 bp 0x7ffea06b0460 sp 0x7ffea06ac370 T0)
    #0 0x7f09d10c9531 in lt_prediction /root/faad2_asan/libfaad/lt_predict.c:108
    #1 0x7f09d10fb6b8 in reconstruct_channel_pair /root/faad2_asan/libfaad/specrec.c:1228
    #2 0x7f09d1102823 in channel_pair_element /root/faad2_asan/libfaad/syntax.c:759
    #3 0x7f09d1100cbf in decode_cpe /root/faad2_asan/libfaad/syntax.c:402
    #4 0x7f09d1101398 in raw_data_block /root/faad2_asan/libfaad/syntax.c:448
    #5 0x7f09d10bb9c3 in aac_frame_decode /root/faad2_asan/libfaad/decoder.c:990
    #6 0x7f09d10bb566 in NeAACDecDecode /root/faad2_asan/libfaad/decoder.c:821
    #7 0x40f8ae in decodeAACfile /root/faad2_asan/frontend/main.c:679
    #8 0x411dd4 in faad_main /root/faad2_asan/frontend/main.c:1323
    #9 0x411fe5 in main /root/faad2_asan/frontend/main.c:1366
    #10 0x7f09d0cf382f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #11 0x401aa8 in _start (/usr/local/faad-asan/bin/faad+0x401aa8)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/faad2_asan/libfaad/lt_predict.c:108 lt_prediction
==7092==ABORTING

POC FILE:https://github.com/fantasy7082/image_test/blob/master/010-invalid-def-lt_predict_108

@nluedtke
Copy link

This was assigned CVE-2018-20358.

@hlef
Copy link
Contributor

hlef commented Aug 18, 2019

Unreproducible on the current master.

Fixed by 466b01d.

@fabiangreffrath
Copy link
Collaborator

Closing then.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants