Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

A heapoverflow bug of wav2swf. #47

Open
ghost opened this issue Nov 10, 2017 · 2 comments
Open

A heapoverflow bug of wav2swf. #47

ghost opened this issue Nov 10, 2017 · 2 comments

Comments

@ghost
Copy link

ghost commented Nov 10, 2017

A heapoverflow bug of wav2swf.

poc: https://drive.google.com/open?id=1z1k-amAf8NoAH8N_yhwggOQj9o6bemch
asan: https://drive.google.com/open?id=1HaydSh6XaszrsfE15l5SLmdAyX6IOi0i

Bug occured in file /lib/wav.c:243. Function wav_convert2mono does not check the size and align in wav sample properly, which causes samplelen equal to 0 while size less than align.

int wav_convert2mono(struct WAV*src, struct WAV*dest, int rate)

Thus, the argument to the function malloc will less than we expect, which is only 128 bytes.
dest->data = (unsigned char*)malloc((int)(samplelen*ratio*2)+128);

Later, in the for loop, it will cause heap buffer overflow. Here the varible src->size is 0xb78a, which makes pos2 much more larger than 128.
for(i=0; i<src->size; i+=channels) {

Patch Suggestion:
Check size and align.

@NicoleG25
Copy link

Is there any plan to address this vulnerability?
Note that it appears that CVE-2017-16793 was assigned to this issue.

@yoya @matthiaskramm

@yoya
Copy link
Contributor

yoya commented Jan 17, 2020

I guess the cause of overflow is the following two in wav_convert2mono.

  • Short estimate dest->size when src->size is not evenly divisible by align.
    • It can be responded by rounding up
  • PCM processor assume that align = channel * bps / 8, if a huge align is passed, the size of dest will be underestimated.
    • Let's check it at the beginning of the function

yoya added a commit to yoya/swftools that referenced this issue Jan 17, 2020
bug: Short estimate dest->size when src->size is not evenly divisible by align.
- matthiaskramm#47
yoya added a commit to yoya/swftools that referenced this issue Jan 17, 2020
bugfix: PCM processor assume that align = channel * bps / 8, if a huge align is passed, the size of dest will be underestimated.
- matthiaskramm#47
matthiaskramm pushed a commit that referenced this issue Jan 17, 2020
…aller error handling (#75)

* In wav_convert2mono, samplelen calculation round-up by src->align.
bug: Short estimate dest->size when src->size is not evenly divisible by align.
- #47

* checking to size & align as PCM sample criteria.
bugfix: PCM processor assume that align = channel * bps / 8, if a huge align is passed, the size of dest will be underestimated.
- #47

* Abnormal termination care when bps unsupported.

* Add caller handling when wav_convert2mono abnormally terminate.
Magicsmx added a commit to Magicsmx/swftools-smx that referenced this issue Jun 2, 2021
bug: Short estimate dest->size when src->size is not evenly divisible by align.
- matthiaskramm/swftools#47

* checking to size & align as PCM sample criteria.
bugfix: PCM processor assume that align = channel * bps / 8, if a huge align is passed, the size of dest will be underestimated.
- matthiaskramm/swftools#47

* Abnormal termination care when bps unsupported.

* Add caller handling when wav_convert2mono abnormally terminate.
Magicsmx added a commit to Magicsmx/swftools-smx that referenced this issue Jun 2, 2021
* In wav_convert2mono, samplelen calculation round-up by src->align.
bug: Short estimate dest->size when src->size is not evenly divisible by align.
- matthiaskramm/swftools#47

* checking to size & align as PCM sample criteria.
bugfix: PCM processor assume that align = channel * bps / 8, if a huge align is passed, the size of dest will be underestimated.
- matthiaskramm/swftools#47

* Abnormal termination care when bps unsupported.

* Add caller handling when wav_convert2mono abnormally terminate.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants