New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
A heapoverflow bug of wav2swf. #47
Comments
|
Is there any plan to address this vulnerability? |
|
I guess the cause of overflow is the following two in wav_convert2mono.
|
yoya
added a commit
to yoya/swftools
that referenced
this issue
Jan 17, 2020
bug: Short estimate dest->size when src->size is not evenly divisible by align. - matthiaskramm#47
yoya
added a commit
to yoya/swftools
that referenced
this issue
Jan 17, 2020
bugfix: PCM processor assume that align = channel * bps / 8, if a huge align is passed, the size of dest will be underestimated. - matthiaskramm#47
matthiaskramm
pushed a commit
that referenced
this issue
Jan 17, 2020
…aller error handling (#75) * In wav_convert2mono, samplelen calculation round-up by src->align. bug: Short estimate dest->size when src->size is not evenly divisible by align. - #47 * checking to size & align as PCM sample criteria. bugfix: PCM processor assume that align = channel * bps / 8, if a huge align is passed, the size of dest will be underestimated. - #47 * Abnormal termination care when bps unsupported. * Add caller handling when wav_convert2mono abnormally terminate.
Magicsmx
added a commit
to Magicsmx/swftools-smx
that referenced
this issue
Jun 2, 2021
bug: Short estimate dest->size when src->size is not evenly divisible by align. - matthiaskramm/swftools#47 * checking to size & align as PCM sample criteria. bugfix: PCM processor assume that align = channel * bps / 8, if a huge align is passed, the size of dest will be underestimated. - matthiaskramm/swftools#47 * Abnormal termination care when bps unsupported. * Add caller handling when wav_convert2mono abnormally terminate.
Magicsmx
added a commit
to Magicsmx/swftools-smx
that referenced
this issue
Jun 2, 2021
* In wav_convert2mono, samplelen calculation round-up by src->align. bug: Short estimate dest->size when src->size is not evenly divisible by align. - matthiaskramm/swftools#47 * checking to size & align as PCM sample criteria. bugfix: PCM processor assume that align = channel * bps / 8, if a huge align is passed, the size of dest will be underestimated. - matthiaskramm/swftools#47 * Abnormal termination care when bps unsupported. * Add caller handling when wav_convert2mono abnormally terminate.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
A heapoverflow bug of wav2swf.
poc: https://drive.google.com/open?id=1z1k-amAf8NoAH8N_yhwggOQj9o6bemch
asan: https://drive.google.com/open?id=1HaydSh6XaszrsfE15l5SLmdAyX6IOi0i
Bug occured in file /lib/wav.c:243. Function wav_convert2mono does not check the size and align in wav sample properly, which causes samplelen equal to 0 while size less than align.
swftools/lib/wav.c
Line 204 in 54657f9
Thus, the argument to the function malloc will less than we expect, which is only 128 bytes.
swftools/lib/wav.c
Line 225 in 54657f9
Later, in the for loop, it will cause heap buffer overflow. Here the varible src->size is 0xb78a, which makes pos2 much more larger than 128.
swftools/lib/wav.c
Line 239 in 54657f9
Patch Suggestion:
Check size and align.
The text was updated successfully, but these errors were encountered: