Skip to content

Heap-buffer-overflow in motion.cc: mc_chroma<unsigned short> #341

Closed
@fdu-sec

Description

@fdu-sec

Description

Heap-buffer-overflow (/libde265/build/libde265/liblibde265.so+0x178e82) in void mc_chroma(base_context const*, seq_parameter_set const*, int, int, int, int, short*, int, unsigned short const*, int, int, int, int)

Version

$ ./dec265 -h
 dec265  v1.0.8
--------------
usage: dec265 [options] videofile.bin
The video file must be a raw bitstream, or a stream with NAL units (option -n).

options:
  -q, --quiet       do not show decoded image
  -t, --threads N   set number of worker threads (0 - no threading)
  -c, --check-hash  perform hash check
  -n, --nal         input is a stream with 4-byte length prefixed NAL units
  -f, --frames N    set number of frames to process
  -o, --output      write YUV reconstruction
  -d, --dump        dump headers
  -0, --noaccel     do not use any accelerated code (SSE)
  -v, --verbose     increase verbosity level (up to 3 times)
  -L, --no-logging  disable logging
  -B, --write-bytestream FILENAME  write raw bytestream (from NAL input)
  -m, --measure YUV compute PSNRs relative to reference YUV
  -T, --highest-TID select highest temporal sublayer to decode
      --disable-deblocking   disable deblocking filter
      --disable-sao          disable sample-adaptive offset filter
  -h, --help        show help

Replay

git clone https://github.com/strukturag/libde265.git
cd libde265
mkdir build
cd build
cmake ../ -DCMAKE_CXX_FLAGS="-fsanitize=address"
make -j$(nproc)
./dec265/dec265 poc7-1
./dec265/dec265 poc7-2

ASAN

WARNING: end_of_sub_stream_one_bit not set to 1 when it should be
WARNING: non-existing PPS referenced
WARNING: pps header invalid
=================================================================
==7775==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62f00007d140 at pc 0x7fd292960e83 bp 0x7ffcd0167ab0 sp 0x7ffcd0167aa0
READ of size 2 at 0x62f00007d140 thread T0
    #0 0x7fd292960e82 in void mc_chroma<unsigned short>(base_context const*, seq_parameter_set const*, int, int, int, int, short*, int, unsigned short const*, int, int, int, int) (/libde265/build/libde265/liblibde265.so+0x178e82)
    #1 0x7fd292951b2d in generate_inter_prediction_samples(base_context*, slice_segment_header const*, de265_image*, int, int, int, int, int, int, int, PBMotion const*) (/libde265/build/libde265/liblibde265.so+0x169b2d)
    #2 0x7fd29295e90f in decode_prediction_unit(base_context*, slice_segment_header const*, de265_image*, PBMotionCoding const&, int, int, int, int, int, int, int, int) (/libde265/build/libde265/liblibde265.so+0x17690f)
    #3 0x7fd2929997e3 in read_prediction_unit(thread_context*, int, int, int, int, int, int, int, int, int) (/libde265/build/libde265/liblibde265.so+0x1b17e3)
    #4 0x7fd29299b2cd in read_coding_unit(thread_context*, int, int, int, int) (/libde265/build/libde265/liblibde265.so+0x1b32cd)
    #5 0x7fd29299c250 in read_coding_quadtree(thread_context*, int, int, int, int) (/libde265/build/libde265/liblibde265.so+0x1b4250)
    #6 0x7fd29299c091 in read_coding_quadtree(thread_context*, int, int, int, int) (/libde265/build/libde265/liblibde265.so+0x1b4091)
    #7 0x7fd29299c091 in read_coding_quadtree(thread_context*, int, int, int, int) (/libde265/build/libde265/liblibde265.so+0x1b4091)
    #8 0x7fd292993726 in read_coding_tree_unit(thread_context*) (/libde265/build/libde265/liblibde265.so+0x1ab726)
    #9 0x7fd29299c9ea in decode_substream(thread_context*, bool, bool) (/libde265/build/libde265/liblibde265.so+0x1b49ea)
    #10 0x7fd29299e70f in read_slice_segment_data(thread_context*) (/libde265/build/libde265/liblibde265.so+0x1b670f)
    #11 0x7fd2928fd6d2 in decoder_context::decode_slice_unit_sequential(image_unit*, slice_unit*) (/libde265/build/libde265/liblibde265.so+0x1156d2)
    #12 0x7fd2928fdec1 in decoder_context::decode_slice_unit_parallel(image_unit*, slice_unit*) (/libde265/build/libde265/liblibde265.so+0x115ec1)
    #13 0x7fd2928fcc0f in decoder_context::decode_some(bool*) (/libde265/build/libde265/liblibde265.so+0x114c0f)
    #14 0x7fd2928fc93d in decoder_context::read_slice_NAL(bitreader&, NAL_unit*, nal_header&) (/libde265/build/libde265/liblibde265.so+0x11493d)
    #15 0x7fd2928ff43e in decoder_context::decode_NAL(NAL_unit*) (/libde265/build/libde265/liblibde265.so+0x11743e)
    #16 0x7fd2928ffab3 in decoder_context::decode(int*) (/libde265/build/libde265/liblibde265.so+0x117ab3)
    #17 0x7fd2928e6e95 in de265_decode (/libde265/build/libde265/liblibde265.so+0xfee95)
    #18 0x557bc2a8bbc9 in main (/libde265/build/dec265/dec265+0x6bc9)
    #19 0x7fd292418c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
    #20 0x557bc2a899b9 in _start (/libde265/build/dec265/dec265+0x49b9)

0x62f00007d140 is located 3376 bytes to the right of 49168-byte region [0x62f000070400,0x62f00007c410)
allocated by thread T0 here:
    #0 0x7fd292e0f790 in posix_memalign (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdf790)
    #1 0x7fd2929381cb in ALLOC_ALIGNED(unsigned long, unsigned long) (/libde265/build/libde265/liblibde265.so+0x1501cb)
    #2 0x7fd2929389e8 in de265_image_get_buffer(void*, de265_image_spec*, de265_image*, void*) (/libde265/build/libde265/liblibde265.so+0x1509e8)
    #3 0x7fd29293ad1a in de265_image::alloc_image(int, int, de265_chroma, std::shared_ptr<seq_parameter_set const>, bool, decoder_context*, long, void*, bool) (/libde265/build/libde265/liblibde265.so+0x152d1a)
    #4 0x7fd29291f0cc in decoded_picture_buffer::new_image(std::shared_ptr<seq_parameter_set const>, decoder_context*, long, void*, bool) (/libde265/build/libde265/liblibde265.so+0x1370cc)
    #5 0x7fd292900824 in decoder_context::generate_unavailable_reference_picture(seq_parameter_set const*, int, bool) (/libde265/build/libde265/liblibde265.so+0x118824)
    #6 0x7fd292903332 in decoder_context::process_reference_picture_set(slice_segment_header*) (/libde265/build/libde265/liblibde265.so+0x11b332)
    #7 0x7fd292906d70 in decoder_context::process_slice_segment_header(slice_segment_header*, de265_error*, long, nal_header*, void*) (/libde265/build/libde265/liblibde265.so+0x11ed70)
    #8 0x7fd2928fc246 in decoder_context::read_slice_NAL(bitreader&, NAL_unit*, nal_header&) (/libde265/build/libde265/liblibde265.so+0x114246)
    #9 0x7fd2928ff43e in decoder_context::decode_NAL(NAL_unit*) (/libde265/build/libde265/liblibde265.so+0x11743e)
    #10 0x7fd2928ffab3 in decoder_context::decode(int*) (/libde265/build/libde265/liblibde265.so+0x117ab3)
    #11 0x7fd2928e6e95 in de265_decode (/libde265/build/libde265/liblibde265.so+0xfee95)
    #12 0x557bc2a8bbc9 in main (/libde265/build/dec265/dec265+0x6bc9)
    #13 0x7fd292418c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/libde265/build/libde265/liblibde265.so+0x178e82) in void mc_chroma<unsigned short>(base_context const*, seq_parameter_set const*, int, int, int, int, short*, int, unsigned short const*, int, int, int, int)
Shadow bytes around the buggy address:
  0x0c5e800079d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5e800079e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5e800079f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5e80007a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5e80007a10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c5e80007a20: fa fa fa fa fa fa fa fa[fa]fa fa fa fa fa fa fa
  0x0c5e80007a30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5e80007a40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5e80007a50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5e80007a60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5e80007a70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==7775==ABORTING

POC

https://github.com/FDU-Sec/poc/blob/main/libde265/poc7-1
https://github.com/FDU-Sec/poc/blob/main/libde265/poc7-2

Environment

Ubuntu 16.04
Clang 10.0.1
gcc 5.5

Credit

Peng Deng (Fudan University)

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions