Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Stack-use-after-scope in sao.cc: void apply_sao_internal<unsigned short> #353

Closed
fdu-sec opened this issue Oct 10, 2022 · 1 comment
Closed

Stack-use-after-scope in sao.cc: void apply_sao_internal<unsigned short> #353

fdu-sec opened this issue Oct 10, 2022 · 1 comment
Labels
fix available

Comments

@fdu-sec
Copy link

fdu-sec commented Oct 10, 2022

Description

Stack-use-after-scope (/libde265/libde265/build/libde265/liblibde265.so+0x19337f) in void apply_sao_internal(de265_image*, int, int, slice_segment_header const*, int, int, int, unsigned short const*, int, unsigned short*, int)

Version

$ ./dec265 -h
 dec265  v1.0.8
--------------
usage: dec265 [options] videofile.bin
The video file must be a raw bitstream, or a stream with NAL units (option -n).

options:
  -q, --quiet       do not show decoded image
  -t, --threads N   set number of worker threads (0 - no threading)
  -c, --check-hash  perform hash check
  -n, --nal         input is a stream with 4-byte length prefixed NAL units
  -f, --frames N    set number of frames to process
  -o, --output      write YUV reconstruction
  -d, --dump        dump headers
  -0, --noaccel     do not use any accelerated code (SSE)
  -v, --verbose     increase verbosity level (up to 3 times)
  -L, --no-logging  disable logging
  -B, --write-bytestream FILENAME  write raw bytestream (from NAL input)
  -m, --measure YUV compute PSNRs relative to reference YUV
  -T, --highest-TID select highest temporal sublayer to decode
      --disable-deblocking   disable deblocking filter
      --disable-sao          disable sample-adaptive offset filter
  -h, --help        show help

Replay

git clone https://github.com/strukturag/libde265.git
cd libde265
mkdir build
cd build
cmake ../ -DCMAKE_CXX_FLAGS="-fsanitize=address"
make -j$(nproc)
./dec265/dec265 poc19

ASAN

WARNING: end_of_sub_stream_one_bit not set to 1 when it should be
WARNING: non-existing PPS referenced
WARNING: CTB outside of image area (concealing stream error...)
=================================================================
==50847==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7ffc2aa1734c at pc 0x7f8a42e42380 bp 0x7ffc2aa14530 sp 0x7ffc2aa14520
READ of size 4 at 0x7ffc2aa1734c thread T0
    #0 0x7f8a42e4237f in void apply_sao_internal<unsigned short>(de265_image*, int, int, slice_segment_header const*, int, int, int, unsigned short const*, int, unsigned short*, int) (/libde265/libde265/build/libde265/liblibde265.so+0x19337f)
    #1 0x7f8a42e403b6 in void apply_sao<unsigned char>(de265_image*, int, int, slice_segment_header const*, int, int, int, unsigned char const*, int, unsigned char*, int) (/libde265/libde265/build/libde265/liblibde265.so+0x1913b6)
    #2 0x7f8a42e3e909 in apply_sample_adaptive_offset_sequential(de265_image*) (/libde265/libde265/build/libde265/liblibde265.so+0x18f909)
    #3 0x7f8a42dcca5d in decoder_context::run_postprocessing_filters_sequential(de265_image*) (/libde265/libde265/build/libde265/liblibde265.so+0x11da5d)
    #4 0x7f8a42dc3ecf in decoder_context::decode_some(bool*) (/libde265/libde265/build/libde265/liblibde265.so+0x114ecf)
    #5 0x7f8a42dc6ba8 in decoder_context::decode(int*) (/libde265/libde265/build/libde265/liblibde265.so+0x117ba8)
    #6 0x7f8a42dade95 in de265_decode (/libde265/libde265/build/libde265/liblibde265.so+0xfee95)
    #7 0x55bb6e3b2bc9 in main (/libde265/libde265/build/dec265/dec265+0x6bc9)
    #8 0x7f8a428dfc86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
    #9 0x55bb6e3b09b9 in _start (/libde265/libde265/build/dec265/dec265+0x49b9)

Address 0x7ffc2aa1734c is located in stack of thread T0 at offset 10268 in frame
    #0 0x55bb6e3b183a in main (/libde265/libde265/build/dec265/dec265+0x583a)

  This frame has 7 object(s):
    [32, 36) 'option_index'
    [96, 100) 'more'
    [160, 176) 'tv_start'
    [224, 240) 'tv_end'
    [288, 291) 'sc'
    [352, 356) 'len'
    [416, 41376) 'buf' <== Memory access at offset 10268 is inside this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-use-after-scope (/libde265/libde265/build/libde265/liblibde265.so+0x19337f) in void apply_sao_internal<unsigned short>(de265_image*, int, int, slice_segment_header const*, int, int, int, unsigned short const*, int, unsigned short*, int)
Shadow bytes around the buggy address:
  0x10000553ae10: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x10000553ae20: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x10000553ae30: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x10000553ae40: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x10000553ae50: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
=>0x10000553ae60: f8 f8 f8 f8 f8 f8 f8 f8 f8[f8]f8 f8 f8 f8 f8 f8
  0x10000553ae70: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x10000553ae80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x10000553ae90: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x10000553aea0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x10000553aeb0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==50847==ABORTING

POC

https://github.com/FDU-Sec/poc/blob/main/libde265/poc19

Environment

Ubuntu 18.04.5 LTS
Clang 10.0.1
gcc 7.5.0

Credit

Peng Deng (Fudan University)
coldtobi pushed a commit to coldtobi/libde265 that referenced this issue Dec 12, 2022
Use the sps from the image
36391cd 
(as e.g mc_chroma is using the sps to determine
picture properties, like pic_width_in_luma_samples
and pic_height_in_luma_samples, I *think* this is
more correct.

This PR is for discussion. (See strukturag#345.)
It makes the failures go away, but that does not mean it's correct :)

The following poc will be stop failing if (only) this
patch is applied:

 - poc2  strukturag#336 - CVE-2022-43238
 - poc4  strukturag#338 - CVE-2022-43241
 - poc6-1, poc6-2 strukturag#340 - CVE-2022-43242
 - poc7-1, poc7-2  strukturag#341 - CVE-2022-43239
 - poc8-1 strukturag#342 - CVE-2022-43244
 - poc9-3 strukturag#343 - CVE-2022-43236
 - poc10-2, poc10-3 strukturag#344 - CVE-2022-43237
 - poc16 strukturag#350
 - poc19 strukturag#353

The following are still failing if only this patch is
applied, but they stop failing if strukturag#365 is applied as well, but will
still fail with ONLY strukturag#365 applied (IOW, both are needed)

 - poc1  strukturag#335 - CVE-2022-43240
 - poc3  strukturag#337 - CVE-2022-43235
 - poc5   strukturag#339 - CVE-2022-43423
 - poc9-1,poc9-2, poc9-4  strukturag#343 - CVE-2022-43236
 - poc14  strukturag#348 - CVE-2022-43253
 - poc15  strukturag#349 - CVE-2022-43248
 - poc17-1, poc17-2  strukturag#351
 - poc18 strukturag#352 - CVE-2022-43245
@coldtobi coldtobi mentioned this issue Dec 12, 2022
Open
@farindk
Copy link
Contributor

farindk commented Jan 24, 2023

Should be fixed with #376

@farindk farindk closed this as completed Jan 24, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
fix available
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@farindk @fdu-sec