Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

NULL pointer dereference in DeleteBitBuffer (bitbuffer.c) #1

Open
asarubbo opened this issue Aug 31, 2017 · 1 comment
Open

NULL pointer dereference in DeleteBitBuffer (bitbuffer.c) #1

asarubbo opened this issue Aug 31, 2017 · 1 comment

Comments

@asarubbo
Copy link

On 0.17.5:

# aacplusenc $FILE out.aac 32
                                                                                                                                                                                                                  
*************************************************************                                                                                                                                                     
* Enhanced aacPlus Encoder                                                                                                                                                                                        
* Build Aug 30 2017, 14:40:49                                                                                                                                                                                     
* Matteo Croce <rootkit85@yahoo.it>                                                                                                                                                                               
*************************************************************                                                                                                                                                     
                                                                                                                                                                                                                  
input file 101.crashes.wav:                                                                                                                                                                                       
sr = 48000, nc = 1                                                                                                                                                                                                
                                                                                                                                                                                                                  
output file out.aac:                                                                                                                                                                                              
br = 32000 sr-OUT = 48000  nc-OUT = 1                                                                                                                                                                             
                                                                                                                                                                                                                  
                                                                                                                                                                                                                  
ASAN:DEADLYSIGNAL
=================================================================
==21496==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000030 (pc 0x000000562e2f bp 0x7ffc2ec32430 sp 0x7ffc2ec32430 T0)
==21496==The signal is caused by a WRITE memory access.
==21496==Hint: address points to the zero page.
    #0 0x562e2e in DeleteBitBuffer /var/tmp/portage/media-sound/aacplusenc-0.17.5/work/aacplusenc/libbitbuf/bitbuffer.c:97:23
    #1 0x50d909 in AacEncClose /var/tmp/portage/media-sound/aacplusenc-0.17.5/work/aacplusenc/libaacenc/aacenc.c:469:5
    #2 0x50c0df in main /var/tmp/portage/media-sound/aacplusenc-0.17.5/work/aacplusenc/aacplusenc.c:536:2
    #3 0x7f0e4c21b680 in __libc_start_main /var/tmp/portage/sys-libs/glibc-2.23-r4/work/glibc-2.23/csu/../csu/libc-start.c:289
    #4 0x419e78 in _init (/usr/bin/aacplusenc+0x419e78)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /var/tmp/portage/media-sound/aacplusenc-0.17.5/work/aacplusenc/libbitbuf/bitbuffer.c:97:23 in DeleteBitBuffer
==21496==ABORTING

Testcase:
https://github.com/asarubbo/poc/blob/master/00332-aacplusenc-NULLptr-DeleteBitBuffer

@carnil
Copy link

carnil commented Sep 7, 2017

This issue has been assigned CVE-2017-14181

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants