Opened 2 years ago
Closed 2 years ago
#2391 closed defect (duplicate)
A heap-buffer-overflow occurred in function gen_sh_video () of mplayer/libmpdemux/demux_mov.c
| Reported by: | ylzs | Owned by: | beastd |
|---|---|---|---|
| Priority: | normal | Component: | undetermined |
| Version: | HEAD | Severity: | major |
| Keywords: | Cc: | ||
| Blocked By: | Blocking: | ||
| Reproduced by developer: | no | Analyzed by developer: | no |
Description (last modified by )
Version: SVN-r38374-13.0.1
Build command: ./configure --disable-ffmpeg_a && make (compiling with asan)
Summary of the bug: A heap-buffer-overflow read is found in fucnction gen_sh_video() which affects mplayer and mencoder. The attached file can reproduce this issue (ASAN-recompilation is needed).
How to reproduce:
1)command: ./mplayer ./testcase_0
2)result:
MPlayer SVN-r38374-13.0.1 (C) 2000-2022 MPlayer Team Playing /home/jlx/crashes/testcase_0. libavformat version 58.29.100 (external) libavformat file format detected. [mov,mp4,m4a,3gp,3g2,mj2 @ 0x7f3ef6cf6600]STSC entry 2 is invalid (first=4 count=14 id=1) [mov,mp4,m4a,3gp,3g2,mj2 @ 0x7f3ef6cf6600]STSC entry 1 is invalid (first=918905090 count=15 id=1) [mov,mp4,m4a,3gp,3g2,mj2 @ 0x7f3ef6cf6600]STSC entry 0 is invalid (first=1 count=109 id=-894264234) [mov,mp4,m4a,3gp,3g2,mj2 @ 0x7f3ef6cf6600]Invalid sample size -16777051 [mov,mp4,m4a,3gp,3g2,mj2 @ 0x7f3ef6cf6600]error reading header LAVF_header: av_open_input_stream() failed
Quicktime/MOV file format detected. MOV: durmap and chunkmap sample count differ (90 vs 654) MOV: durmap or chunkmap bigger than sample count (654 vs 90)
[mov] Video stream found, -vid 0
=================================================================
==14591==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60d000001ef5 at pc 0x557daf768391 bp 0x7ffe9f4edb50 sp 0x7ffe9f4edb48
READ of size 2 at 0x60d000001ef5 thread T0
#0 0x557daf768390 in gen_sh_video /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c:1100:80
#1 0x557daf768390 in lschunks /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c:1344:3
#2 0x557daf75388c in mov_read_header /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c:1961:5
0x60d000001ef5 is located 21 bytes to the right of 144-byte region [0x60d000001e50,0x60d000001ee0)
allocated by thread T0 here: #0 0x557daf391362 in __interceptor_calloc (/home/jlx/good_mplayer/mplayer/mplayer+0x343362) #1 0x557daf758c4c in lschunks_intrak /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c:1837:24 #2 0x557daf758c4c in lschunks /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c:1305:8 #3 0x557daf75a576 in lschunks_intrak /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c #4 0x557daf75a576 in lschunks /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c:1305:8 #5 0x557daf75a576 in lschunks_intrak /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c #6 0x557daf75a576 in lschunks /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c:1305:8
#7 0x557daf75a576 in lschunks_intrak /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c
#8 0x557daf75a576 in lschunks /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c:1305:8
#9 0x557daf75b068 in lschunks /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c:1332:6
#10 0x557daf75388c in mov_read_header /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c:1961:5
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c:1100:80 in gen_sh_video
Shadow bytes around the buggy address:
0x0c1a7fff8380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa
0x0c1a7fff8390: fa fa fa fa fa fa 00 00 00 00 00 00 00 00 00 00
0x0c1a7fff83a0: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
0x0c1a7fff83b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c1a7fff83c0: 00 07 fa fa fa fa fa fa fa fa 00 00 00 00 00 00
=>0x0c1a7fff83d0: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa[fa]fa
0x0c1a7fff83e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1a7fff83f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1a7fff8400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1a7fff8410: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1a7fff8420: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==14591==ABORTING
Attachments (1)
Change History (4)
by , 2 years ago
| Attachment: | testcase_0 added |
|---|
comment:1 by , 2 years ago
| Description: | modified (diff) |
|---|
comment:2 by , 2 years ago
| Severity: | critical → major |
|---|
comment:3 by , 2 years ago
| Resolution: | → duplicate |
|---|---|
| Status: | new → closed |
Note:
See TracTickets
for help on using tickets.
Same as #2392