Opened 3 months ago

Closed 3 months ago

#2391 closed defect (duplicate)

A heap-buffer-overflow occurred in function gen_sh_video () of mplayer/libmpdemux/demux_mov.c

Reported by: ylzs Owned by: beastd
Priority: normal Component: undetermined
Version: HEAD Severity: major
Keywords: Cc:
Blocked By: Blocking:
Reproduced by developer: no Analyzed by developer: no

Description (last modified by ylzs)

Version: SVN-r38374-13.0.1

Build command: ./configure --disable-ffmpeg_a && make (compiling with asan)

Summary of the bug: A heap-buffer-overflow read is found in fucnction gen_sh_video() which affects mplayer and mencoder. The attached file can reproduce this issue (ASAN-recompilation is needed).

How to reproduce:

1)command: ./mplayer ./testcase_0

2)result:

MPlayer SVN-r38374-13.0.1 (C) 2000-2022 MPlayer Team                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Playing /home/jlx/crashes/testcase_0.                                                                                                                                                                                                                                                                                                                                                 libavformat version 58.29.100 (external)                                                                                                                                                                                                                                                                                                                                              libavformat file format detected.                                                                                                                                                                                                                                                                                                                                                     [mov,mp4,m4a,3gp,3g2,mj2 @ 0x7f3ef6cf6600]STSC entry 2 is invalid (first=4 count=14 id=1)                                                                                                                                                                                                                                                                                             [mov,mp4,m4a,3gp,3g2,mj2 @ 0x7f3ef6cf6600]STSC entry 1 is invalid (first=918905090 count=15 id=1)                                                                                                                                                                                                                                                                                     [mov,mp4,m4a,3gp,3g2,mj2 @ 0x7f3ef6cf6600]STSC entry 0 is invalid (first=1 count=109 id=-894264234)                                                                                                                                                                                                                                                                                   [mov,mp4,m4a,3gp,3g2,mj2 @ 0x7f3ef6cf6600]Invalid sample size -16777051                                                                                                                                                                                                                                                                                                               [mov,mp4,m4a,3gp,3g2,mj2 @ 0x7f3ef6cf6600]error reading header                                                                                                                                                                                                                                                                                                                        LAVF_header: av_open_input_stream() failed
Quicktime/MOV file format detected.                                                                                                                                                                                                                                                                                                                                                   MOV: durmap and chunkmap sample count differ (90 vs 654)                                                                                                                                                                                                                                                                                                                              MOV: durmap or chunkmap bigger than sample count (654 vs 90)
[mov] Video stream found, -vid 0
=================================================================
==14591==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60d000001ef5 at pc 0x557daf768391 bp 0x7ffe9f4edb50 sp 0x7ffe9f4edb48
READ of size 2 at 0x60d000001ef5 thread T0
    #0 0x557daf768390 in gen_sh_video /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c:1100:80
    #1 0x557daf768390 in lschunks /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c:1344:3
    #2 0x557daf75388c in mov_read_header /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c:1961:5

0x60d000001ef5 is located 21 bytes to the right of 144-byte region [0x60d000001e50,0x60d000001ee0)
allocated by thread T0 here:                                                                                                                                                                                                                                                                                                                                                              #0 0x557daf391362 in __interceptor_calloc (/home/jlx/good_mplayer/mplayer/mplayer+0x343362)                                                                                                                                                                                                                                                                                           #1 0x557daf758c4c in lschunks_intrak /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c:1837:24                                                                                                                                                                                                                                                                                    #2 0x557daf758c4c in lschunks /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c:1305:8                                                                                                                                                                                                                                                                                            #3 0x557daf75a576 in lschunks_intrak /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c                                                                                                                                                                                                                                                                                            #4 0x557daf75a576 in lschunks /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c:1305:8                                                                                                                                                                                                                                                                                            #5 0x557daf75a576 in lschunks_intrak /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c                                                                                                                                                                                                                                                                                            #6 0x557daf75a576 in lschunks /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c:1305:8
    #7 0x557daf75a576 in lschunks_intrak /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c
    #8 0x557daf75a576 in lschunks /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c:1305:8
    #9 0x557daf75b068 in lschunks /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c:1332:6
    #10 0x557daf75388c in mov_read_header /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c:1961:5

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/jlx/good_mplayer/mplayer/libmpdemux/demux_mov.c:1100:80 in gen_sh_video
Shadow bytes around the buggy address:
  0x0c1a7fff8380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa
  0x0c1a7fff8390: fa fa fa fa fa fa 00 00 00 00 00 00 00 00 00 00
  0x0c1a7fff83a0: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
  0x0c1a7fff83b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1a7fff83c0: 00 07 fa fa fa fa fa fa fa fa 00 00 00 00 00 00
=>0x0c1a7fff83d0: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa[fa]fa
  0x0c1a7fff83e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1a7fff83f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1a7fff8400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1a7fff8410: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1a7fff8420: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==14591==ABORTING

Attachments (1)

testcase_0 (53.2 KB ) - added by ylzs 3 months ago.

Download all attachments as: .zip

Change History (4)

by ylzs, 3 months ago

Attachment: testcase_0 added

comment:1 by ylzs, 3 months ago

Description: modified (diff)

comment:2 by ylzs, 3 months ago

Severity: criticalmajor

comment:3 by reimar, 3 months ago

Resolution: duplicate
Status: newclosed

Same as #2392

Note: See TracTickets for help on using tickets.