Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

out of bound heap access in SimpleModule.h #55

Open
cuanduo opened this issue Jul 25, 2019 · 1 comment
Open

out of bound heap access in SimpleModule.h #55

cuanduo opened this issue Jul 25, 2019 · 1 comment

Comments

@cuanduo
Copy link

cuanduo commented Jul 25, 2019

There exists one out of bound heap access in SwapModule::runSwap, in SimpleModule.h:82, which allows an attacker to cause a denial of service via a crafted file.

sfconvert $poc output format caf
poc.zip

asan output

root@ubuntu:~/fuzz/audiofile# /home/tim/audiofile-santi/sfcommands/sfconvert /home/tim/Downloads/poc output format caf
ASAN:DEADLYSIGNAL
=================================================================
==30065==ERROR: AddressSanitizer: SEGV on unknown address 0x625000010000 (pc 0x7ffff6becb40 bp 0x60c000000340 sp 0x7fffffffe200 T0)
==30065==The signal is caused by a READ memory access.
    #0 0x7ffff6becb3f in void SwapModule::runSwap<8, long>(long const*, long*, int) /home/tim/audiofile-santi/libaudiofile/modules/SimpleModule.h:81
    #1 0x7ffff6becb3f in void SwapModule::run<8, long>(Chunk&, Chunk&) /home/tim/audiofile-santi/libaudiofile/modules/SimpleModule.h:74
    #2 0x7ffff6becb3f in SwapModule::run(Chunk&, Chunk&) /home/tim/audiofile-santi/libaudiofile/modules/SimpleModule.h:63
    #3 0x7ffff6bdc218 in afReadFrames (/home/tim/audiofile-santi/libaudiofile/.libs/libaudiofile.so.1+0x32218)
    #4 0x555555555fdd in copyaudiodata /home/tim/audiofile-santi/sfcommands/sfconvert.c:340
    #5 0x555555555620 in main /home/tim/audiofile-santi/sfcommands/sfconvert.c:248
    #6 0x7ffff67dab96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #7 0x555555555c79 in _start (/home/tim/audiofile-santi/sfcommands/.libs/sfconvert+0x1c79)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/tim/audiofile-santi/libaudiofile/modules/SimpleModule.h:81 in void SwapModule::runSwap<8, long>(long const*, long*, int)
==30065==ABORTING

gdb output

gdb-peda$ r /home/tim/Downloads/poc output format caf
Starting program: /home/tim/fuzz/audiofile/sfconvert /home/tim/Downloads/poc output format caf

Program received signal SIGSEGV, Segmentation fault.

[----------------------------------registers-----------------------------------]
RAX: 0x0 
RBX: 0x0 
RCX: 0x7ffff7f5b010 --> 0x2e736e6400000000 ('')
RDX: 0x0 
RSI: 0x55555587ac40 --> 0x646e732e ('.snd')
RDI: 0x0 
RBP: 0x200000028 
RSP: 0x7fffffffe320 --> 0x555555877f28 --> 0x3e9 
RIP: 0x5555555c82b5 (<SwapModule::run(Chunk&, Chunk&)+1525>:	mov    rdx,QWORD PTR [rsi+r10*1+0x18])
R8 : 0x0 
R9 : 0x0 
R10: 0xc3a8 
R11: 0x0 
R12: 0x555555877f28 --> 0x3e9 
R13: 0x555555878660 --> 0x5555558643f8 --> 0x5555555c72d0 (<SwapModule::~SwapModule()>:	lea    rsp,[rsp-0x98])
R14: 0x0 
R15: 0x1
EFLAGS: 0x10283 (CARRY parity adjust zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x5555555c82a8 <SwapModule::run(Chunk&, Chunk&)+1512>:	mov    r8,QWORD PTR [rsi+r10*1+0x10]
   0x5555555c82ad <SwapModule::run(Chunk&, Chunk&)+1517>:	bswap  r8
   0x5555555c82b0 <SwapModule::run(Chunk&, Chunk&)+1520>:	mov    QWORD PTR [rcx+r10*1+0x10],r8
=> 0x5555555c82b5 <SwapModule::run(Chunk&, Chunk&)+1525>:	mov    rdx,QWORD PTR [rsi+r10*1+0x18]
   0x5555555c82ba <SwapModule::run(Chunk&, Chunk&)+1530>:	bswap  rdx
   0x5555555c82bd <SwapModule::run(Chunk&, Chunk&)+1533>:	mov    QWORD PTR [rcx+r10*1+0x18],rdx
   0x5555555c82c2 <SwapModule::run(Chunk&, Chunk&)+1538>:	mov    rax,QWORD PTR [rsi+r10*1+0x20]
   0x5555555c82c7 <SwapModule::run(Chunk&, Chunk&)+1543>:	bswap  rax
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffe320 --> 0x555555877f28 --> 0x3e9 
0008| 0x7fffffffe328 --> 0x5 
0016| 0x7fffffffe330 --> 0x555555878b70 --> 0x3 
0024| 0x7fffffffe338 --> 0x55555556a266 (<afReadFrames(AFfilehandle, int, void*, int)+1702>:	movzx  r15d,BYTE PTR [r12+0x169])
0032| 0x7fffffffe340 --> 0x5 
0040| 0x7fffffffe348 --> 0x855877f28 
0048| 0x7fffffffe350 --> 0x7ffff7f5b010 --> 0x2e736e6400000000 ('')
0056| 0x7fffffffe358 --> 0xfffffffffffffc06 
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
0x00005555555c82b5 in SwapModule::runSwap<8, long> (this=<optimized out>, sampleCount=<optimized out>, output=0x7ffff7f5b010, input=0x55555587ac40) at SimpleModule.h:82
82				output[i] = byteswap(input[i]);
gdb-peda$ bt
#0  0x00005555555c82b5 in SwapModule::runSwap<8, long> (this=<optimized out>, sampleCount=<optimized out>, output=0x7ffff7f5b010, input=0x55555587ac40) at SimpleModule.h:82
#1  SwapModule::run<8, long> (this=<optimized out>, outChunk=..., inChunk=...) at SimpleModule.h:74
#2  SwapModule::run (this=<optimized out>, inChunk=..., outChunk=...) at SimpleModule.h:63
#3  0x000055555556a266 in afReadFrames (file=<optimized out>, trackid=<optimized out>, samples=0x7ffff7f5b010, nvframeswanted=<optimized out>) at data.cpp:222
#4  0x000055555555ab4d in copyaudiodata (infile=0x555555877e90, outfile=0x5555558786a0, trackid=0x3e9) at sfconvert.c:340
#5  0x0000555555559331 in main (argc=argc@entry=0x5, argv=argv@entry=0x7fffffffe548) at sfconvert.c:248
#6  0x00007ffff72deb97 in __libc_start_main (main=0x555555558b70 <main>, argc=0x5, argv=0x7fffffffe548, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe538) at ../csu/libc-start.c:310
#7  0x000055555555a62a in _start ()
gdb-peda$ vmmap 
Start              End                Perm	Name
0x0000555555554000 0x0000555555663000 r-xp	/home/tim/fuzz/audiofile/sfconvert
0x0000555555863000 0x0000555555865000 r--p	/home/tim/fuzz/audiofile/sfconvert
0x0000555555865000 0x0000555555866000 rw-p	/home/tim/fuzz/audiofile/sfconvert
0x0000555555866000 0x0000555555887000 rw-p	[heap]
0x00007ffff70a5000 0x00007ffff70bc000 r-xp	/lib/x86_64-linux-gnu/libgcc_s.so.1
0x00007ffff70bc000 0x00007ffff72bb000 ---p	/lib/x86_64-linux-gnu/libgcc_s.so.1
0x00007ffff72bb000 0x00007ffff72bc000 r--p	/lib/x86_64-linux-gnu/libgcc_s.so.1
0x00007ffff72bc000 0x00007ffff72bd000 rw-p	/lib/x86_64-linux-gnu/libgcc_s.so.1
0x00007ffff72bd000 0x00007ffff74a4000 r-xp	/lib/x86_64-linux-gnu/libc-2.27.so
0x00007ffff74a4000 0x00007ffff76a4000 ---p	/lib/x86_64-linux-gnu/libc-2.27.so
0x00007ffff76a4000 0x00007ffff76a8000 r--p	/lib/x86_64-linux-gnu/libc-2.27.so
0x00007ffff76a8000 0x00007ffff76aa000 rw-p	/lib/x86_64-linux-gnu/libc-2.27.so
0x00007ffff76aa000 0x00007ffff76ae000 rw-p	mapped
0x00007ffff76ae000 0x00007ffff784b000 r-xp	/lib/x86_64-linux-gnu/libm-2.27.so
0x00007ffff784b000 0x00007ffff7a4a000 ---p	/lib/x86_64-linux-gnu/libm-2.27.so
0x00007ffff7a4a000 0x00007ffff7a4b000 r--p	/lib/x86_64-linux-gnu/libm-2.27.so
0x00007ffff7a4b000 0x00007ffff7a4c000 rw-p	/lib/x86_64-linux-gnu/libm-2.27.so
0x00007ffff7a4c000 0x00007ffff7bc5000 r-xp	/usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.25
0x00007ffff7bc5000 0x00007ffff7dc5000 ---p	/usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.25
0x00007ffff7dc5000 0x00007ffff7dcf000 r--p	/usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.25
0x00007ffff7dcf000 0x00007ffff7dd1000 rw-p	/usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.25
0x00007ffff7dd1000 0x00007ffff7dd5000 rw-p	mapped
0x00007ffff7dd5000 0x00007ffff7dfc000 r-xp	/lib/x86_64-linux-gnu/ld-2.27.so
0x00007ffff7f5b000 0x00007ffff7fe2000 rw-p	mapped
0x00007ffff7ff7000 0x00007ffff7ffa000 r--p	[vvar]
0x00007ffff7ffa000 0x00007ffff7ffc000 r-xp	[vdso]
0x00007ffff7ffc000 0x00007ffff7ffd000 r--p	/lib/x86_64-linux-gnu/ld-2.27.so
0x00007ffff7ffd000 0x00007ffff7ffe000 rw-p	/lib/x86_64-linux-gnu/ld-2.27.so
0x00007ffff7ffe000 0x00007ffff7fff000 rw-p	mapped
0x00007ffffffde000 0x00007ffffffff000 rw-p	[stack]
0xffffffffff600000 0xffffffffff601000 r-xp	[vsyscall]
gdb-peda$
@cuanduo
Copy link
Author

cuanduo commented Jul 25, 2019

ignore it, may same like #46

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@cuanduo