After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 774902 - typefind: out of bounds memory read in windows_icon_typefind
typefind: out of bounds memory read in windows_icon_typefind
Status: RESOLVED FIXED
Product: GStreamer
Classification: Platform
Component: gst-plugins-base
git master
Other Linux
: Normal normal
: 1.10.2
Assigned To: GStreamer Maintainers
GStreamer Maintainers
Depends on:
Blocks:
 
 
Reported: 2016-11-23 10:15 UTC by Hanno Böck
Modified: 2016-11-23 10:41 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
poc file causing out of bounds read (10 bytes, image/x-tga)
2016-11-23 10:15 UTC, Hanno Böck 		  Details
typefind: bounds check windows ico detection (853 bytes, patch)
2016-11-23 10:29 UTC, Matthew Waters (ystreet00) 		committed Details | Review

Description Hanno Böck 2016-11-23 10:15:06 UTC 
Created attachment 340587 [details]
poc file causing out of bounds read

The attached file will cause a 4 bytes out of bounds memory read in the function windows_icon_typefind. Needs G_SLICE=always-malloc set and a memory safety tool like asan. Current git code, found with afl.

asan error:
==21113==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60f000002662 at pc 0x7f1fcc1c838c bp 0x7f1fccbf2950 sp 0x7f1fccbf2948
READ of size 4 at 0x60f000002662 thread T1 (typefind:sink)
    #0 0x7f1fcc1c838b in __gst_fast_read32 /usr/include/gstreamer-1.0/gst/gstutils.h:122:10
    #1 0x7f1fcc1c838b in windows_icon_typefind /f/gstreamer/gst-plugins-base/gst/typefind/gsttypefindfunctions.c:5249
    #2 0x7f1fd85682ec in gst_type_find_factory_call_function /f/gstreamer/gstreamer/gst/gsttypefindfactory.c:215:7
    #3 0x7f1fd8a7b3ba in gst_type_find_helper_get_range /f/gstreamer/gstreamer/libs/gst/base/gsttypefindhelper.c:353:5
    #4 0x7f1fcccff64a in gst_type_find_element_loop /f/gstreamer/gstreamer/plugins/elements/gsttypefindelement.c:1134:13
    #5 0x7f1fd855a5c3 in gst_task_func /f/gstreamer/gstreamer/gst/gsttask.c:334:5
    #6 0x7f1fd7759867  (/usr/lib64/libglib-2.0.so.0+0x70867)
    #7 0x7f1fd7758ed4  (/usr/lib64/libglib-2.0.so.0+0x6fed4)
    #8 0x7f1fd71d6443 in start_thread (/lib64/libpthread.so.0+0x7443)
    #9 0x7f1fd6d0592c in clone (/lib64/libc.so.6+0xe792c)

0x60f000002662 is located 1 bytes to the right of 161-byte region [0x60f0000025c0,0x60f000002661)
allocated by thread T1 (typefind:sink) here:
    #0 0x4d4e28 in malloc (/usr/bin/gst-discoverer-1.0+0x4d4e28)
    #1 0x7f1fd77383a8 in g_malloc (/usr/lib64/libglib-2.0.so.0+0x4f3a8)

Thread T1 (typefind:sink) created by T0 here:
    #0 0x42e26d in __interceptor_pthread_create (/usr/bin/gst-discoverer-1.0+0x42e26d)
    #1 0x7f1fd7776adf  (/usr/lib64/libglib-2.0.so.0+0x8dadf)
Comment 1 Matthew Waters (ystreet00) 2016-11-23 10:29:19 UTC 
Created attachment 340588 [details] [review]
typefind: bounds check windows ico detection
Comment 2 Matthew Waters (ystreet00) 2016-11-23 10:33:00 UTC 
commit 8f7ece78afe6272de2272713b78b20d0f8e164ab
Author: Matthew Waters <matthew@centricular.com>
Date:   Wed Nov 23 21:27:55 2016 +1100

    typefind: bounds check windows ico detection
    
    Fixes out of bounds read
    
    https://bugzilla.gnome.org/show_bug.cgi?id=774902
Comment 3 Matthew Waters (ystreet00) 2016-11-23 10:41:19 UTC 
1.8 71f367c297ccfeebf7ff54439d9e69e601efd949
1.10 e62da134316082bf053f10c40d63f772536e2b13
master 2fdccfd64fc609e44e9c4b8eed5bfdc0ab9c9095