GNOME Bugzilla – Bug 774902
typefind: out of bounds memory read in windows_icon_typefind
Last modified: 2016-11-23 10:41:57 UTC
Created attachment 340587 [details] poc file causing out of bounds read The attached file will cause a 4 bytes out of bounds memory read in the function windows_icon_typefind. Needs G_SLICE=always-malloc set and a memory safety tool like asan. Current git code, found with afl. asan error: ==21113==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60f000002662 at pc 0x7f1fcc1c838c bp 0x7f1fccbf2950 sp 0x7f1fccbf2948 READ of size 4 at 0x60f000002662 thread T1 (typefind:sink) #0 0x7f1fcc1c838b in __gst_fast_read32 /usr/include/gstreamer-1.0/gst/gstutils.h:122:10 #1 0x7f1fcc1c838b in windows_icon_typefind /f/gstreamer/gst-plugins-base/gst/typefind/gsttypefindfunctions.c:5249 #2 0x7f1fd85682ec in gst_type_find_factory_call_function /f/gstreamer/gstreamer/gst/gsttypefindfactory.c:215:7 #3 0x7f1fd8a7b3ba in gst_type_find_helper_get_range /f/gstreamer/gstreamer/libs/gst/base/gsttypefindhelper.c:353:5 #4 0x7f1fcccff64a in gst_type_find_element_loop /f/gstreamer/gstreamer/plugins/elements/gsttypefindelement.c:1134:13 #5 0x7f1fd855a5c3 in gst_task_func /f/gstreamer/gstreamer/gst/gsttask.c:334:5 #6 0x7f1fd7759867 (/usr/lib64/libglib-2.0.so.0+0x70867) #7 0x7f1fd7758ed4 (/usr/lib64/libglib-2.0.so.0+0x6fed4) #8 0x7f1fd71d6443 in start_thread (/lib64/libpthread.so.0+0x7443) #9 0x7f1fd6d0592c in clone (/lib64/libc.so.6+0xe792c) 0x60f000002662 is located 1 bytes to the right of 161-byte region [0x60f0000025c0,0x60f000002661) allocated by thread T1 (typefind:sink) here: #0 0x4d4e28 in malloc (/usr/bin/gst-discoverer-1.0+0x4d4e28) #1 0x7f1fd77383a8 in g_malloc (/usr/lib64/libglib-2.0.so.0+0x4f3a8) Thread T1 (typefind:sink) created by T0 here: #0 0x42e26d in __interceptor_pthread_create (/usr/bin/gst-discoverer-1.0+0x42e26d) #1 0x7f1fd7776adf (/usr/lib64/libglib-2.0.so.0+0x8dadf)
Created attachment 340588 [details] [review] typefind: bounds check windows ico detection
commit 8f7ece78afe6272de2272713b78b20d0f8e164ab Author: Matthew Waters <matthew@centricular.com> Date: Wed Nov 23 21:27:55 2016 +1100 typefind: bounds check windows ico detection Fixes out of bounds read https://bugzilla.gnome.org/show_bug.cgi?id=774902
1.8 71f367c297ccfeebf7ff54439d9e69e601efd949 1.10 e62da134316082bf053f10c40d63f772536e2b13 master 2fdccfd64fc609e44e9c4b8eed5bfdc0ab9c9095