[security-report]Lame multi memory error bug && CVE Request

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

hi,

reproduce:
lame 2
lame 3

Case1:
LAME 3.99.5 64bits (http://lame.sf.net)
Resampling:  input -2.14698e+06 kHz  output 8 kHz
Using polyphase lowpass filter, transition band:  3903 Hz -  4000 Hz
Encoding 2 to 2.mp3
Encoding as 8 kHz j-stereo MPEG-2.5 Layer III (10.7x)  24 kbps qval=3
    Frame          |  CPU time/estim | REAL time/estim | play/CPU |    ETA
     0/       ( 0%)|    0:00/     :  |    0:00/     :  |         x|     :
00:03----------------------------------------------------------------------------------------------------------------------------------------------------------------------------
   kbps      %     %
    0.0           ASAN:SIGSEGV
=================================================================
==523==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000053e651 sp 0x7ffda3f33c20 bp 0x000000000000 T0)
    #0 0x53e650 in fill_buffer_resample /home/k/a/lame-3.99.5/libmp3lame/util.c:608
    #1 0x53e650 in fill_buffer /home/k/a/lame-3.99.5/libmp3lame/util.c:676
    #2 0x495550 in lame_encode_buffer_sample_t /home/k/a/lame-3.99.5/libmp3lame/lame.c:1736    #3 0x407127 in lame_encoder_loop /home/k/a/lame-3.99.5/frontend/lame_main.c:462
    #4 0x4094b6 in lame_encoder /home/k/a/lame-3.99.5/frontend/lame_main.c:531
    #5 0x4094b6 in lame_main /home/k/a/lame-3.99.5/frontend/lame_main.c:707
    #6 0x4042c3 in c_main /home/k/a/lame-3.99.5/frontend/main.c:470
    #7 0x4042c3 in main /home/k/a/lame-3.99.5/frontend/main.c:438
    #8 0x7f7e77bfea3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x20a3f)
    #9 0x405a98 in _start (/usr/local/bin/lame+0x405a98)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/k/a/lame-3.99.5/libmp3lame/util.c:608 fill_buffer_resample
==523==ABORTING


Case2:
==1484==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60c00000bf78 at pc 0x5408cc bp 0x7ffff7f747d0 sp 0x7ffff7f747c0
READ of size 4 at 0x60c00000bf78 thread T0
    #0 0x5408cb in fill_buffer_resample /home/k/a/lame-3.99.5/libmp3lame/util.c:606
    #1 0x5408cb in fill_buffer /home/k/a/lame-3.99.5/libmp3lame/util.c:676
    #2 0x495550 in lame_encode_buffer_sample_t /home/k/a/lame-3.99.5/libmp3lame/lame.c:1736
    #3 0x407127 in lame_encoder_loop /home/k/a/lame-3.99.5/frontend/lame_main.c:462
    #4 0x4094b6 in lame_encoder /home/k/a/lame-3.99.5/frontend/lame_main.c:531
    #5 0x4094b6 in lame_main /home/k/a/lame-3.99.5/frontend/lame_main.c:707
    #6 0x4042c3 in c_main /home/k/a/lame-3.99.5/frontend/main.c:470
    #7 0x4042c3 in main /home/k/a/lame-3.99.5/frontend/main.c:438
    #8 0x7f37b4618a3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x20a3f)
    #9 0x405a98 in _start (/usr/local/bin/lame+0x405a98)

0x60c00000bf78 is located 8 bytes to the left of 128-byte region [0x60c00000bf80,0x60c00000c000)
allocated by thread T0 here:
    #0 0x7f37b516e985 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x57985)
    #1 0x53fa9c in fill_buffer_resample /home/k/a/lame-3.99.5/libmp3lame/util.c:558
    #2 0x53fa9c in fill_buffer /home/k/a/lame-3.99.5/libmp3lame/util.c:676

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/k/a/lame-3.99.5/libmp3lame/util.c:606 fill_buffer_resample
Shadow bytes around the buggy address:
  0x0c187fff9790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c187fff97a0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c187fff97b0: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
  0x0c187fff97c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c187fff97d0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
=>0x0c187fff97e0: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa[fa]
  0x0c187fff97f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c187fff9800: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c187fff9810: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
  0x0c187fff9820: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c187fff9830: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Contiguous container OOB:fc
  ASan internal:           fe
==1484==ABORTING

thanks

—
Chen Qin / Topsec Product Security Team
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCAAGBQJWg4i6AAoJEIVElDCpqHYPAs8QAMQn5fQgqHfRQ1Z2TQpK29vT
00IWmcti7/g6PJSF6I3NBJuyT7PPPVecsLQBvkuvYVBm2sz482DBZghNpWwnLaiL
qvAaf/GgUQKrnhd6SSR/L9PUwA/pZ+OGB2Fy4gqC8/SBtEC35WY+3pj7oIbzfYYp
QRdEX0O3DZrPAhUM3DH9DTyqYR8VlGosg3iXnQZ3Zqa3xRq0daOip9izTx6Mu4Is
FalOJfyUoUtTcY7PCnZ7c8I5OU7xpqiLsXIGlqVMKz0tJAcSFJJnDQDDegcf1+pS
1xsz3Cu1jrIqwnK2bvbJGTEOyPbKc9AdXh9PBBV9csJ6wGEvsfwCrJZB9BRqLdrp
vvQ6CzjLK3+SQrerUOUbEUR/p99I/GkmP/cEIb2/vukDiMwDncvjvHFasgA3qD9R
w1Ny8F38PlweESyvZQwMqCnrGOnqXtga8L/SxGnT8W10n4UUrRP3h8NtPWcQmu4v
3/T9383yNUq7RZdUgv2jOHNerjjTPL9QWbquyOHYKXi5pLSJOB6DEHt1BjN++/vM
ZkiTC3iCcaR/3M/UPs31Q09LGDgE1zARO+hrFrQqs6Ha5irWS/sfF33yGai9Zc3/
zKRHP1k870FfkpMECEODK9BsXi19HCklL1KuyPfDrGYQD6n9htqWd8/2ziNA4gP1
x7aJk8dGIhqYDBVcTL+q
=Uyb4
-----END PGP SIGNATURE-----

------------------------------------------------------------------------------

_______________________________________________
Lame-dev mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/lame-dev