Re: [security-report]Lame multi memory error bug && CVE Request

Fabian Greffrath <[email protected]> Sun, 07 Feb 2016 17:17:15 +0100
Newsgroups	gmane.comp.audio.mp3.lame
Message-ID	<[email protected]>
Hi there,

during the last year or so, a lot of crashes like the one you
experienced have been reported against the "lame" package in Debian.
They were all triggered by fuzzed input data and led to segmentation
faults and stack corruption. Meanwhile, we have been able to fix all of
them (i.e. the ones that were reported). The individual patches can be
found here, they have all been already applied to the lame CVS head
(thanks to rbrito):

http://anonscm.debian.org/cgit/pkg-multimedia/lame.git/tree/debian/patches

(Check the last four patches in the "series" file.)

I assume that you have experienced the crahes with the latest released
version of the lame sources, right? I am asking, because I doubt that
the crashes you have seen could be triggered with either the lame
version packaged in Debian or with lame compiled from current CVS head.
Could you please confirm this? I would check for myself, but
unfortunately you did not provide the samples with which you triggered
the crashes.

Best regards,

Fabian


Am Mittwoch, den 30.12.2015, 15:33 +0800 schrieb ChenQin:
> 
> hi,
> 
> reproduce:
> lame 2
> lame 3
> 
> Case1:
> LAME 3.99.5 64bits (http://lame.sf.net)
> Resampling:  input -2.14698e+06 kHz  output 8 kHz
> Using polyphase lowpass filter, transition band:  3903 Hz -  4000 Hz
> Encoding 2 to 2.mp3
> Encoding as 8 kHz j-stereo MPEG-2.5 Layer III (10.7x)  24 kbps qval=3
>     Frame          |  CPU time/estim | REAL time/estim | play/CPU
> |    ETA
>      0/       (
> 0%)|    0:00/     :  |    0:00/     :  |         x|     :
> 00:03--------------------------------------------------------------
> -------------------------------------------------------------------
> -------------------------------------------
>    kbps      %     %
>     0.0           ASAN:SIGSEGV
> =================================================================
> ==523==ERROR: AddressSanitizer: SEGV on unknown address
> 0x000000000000 (pc 0x00000053e651 sp 0x7ffda3f33c20 bp 0x000000000000
> T0)
>     #0 0x53e650 in fill_buffer_resample /home/k/a/lame-
> 3.99.5/libmp3lame/util.c:608
>     #1 0x53e650 in fill_buffer /home/k/a/lame-
> 3.99.5/libmp3lame/util.c:676
>     #2 0x495550 in lame_encode_buffer_sample_t /home/k/a/lame-
> 3.99.5/libmp3lame/lame.c:1736    #3 0x407127 in lame_encoder_loop
> /home/k/a/lame-3.99.5/frontend/lame_main.c:462
>     #4 0x4094b6 in lame_encoder /home/k/a/lame-
> 3.99.5/frontend/lame_main.c:531
>     #5 0x4094b6 in lame_main /home/k/a/lame-
> 3.99.5/frontend/lame_main.c:707
>     #6 0x4042c3 in c_main /home/k/a/lame-3.99.5/frontend/main.c:470
>     #7 0x4042c3 in main /home/k/a/lame-3.99.5/frontend/main.c:438
>     #8 0x7f7e77bfea3f in __libc_start_main (/lib/x86_64-linux-
> gnu/libc.so.6+0x20a3f)
>     #9 0x405a98 in _start (/usr/local/bin/lame+0x405a98)
> 
> AddressSanitizer can not provide additional info.
> SUMMARY: AddressSanitizer: SEGV /home/k/a/lame-
> 3.99.5/libmp3lame/util.c:608 fill_buffer_resample
> ==523==ABORTING
> 
> 
> Case2:
> ==1484==ERROR: AddressSanitizer: heap-buffer-overflow on address
> 0x60c00000bf78 at pc 0x5408cc bp 0x7ffff7f747d0 sp 0x7ffff7f747c0
> READ of size 4 at 0x60c00000bf78 thread T0
>     #0 0x5408cb in fill_buffer_resample /home/k/a/lame-
> 3.99.5/libmp3lame/util.c:606
>     #1 0x5408cb in fill_buffer /home/k/a/lame-
> 3.99.5/libmp3lame/util.c:676
>     #2 0x495550 in lame_encode_buffer_sample_t /home/k/a/lame-
> 3.99.5/libmp3lame/lame.c:1736
>     #3 0x407127 in lame_encoder_loop /home/k/a/lame-
> 3.99.5/frontend/lame_main.c:462
>     #4 0x4094b6 in lame_encoder /home/k/a/lame-
> 3.99.5/frontend/lame_main.c:531
>     #5 0x4094b6 in lame_main /home/k/a/lame-
> 3.99.5/frontend/lame_main.c:707
>     #6 0x4042c3 in c_main /home/k/a/lame-3.99.5/frontend/main.c:470
>     #7 0x4042c3 in main /home/k/a/lame-3.99.5/frontend/main.c:438
>     #8 0x7f37b4618a3f in __libc_start_main (/lib/x86_64-linux-
> gnu/libc.so.6+0x20a3f)
>     #9 0x405a98 in _start (/usr/local/bin/lame+0x405a98)
> 
> 0x60c00000bf78 is located 8 bytes to the left of 128-byte region
> [0x60c00000bf80,0x60c00000c000)
> allocated by thread T0 here:
>     #0 0x7f37b516e985 in __interceptor_calloc (/usr/lib/x86_64-linux-
> gnu/libasan.so.1+0x57985)
>     #1 0x53fa9c in fill_buffer_resample /home/k/a/lame-
> 3.99.5/libmp3lame/util.c:558
>     #2 0x53fa9c in fill_buffer /home/k/a/lame-
> 3.99.5/libmp3lame/util.c:676
> 
> SUMMARY: AddressSanitizer: heap-buffer-overflow /home/k/a/lame-
> 3.99.5/libmp3lame/util.c:606 fill_buffer_resample
> Shadow bytes around the buggy address:
>   0x0c187fff9790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>   0x0c187fff97a0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
>   0x0c187fff97b0: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
>   0x0c187fff97c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>   0x0c187fff97d0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
> =>0x0c187fff97e0: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa[fa]
>   0x0c187fff97f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>   0x0c187fff9800: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
>   0x0c187fff9810: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
>   0x0c187fff9820: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>   0x0c187fff9830: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
> Shadow byte legend (one shadow byte represents 8 application bytes):
>   Addressable:           00
>   Partially addressable: 01 02 03 04 05 06 07
>   Heap left redzone:       fa
>   Heap right redzone:      fb
>   Freed heap region:       fd
>   Stack left redzone:      f1
>   Stack mid redzone:       f2
>   Stack right redzone:     f3
>   Stack partial redzone:   f4
>   Stack after return:      f5
>   Stack use after scope:   f8
>   Global redzone:          f9
>   Global init order:       f6
>   Poisoned by user:        f7
>   Contiguous container OOB:fc
>   ASan internal:           fe
> ==1484==ABORTING
> 
> thanks
> 
> —
> Chen Qin / Topsec Product Security Team
> 
> 
> -------------------------------------------------------------------
> -----------
> _______________________________________________
> Lame-dev mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/lame-dev

------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=272487151&iu=/4140

_______________________________________________
Lame-dev mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/lame-dev