Re: Buffer overrun in III_dequantize_sample
electricworry <[email protected]>
| Newsgroups | gmane.comp.audio.mp3.lame |
|---|---|
| Message-ID | <CABZPTZScuTOfEhU6MbRA6twbgPaVwwKwBnATDFUsc_5RyqGTQw@mail.gmail.com> |
On 21 July 2017 at 16:07, Thomas Orgis <[email protected]> wrote: > ? Do you produce a crash with/without ASan? No, this test case (and AFL/ASan has found a bunch of others) only crashes with ASan. However, it I do a normal build with -gno-stack-protector, some of the other test cases do produce a seg fault. But to stick to this one case, no; no crash is produced without ASan. > Is this different from > > https://blogs.gentoo.org/ago/2017/06/17/lame-stack-based-buffer-overflow-in-iii_dequantize_sample-layer3-c It might be; it's certainly got a near identical stack trace. However, when I run the test case linked to, I don't get a crash. > I guess that is not the full set of conditions … Yes, I feel my lack of knowledge about implementation is unhelpful. > As mpg123 developer, I am muchly interested in your input file to see > if it also triggers that. The respective code in LAME is a fork of > mpg123 and the fix is likely identical. Can you send the example to > [email protected]? I guess the first n KiB of the file can be enough. > > In any case … we should go forward with the plan to remove the decoding > code from lame and install additional hooks in libmpg123 to be able to > build the analyser. The trouble is to define the “we” here. I'm happy to send the example over and will do so now. As I mentioned earlier, testing has found a bunch of crash cases in various other functions. Some of them are further stack buffer overflows, some are global buffer overflows. However I didn't want to mention more than one to start with, as they might have the same root cause. If you'd like them, just shout. I'm sorry that I'm not able to offer better assistance, not being an audio developer. I'm assuming that these are not exploitable and very low urgency. Thanks. ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________ Lame-dev mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/lame-dev