Re: Buffer overrun in III_dequantize_sample

electricworry <[email protected]>
Newsgroups gmane.comp.audio.mp3.lame
Message-ID <CABZPTZScuTOfEhU6MbRA6twbgPaVwwKwBnATDFUsc_5RyqGTQw@mail.gmail.com>
On 21 July 2017 at 16:07, Thomas Orgis <[email protected]> wrote:
> ? Do you produce a crash with/without ASan?

No, this test case (and AFL/ASan has found a bunch of others) only
crashes with ASan. However, it I do a normal build with
-gno-stack-protector, some of the other test cases do produce a seg
fault.

But to stick to this one case, no; no crash is produced without ASan.

> Is this different from
>
>         https://blogs.gentoo.org/ago/2017/06/17/lame-stack-based-buffer-overflow-in-iii_dequantize_sample-layer3-c

It might be; it's certainly got a near identical stack trace. However,
when I run the test case linked to, I don't get a crash.

> I guess that is not the full set of conditions …

Yes, I feel my lack of knowledge about implementation is unhelpful.

> As mpg123 developer, I am muchly interested in your input file to see
> if it also triggers that. The respective code in LAME is a fork of
> mpg123 and the fix is likely identical. Can you send the example to
> [email protected]? I guess the first n KiB of the file can be enough.
>
> In any case … we should go forward with the plan to remove the decoding
> code from lame and install additional hooks in libmpg123 to be able to
> build the analyser. The trouble is to define the “we” here.

I'm happy to send the example over and will do so now.

As I mentioned earlier, testing has found a bunch of crash cases in
various other functions. Some of them are further stack buffer
overflows, some are global buffer overflows. However I didn't want to
mention more than one to start with, as they might have the same root
cause. If you'd like them, just shout.

I'm sorry that I'm not able to offer better assistance, not being an
audio developer. I'm assuming that these are not exploitable and very
low urgency.

Thanks.

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Lame-dev mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/lame-dev
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.