Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Heap-Buffer Overflow in MS_ADPCM_decode #3157

Closed
SDLBugzilla opened this issue Feb 11, 2021 · 0 comments
Closed

Heap-Buffer Overflow in MS_ADPCM_decode #3157

SDLBugzilla opened this issue Feb 11, 2021 · 0 comments

Comments

@SDLBugzilla
Copy link
Collaborator

This bug report was migrated from our old Bugzilla tracker.

These attachments are available in the static archive:

Reported in version: HG 2.0
Reported for operating system, platform: Linux, x86_64

Comments on the original bug report:

On 2019-02-06 13:35:04 +0000, Radue wrote:

Created attachment 3599
PoC

A heap buffer overflow vulnerability was discovered in SDL-1.2.15 library.

Asan output:

=================================================================
==9815==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61500000fedc at pc 0x7fbefacecd59 bp 0x7ffdc1718670 sp 0x7ffdc1718668
WRITE of size 1 at 0x61500000fedc thread T0
# 0 0x7fbefacecd58 in MS_ADPCM_decode /home/radu/apps/sdl_player_lib/SDL-1.2.15/build/../src/audio/SDL_wave.c:170:3
# 1 0x7fbefacecd58 in SDL_LoadWAV_RW /home/radu/apps/sdl_player_lib/SDL-1.2.15/build/../src/audio/SDL_wave.c:536
# 2 0x4db938 in main /home/radu/apps/sdl_player_lib/SDL-1.2.15/test/loopwave.c:76:7
# 3 0x7fbef9a5e82f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
# 4 0x4352f8 in _start (/home/radu/apps/sdl_player_lib/SDL-1.2.15/test/loopwave+0x4352f8)

0x61500000fedc is located 0 bytes to the right of 476-byte region [0x61500000fd00,0x61500000fedc)
allocated by thread T0 here:
# 0 0x4bc2c2 in malloc (/home/radu/apps/sdl_player_lib/SDL-1.2.15/test/loopwave+0x4bc2c2)
# 1 0x7fbefacea7ac in MS_ADPCM_decode /home/radu/apps/sdl_player_lib/SDL-1.2.15/build/../src/audio/SDL_wave.c:131:24
# 2 0x7fbefacea7ac in SDL_LoadWAV_RW /home/radu/apps/sdl_player_lib/SDL-1.2.15/build/../src/audio/SDL_wave.c:536
# 3 0x4db938 in main /home/radu/apps/sdl_player_lib/SDL-1.2.15/test/loopwave.c:76:7

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/radu/apps/sdl_player_lib/SDL-1.2.15/build/../src/audio/SDL_wave.c:170 MS_ADPCM_decode
Shadow bytes around the buggy address:
0x0c2a7fff9f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c2a7fff9f90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c2a7fff9fa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c2a7fff9fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c2a7fff9fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c2a7fff9fd0: 00 00 00 00 00 00 00 00 00 00 00[04]fa fa fa fa
0x0c2a7fff9fe0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c2a7fff9ff0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c2a7fffa000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c2a7fffa010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c2a7fffa020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==9815==ABORTING

PoC: See attachment

Reproducing steps:

  1. Download SDL-1.2.15 library
  2. ./configure with Asan enabled
  3. ./make
  4. sudo make install
  5. cd examples
  6. ./configure with Asan enabled
  7. make
  8. ./loopwave PoC

On 2019-02-06 14:30:40 +0000, Ryan C. Gordon wrote:

This bug is still present in SDL2's revision control, so I'm assigning it there.

--ryan.

On 2019-02-06 15:01:33 +0000, Radue wrote:

(In reply to Ryan C. Gordon from comment # 1)

This bug is still present in SDL2's revision control, so I'm assigning it
there.

--ryan.

Also reported this in a different thread.
https://bugzilla.libsdl.org/show_bug.cgi?id=4491

-- radu

On 2019-02-07 07:17:26 +0000, Radue wrote:

(In reply to Ryan C. Gordon from comment # 1)

This bug is still present in SDL2's revision control, so I'm assigning it
there.

--ryan.

Assigned CVE-2019-7575 by MITRE.

On 2019-02-14 14:07:14 +0000, Petr Pisar wrote:

Created attachment 3609
Fix

On 2019-05-18 18:48:55 +0000, Ryan C. Gordon wrote:

Tagging a bunch of bugs with "target-2.0.10" so we have a clear list of things to address before a 2.0.10 release.

Please note that "addressing" one of these bugs might mean deciding to defer on it until after 2.0.10, or resolving it as WONTFIX, etc. This is just here to tell us we should look at it carefully, and soon.

If you have new information or feedback on this issue, this is a good time to add it to the conversation, as we're likely to be paying attention to this specific report in the next few days/weeks.

Thanks!

--ryan.

On 2019-06-10 16:26:03 +0000, Sam Lantinga wrote:

This fix is in for SDL 1.2:
https://hg.libsdl.org/SDL/rev/a936f9bd3e38

Simon, can you check to make sure your changes fix this in SDL 2.0?

Thanks!

On 2019-06-10 21:00:49 +0000, Simon Hug wrote:

The WAVE file (attachment 3599) specifies a 512 byte MS ADPCM block size with only 1 sample frame per block. Depending on the interpretation of the Microsoft specification, this makes this file invalid.

With the current tip, SDL_LoadWAV_RW rejects this file with "Invalid number of samples per MS ADPCM block (wSamplesPerBlock)" as it does not support only the one header sample frame (an MS ADPCM block header has two).

On 2019-06-11 13:24:19 +0000, Sam Lantinga wrote:

Great, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant