Opened 13 years ago
Closed 13 years ago
#1203 closed defect (fixed)
Illegal Data Usage in Avcodec
Reported by: | John Villamil | Owned by: | |
---|---|---|---|
Priority: | critical | Component: | avcodec |
Version: | git-master | Keywords: | crash SIGSEGV wmapro |
Cc: | Blocked By: | ||
Blocking: | Reproduced by developer: | yes | |
Analyzed by developer: | no |
Description
An attacker may be able to create a file that reads data from an unintended location in memory. This data is trusted and used by the application in a way which may enable code execution.
(21268.22868): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
avcodec_54!ff_dct32_float_sse2+0x12ae7:
6a5999f7 0f280c11 movaps xmm1,xmmword ptr [ecx+edx] ds:002b:00000070=????????????????????????????????
0:009:x86> $<dbgcomm.txt
0:009:x86> r
eax=ffffffc0 ebx=02f62d80 ecx=00000040 edx=00000030 esi=02f62d80 edi=02f62d80
eip=6a5999f7 esp=048dfc10 ebp=02f62d80 iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202
avcodec_54!ff_dct32_float_sse2+0x12ae7:
6a5999f7 0f280c11 movaps xmm1,xmmword ptr [ecx+edx] ds:002b:00000070=????????????????????????????????
0:009:x86> !load winext\msec.dll
0:009:x86> !exploitable
* ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll32.dll -
* ERROR: Symbol file could not be found. Defaulted to export symbols for C:\windows\syswow64\KERNELBASE.dll -
Exploitability Classification: PROBABLY_EXPLOITABLE
Recommended Bug Title: Probably Exploitable - Data from Faulting Address controls subsequent Write Address starting at avcodec_54!ff_dct32_float_sse2+0x0000000000012ae7 (Hash=0x6a521235.0x0b720433)
The data from the faulting address is later used as the target for a later write.
0:009:x86> q
quit:
0:009> kn
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may be wrong.
00 0471fba8 6a585144 avcodec_54!ff_dct32_float_sse2+0x12ae7
01 0471fc68 6a1216b2 avcodec_54!avpriv_vorbis_parse_reset+0x46764
02 0471fca8 6a583045 avcodec_54!avpriv_copy_bits+0x222
03 0471fce8 6a586319 avcodec_54!avpriv_vorbis_parse_reset+0x44665
04 0471fd38 6a50549a avcodec_54!avpriv_vorbis_parse_reset+0x47939
* ERROR: Module load completed but symbols could not be loaded for image00400000
05 0471fdc8 00405109 avcodec_54!avcodec_decode_audio4+0x9a
06 0471fe38 75750ac4 image00400000+0x5109
07 0471fed8 0040e37f KERNELBASEWaitForSingleObjectEx+0xcb
08 0471ff18 004161b8 image00400000+0xe37f
09 0471ff38 0041620e image00400000+0x161b8
0a 0471ff48 763f1287 image00400000+0x1620e
0b 0471ff80 763f1328 msvcrt!_endthreadex+0x44
0c 0471ff88 7526339a msvcrt!_endthreadex+0xce
0d 0471ff94 77129ef2 kernel32BaseThreadInitThunk+0xe
0e 0471ffd4 77129ec5 ntdll__RtlUserThreadStart+0x70
0f 0471ffec 00000000 ntdll!_RtlUserThreadStart+0x1b
This was tested on the shared build from 2012-04-09 found at http://ffmpeg.zeranoe.com/builds/
A PoC file is at:
http://w.rdtsc.net/ffmpegmkv/ProbablyExploitable/ReadandWrite.zip
Thanks,
John Villamil
Change History (3)
comment:1 by , 13 years ago
Keywords: | crash SIGSEGV wmapro added |
---|---|
Reproduced by developer: | set |
Status: | new → open |
Version: | unspecified → git-master |
comment:2 by , 13 years ago
Also reproducible with --disable-optimizations --disable-asm --disable-yasm.
... Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0xb7bc46c0 (LWP 8447)] 0x0828cdeb in vector_fmul_window_c (dst=0x8e2b5a0, src0=0x8e2b5a0, src1=0x8e2b5a0, win=0x40, len=16) at libavcodec/dsputil.c:2506 2506 float wi = win[i]; (gdb) bt #0 0x0828cdeb in vector_fmul_window_c (dst=0x8e2b5a0, src0=0x8e2b5a0, src1=0x8e2b5a0, win=0x40, len=16) at libavcodec/dsputil.c:2506 #1 0x08584770 in wmapro_window (s=0x8e18880) at libavcodec/wmaprodec.c:1045 #2 0x08585459 in decode_subframe (s=0x8e18880) at libavcodec/wmaprodec.c:1275 #3 0x0858583c in decode_frame (s=0x8e18880, got_frame_ptr=0xbff11624) at libavcodec/wmaprodec.c:1364 #4 0x08586243 in decode_packet (avctx=0x8de3df0, data=0x8de3470, got_frame_ptr=0xbff11624, avpkt=0xbff1143c) at libavcodec/wmaprodec.c:1573 #5 0x0850e7c2 in avcodec_decode_audio4 (avctx=0x8de3df0, frame=0x8de3470, got_frame_ptr=0xbff11624, avpkt=0xbff115d4) at libavcodec/utils.c:1541 #6 0x08051a0c in transcode_audio (ist=0x8de5700, pkt=0xbff115d4, got_output=0xbff11624) at ffmpeg.c:2005 #7 0x0805298f in output_packet (ist=0x8de5700, ost_table=0x8de5768, nb_ostreams=1, pkt=0xbff12968) at ffmpeg.c:2289 #8 0x08056590 in transcode (output_files=0x8de4d50, nb_output_files=1, input_files=0x8dddc10, nb_input_files=1) at ffmpeg.c:3163 #9 0x0805dcfe in main (argc=6, argv=0xbff12da4) at ffmpeg.c:5275 (gdb) disass $pc-32 $pc+32 Dump of assembler code from 0x828cdcb to 0x828ce0b: 0x0828cdcb <vector_fmul_window_c+57>: add (%ebx),%al 0x0828cdcd <vector_fmul_window_c+59>: inc %ebp 0x0828cdce <vector_fmul_window_c+60>: or $0x8b,%al 0x0828cdd0 <vector_fmul_window_c+62>: add %cl,0x458bf045(%ecx) 0x0828cdd6 <vector_fmul_window_c+68>: in (%dx),%al 0x0828cdd7 <vector_fmul_window_c+69>: shl $0x2,%eax 0x0828cdda <vector_fmul_window_c+72>: add 0x10(%ebp),%eax 0x0828cddd <vector_fmul_window_c+75>: mov (%eax),%eax 0x0828cddf <vector_fmul_window_c+77>: mov %eax,-0xc(%ebp) 0x0828cde2 <vector_fmul_window_c+80>: mov -0x18(%ebp),%eax 0x0828cde5 <vector_fmul_window_c+83>: shl $0x2,%eax 0x0828cde8 <vector_fmul_window_c+86>: add 0x14(%ebp),%eax 0x0828cdeb <vector_fmul_window_c+89>: mov (%eax),%eax 0x0828cded <vector_fmul_window_c+91>: mov %eax,-0x8(%ebp) 0x0828cdf0 <vector_fmul_window_c+94>: mov -0x14(%ebp),%eax 0x0828cdf3 <vector_fmul_window_c+97>: shl $0x2,%eax 0x0828cdf6 <vector_fmul_window_c+100>: add 0x14(%ebp),%eax 0x0828cdf9 <vector_fmul_window_c+103>: mov (%eax),%eax 0x0828cdfb <vector_fmul_window_c+105>: mov %eax,-0x4(%ebp) 0x0828cdfe <vector_fmul_window_c+108>: mov -0x18(%ebp),%eax 0x0828ce01 <vector_fmul_window_c+111>: shl $0x2,%eax 0x0828ce04 <vector_fmul_window_c+114>: add 0x8(%ebp),%eax 0x0828ce07 <vector_fmul_window_c+117>: flds -0x10(%ebp) 0x0828ce0a <vector_fmul_window_c+120>: fmuls -0x4(%ebp) (gdb) info register eax 0x0 0 ecx 0x828cd92 136891794 edx 0x8e2b5a0 149075360 ebx 0x0 0 esp 0xbff11248 0xbff11248 ebp 0xbff11268 0xbff11268 esi 0x0 0 edi 0x15a5810 22698000 eip 0x828cdeb 0x828cdeb <vector_fmul_window_c+89> eflags 0x210247 [ CF PF ZF IF RF ID ] cs 0x73 115 ss 0x7b 123 ds 0x7b 123 es 0x7b 123 fs 0x0 0 gs 0x33 51