[FFmpeg-trac] #11389(avformat:new): heap-buffer-overflow at libavformat/dump.c:792:34 on ffmpeg

[FFmpeg]

#11389: heap-buffer-overflow at libavformat/dump.c:792:34 on ffmpeg
----------------------------------+--------------------------------------
             Reporter:  0x20z     |                     Type:  defect
               Status:  new       |                 Priority:  important
            Component:  avformat  |                  Version:  git-master
             Keywords:  bugs      |               Blocked By:
             Blocking:            |  Reproduced by developer:  0
Analyzed by developer:  0         |
----------------------------------+--------------------------------------
 Summary of the bug:
 Dear developers,
 I discovered a heap overflow vulnerability while using format conversion.
 The POC file is attached to the session, and the version of ffmpeg is
 N-118197-gbb85423142, master branch. please confirm.

 How to reproduce:
 {{{
 git clone https://github.com/FFmpeg/FFmpeg.git
 cd FFmpeg
 ./configure --cc=clang --cxx=clang++ --toolchain=clang-asan --extra-
 cflags="-I$HOME/ffmpeg_build/include -O0 -fno-omit-frame-pointer -g"
 --extra-cxxflags="-O0 -fno-omit-frame-pointer -g" --extra-
 ldflags="-L$HOME/ffmpeg_build/include -fsanitize=address
 -fsanitize=undefined -lubsan" --disable-optimizations --disable-stripping
 --enable-cross-compile
 make -j30
 }}}

 ASAN log:
 {{{
 =================================================================
 ==1366945==ERROR: AddressSanitizer: heap-buffer-overflow on address
 0x613000001db8 at pc 0x5c82931d7ca9 bp 0x7ffc11d48a90 sp 0x7ffc11d48a88
 READ of size 8 at 0x613000001db8 thread T0
     #0 0x5c82931d7ca8  (FFmpeg/ffmpeg+0x13f0ca8) (BuildId:
 d9813d42ed110d0d0780865381db8c33a24a231c)
     #1 0x5c82927865a3  (FFmpeg/ffmpeg+0x99f5a3) (BuildId:
 d9813d42ed110d0d0780865381db8c33a24a231c)
     #2 0x5c82927c8e0b  (FFmpeg/ffmpeg+0x9e1e0b) (BuildId:
 d9813d42ed110d0d0780865381db8c33a24a231c)
     #3 0x5c82927f60ef  (FFmpeg/ffmpeg+0xa0f0ef) (BuildId:
 d9813d42ed110d0d0780865381db8c33a24a231c)
     #4 0x7ee34e629d8f in __libc_start_call_main
 csu/../sysdeps/nptl/libc_start_call_main.h:58:16
     #5 0x7ee34e629e3f in __libc_start_main csu/../csu/libc-start.c:392:3
     #6 0x5c82926b7ce4  (FFmpeg/ffmpeg+0x8d0ce4) (BuildId:
 d9813d42ed110d0d0780865381db8c33a24a231c)

 0x613000001db8 is located 0 bytes to the right of 376-byte region
 [0x613000001c40,0x613000001db8)
 allocated by thread T0 here:
     #0 0x5c829273af56 in realloc (FFmpeg/ffmpeg+0x953f56) (BuildId:
 d9813d42ed110d0d0780865381db8c33a24a231c)
     #1 0x5c82934420cd  (FFmpeg/ffmpeg+0x165b0cd) (BuildId:
 d9813d42ed110d0d0780865381db8c33a24a231c)
     #2 0x5c82931b05e8  (FFmpeg/ffmpeg+0x13c95e8) (BuildId:
 d9813d42ed110d0d0780865381db8c33a24a231c)
     #3 0x5c8292783233  (FFmpeg/ffmpeg+0x99c233) (BuildId:
 d9813d42ed110d0d0780865381db8c33a24a231c)
     #4 0x5c82927c8e0b  (FFmpeg/ffmpeg+0x9e1e0b) (BuildId:
 d9813d42ed110d0d0780865381db8c33a24a231c)
     #5 0x5c82927f60ef  (FFmpeg/ffmpeg+0xa0f0ef) (BuildId:
 d9813d42ed110d0d0780865381db8c33a24a231c)
     #6 0x7ee34e629d8f in __libc_start_call_main
 csu/../sysdeps/nptl/libc_start_call_main.h:58:16

 SUMMARY: AddressSanitizer: heap-buffer-overflow (FFmpeg/ffmpeg+0x13f0ca8)
 (BuildId: d9813d42ed110d0d0780865381db8c33a24a231c)
 Shadow bytes around the buggy address:
   0x0c267fff8360: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
   0x0c267fff8370: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa
   0x0c267fff8380: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
   0x0c267fff8390: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c267fff83a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 =>0x0c267fff83b0: 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa
   0x0c267fff83c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
   0x0c267fff83d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
   0x0c267fff83e0: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c267fff83f0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
   0x0c267fff8400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 Shadow byte legend (one shadow byte represents 8 application bytes):
   Addressable:           00
   Partially addressable: 01 02 03 04 05 06 07
   Heap left redzone:       fa
   Freed heap region:       fd
   Stack left redzone:      f1
   Stack mid redzone:       f2
   Stack right redzone:     f3
   Stack after return:      f5
   Stack use after scope:   f8
   Global redzone:          f9
   Global init order:       f6
   Poisoned by user:        f7
   Container overflow:      fc
   Array cookie:            ac
   Intra object redzone:    bb
   ASan internal:           fe
   Left alloca redzone:     ca
   Right alloca redzone:    cb
 ==1366945==ABORTING

 }}}

 ffmpeg version:
 {{{
 # ./ffmpeg -version
 ffmpeg version N-118197-gbb85423142 Copyright (c) 2000-2024 the FFmpeg
 developers
 built with Ubuntu clang version 14.0.0-1ubuntu1.1
 configuration: --cc=clang --cxx=clang++ --ld=clang --enable-debug
 --toolchain=clang-asan --enable-cross-compile
 libavutil      59. 53.100 / 59. 53.100
 libavcodec     61. 28.100 / 61. 28.100
 libavformat    61.  9.102 / 61.  9.102
 libavdevice    61.  4.100 / 61.  4.100
 libavfilter    10.  6.101 / 10.  6.101
 libswscale      8. 13.100 /  8. 13.100
 libswresample   5.  4.100 /  5.  4.100

 }}}

 Found by：
 {{{
 Found by 0x20z
 }}}

 Thank you for your time and attention
-- 
Ticket URL: <https://trac.ffmpeg.org/ticket/11389>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker