Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] global buffer overflow when parsing TS format #1428

Open
6 of 7 tasks
Me19m4 opened this issue Mar 23, 2022 · 1 comment
Open
6 of 7 tasks

[BUG] global buffer overflow when parsing TS format #1428

Me19m4 opened this issue Mar 23, 2022 · 1 comment

Comments

@Me19m4
Copy link

Me19m4 commented Mar 23, 2022

CCExtractor version: {replace with the version}

Version: 0.94

In raising this issue, I confirm the following:

  • I have read and understood the contributors guide.

  • I have checked that the bug-fix I am reporting can be replicated, or that the feature I am suggesting isn't already present.

  • I have checked that the issue I'm posting isn't already reported.

  • I have checked that the issue I'm porting isn't already solved and no duplicates exist in closed issues and in opened issues

  • I have checked the pull requests tab for existing solutions/implementations to my issue/suggestion.

  • I have used the latest available version of CCExtractor to verify this issue exists.

  • I have ticked all the boxes in this section and to prove it I'm deleting the section completely to remove boilerplate text.

  • What platform did you use? {Window/Linux/Mac}

    Ubuntu21.10

  • What were the used arguments?

    ./ccextractor global_example.ts

Additional information


==3374324==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000001844050 at pc 0x0000016061df bp 0x7ffcd288a9f0 sp 0x7ffcd288a9e8
READ of size 8 at 0x000001844050 thread T0
    #0 0x16061de in slice_header /home/moqi/ccextractor/src/lib_ccx/avc_functions.c:1166:5
    #1 0x1600b09 in do_NAL /home/moqi/ccextractor/src/lib_ccx/avc_functions.c:125:3
    #2 0x160743c in process_avc /home/moqi/ccextractor/src/lib_ccx/avc_functions.c:249:3
    #3 0x167c4c2 in process_data /home/moqi/ccextractor/src/lib_ccx/general_loop.c:721:9
    #4 0x168281f in general_loop /home/moqi/ccextractor/src/lib_ccx/general_loop.c:1025:10
    #5 0x1107d55 in api_start /home/moqi/ccextractor/src/ccextractor.c:205:11
    #6 0x110bed3 in main /home/moqi/ccextractor/src/ccextractor.c:463:18
    #7 0x7fe847049fcf in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #8 0x7fe84704a07c in __libc_start_main csu/../csu/libc-start.c:409:3
    #9 0x58c604 in _start (/home/moqi/ccextractor/src/build/ccextractor+0x58c604)

0x000001844050 is located 0 bytes to the right of global variable 'slice_types' defined in '/home/moqi/ccextractor/src/lib_ccx/ccx_common_constants.c:91:13' (0x1844000) of size 80
SUMMARY: AddressSanitizer: global-buffer-overflow /home/moqi/ccextractor/src/lib_ccx/avc_functions.c:1166:5 in slice_header
Shadow bytes around the buggy address:
  0x0000803007b0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
  0x0000803007c0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
  0x0000803007d0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
  0x0000803007e0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
  0x0000803007f0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
=>0x000080300800: 00 00 00 00 00 00 00 00 00 00[f9]f9 f9 f9 f9 f9
  0x000080300810: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
  0x000080300820: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
  0x000080300830: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
  0x000080300840: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
  0x000080300850: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

global_example.ts link :

https://drive.google.com/file/d/1CiRfzglUdyyXz3PwLvJmbJCl9-03SIuj/view?usp=sharing

@cfsmp3
Copy link
Contributor

cfsmp3 commented Mar 23, 2023

Confirmed. This one -I suspect- won't be trivial.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants