ffmpeg 3.1.2 Heap Overflow

2016.09.08
Credit: Yaoguang Chen
Risk: High
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-119

======= Product: ffmpeg Affected Versions: <= 3.1.2 Vulnerability Type: Heap Overflow Security Risk: High Credit: Yaoguang Chen of Aliapy unLimit Security Team Introduction ============ $ ffmpeg_debug_312/bin/ffmpeg -i tiled_with_deeptile_type.exr -y xx.png ffmpeg version 3.1.2 Copyright (c) 2000-2016 the FFmpeg developers built with gcc 4.8 (Ubuntu 4.8.4-2ubuntu1~14.04.3) configuration: --prefix=/home/burningcodes/ffmpeg_debug_312/ --disable-yasm --assert-level=2 --enable-debug=3 --disable-optimizations --disable-asm --disable-stripping libavutil 55. 28.100 / 55. 28.100 libavcodec 57. 48.101 / 57. 48.101 libavformat 57. 41.100 / 57. 41.100 libavdevice 57. 0.101 / 57. 0.101 libavfilter 6. 47.100 / 6. 47.100 libswscale 4. 1.100 / 4. 1.100 libswresample 2. 1.100 / 2. 1.100 *** Error in `ffmpeg_debug_312/bin/ffmpeg': free(): invalid next size (normal): 0x00000000024a44c0 *** Aborted (core dumped) gdb backtrace: $ gdb ffmpeg_debug_312/bin/ffmpeg /tmp/core.1471448229 -q Reading symbols from ffmpeg_debug_312/bin/ffmpeg...done. [New LWP 6771] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Core was generated by `ffmpeg_debug_312/bin/ffmpeg -i tiled_with_deeptile_type.exr -y xx.png'. Program terminated with signal SIGABRT, Aborted. #0 0x00007f100f696267 in __GI_raise (sig=sig@entry=0x6) at ../sysdeps/unix/sysv/linux/raise.c:55 55 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory. gdb-peda$ bt #0 0x00007f100f696267 in __GI_raise (sig=sig@entry=0x6) at ../sysdeps/unix/sysv/linux/raise.c:55 #1 0x00007f100f697eca in __GI_abort () at abort.c:89 #2 0x00007f100f6d9c53 in __libc_message (do_abort=do_abort@entry=0x1, fmt=fmt@entry=0x7f100f7f21a8 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175 #3 0x00007f100f6e1c69 in malloc_printerr (ptr=<optimized out>, str=0x7f100f7f2300 "free(): invalid next size (normal)", action=0x1) at malloc.c:4965 #4 _int_free (av=<optimized out>, p=<optimized out>, have_lock=0x0) at malloc.c:3834 #5 0x00007f100f6e589c in __GI___libc_free (mem=<optimized out>) at malloc.c:2950 #6 0x00000000013e3039 in av_free (ptr=0x24a44c0) at libavutil/mem.c:239 #7 0x00000000013d149c in av_buffer_default_free (opaque=0x0, data=0x24a44c0 "\377\377\360j \241\377\377\377\377\020^") at libavutil/buffer.c:63 #8 0x00000000013d165d in buffer_replace (dst=0x7ffd71aa3180, src=0x0) at libavutil/buffer.c:119 #9 0x00000000013d169d in av_buffer_unref (buf=0x7ffd71aa3180) at libavutil/buffer.c:129 #10 0x00000000008184e6 in av_packet_unref (pkt=0x7ffd71aa3180) at libavcodec/avpacket.c:566 #11 0x000000000069e1bb in ff_img_read_packet (s1=0x248c2c0, pkt=0x7ffd71aa3180) at libavformat/img2dec.c:502 #12 0x00000000007a4dc1 in ff_read_packet (s=0x248c2c0, pkt=0x7ffd71aa3180) at libavformat/utils.c:759 #13 0x00000000007a7ef3 in read_frame_internal (s=0x248c2c0, pkt=0x7ffd71aa3460) at libavformat/utils.c:1457 #14 0x00000000007af3c4 in avformat_find_stream_info (ic=0x248c2c0, options=0x248d110) at libavformat/utils.c:3475 #15 0x00000000004103f2 in open_input_file (o=0x7ffd71aa37b0, filename=0x7ffd71aa41c6 "tiled_with_deeptile_type.exr") at ffmpeg_opt.c:1002 #16 0x0000000000419274 in open_files (l=0x248c058, inout=0x1413717 "input", open_file=0x40fa95 <open_input_file>) at ffmpeg_opt.c:3036 #17 0x0000000000419401 in ffmpeg_parse_options (argc=0x5, argv=0x7ffd71aa3d98) at ffmpeg_opt.c:3073 #18 0x000000000042e8a6 in main (argc=0x5, argv=0x7ffd71aa3d98) at ffmpeg.c:4335 #19 0x00007f100f681a40 in __libc_start_main (main=0x42e7c6 <main>, argc=0x5, argv=0x7ffd71aa3d98, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffd71aa3d88) at libc-start.c:289 #20 0x00000000004061c9 in _start ()


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top