[<prev] [next>] [day] [month] [year] [list]
Message-ID: <A962A2D04FAB5C4499FEFD15B642FA0A32B53451@EX02.corp.qihoo.net>
Date: Thu, 8 Dec 2016 02:33:57 +0000
From: 连一汉 <lianyihan@....cn>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: [CVE-2016-9561] ffmpeg crashes on decoding MOV file
Hi , I’m Lian Yihan ,a security researcher in Qihoo 360 Gear Team.
I found a vulnerability in ffmpeg <= 3.2. When ffmpeg decodes a small craft MOV file which is just a few megabits, it will allocate a huge memory(about a few gigabits) and then be killed by OS .
========================= target version ==========================
Ffmpeg 3.2
========================= target command =========================
Ffmpeg -i input.mov -y 1.ts
============================= key information ==========================
0x00000000007ae7b6 in avformat_find_stream_info (ic=0x2173290, options=0x7ffff7f74010) at libavformat/utils.c:3377
3377 avctx = st->internal->avctx;
(gdb) p ic->nb_streams
$3 = 26418
------------------------------------------------------------------------------------------------------------------------------------------------------------------
Breakpoint 3, che_configure (ac=0x19ff1810, che_pos=AAC_CHANNEL_FRONT, type=1, id=0, channels=0x7fffffffd458) at libavcodec/aacdec_template.c:135
135 if (!(ac->che[type][id] = av_mallocz(sizeof(ChannelElement)))) // malloc a big memory on every loop.
(gdb) p sizeof(ChannelElement)
$4 = 547744
The total memory allocated is about 26418*547744 at last.
============================ my test info =========================== ffmpeg version 3.2 Copyright (c) 2000-2016 the FFmpeg developers
built with clang version 3.8.0 (tags/RELEASE_380/final)
configuration: --cc=afl-clang-fast --enable-debug=3 --disable-asm --disable-stripping --disable-optimizations --disable-shared
libavutil 55. 34.100 / 55. 34.100
libavcodec 57. 64.100 / 57. 64.100
libavformat 57. 56.100 / 57. 56.100
libavdevice 57. 1.100 / 57. 1.100
libavfilter 6. 65.100 / 6. 65.100
libswscale 4. 2.100 / 4. 2.100
libswresample 2. 3.100 / 2. 3.100
[mov,mp4,m4a,3gp,3g2,mj2 @ 0x2a582b0] overread end of atom 'tkhd' by 32 bytes
[mov,mp4,m4a,3gp,3g2,mj2 @ 0x2a582b0] stream 1, timescale not set Killed
-----邮件原件-----
发件人: cve-request@...re.org [mailto:cve-request@...re.org]
发送时间: 2016年11月23日 8:40
收件人: 连一汉
抄送: cve-request@...re.org
主题: Re: [scr264871] Huge memory allocated
> [VulnerabilityType Other]
> Huge memory allocated , result in DoS of ffmpeg.
>
> ------------------------------------------
>
> [Affected Product Code Base]
> ffmpeg - 3.2
Use CVE-2016-9561.
--
CVE Assignment Team
M/S M300, 202 Burlington Road, Bedford, MA 01730 USA [ A PGP key is available for encrypted communications at
http://cve.mitre.org/cve/request_id.html ]
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
