[Bug 774902] New: typefind: out of bounds memory read in windows_icon_typefind

[GStreamer (GNOME Bugzilla)]

https://bugzilla.gnome.org/show_bug.cgi?id=774902

            Bug ID: 774902
           Summary: typefind: out of bounds memory read in
                    windows_icon_typefind
    Classification: Platform
           Product: GStreamer
           Version: git master
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: Normal
         Component: gst-plugins-base
          Assignee: gstreamer-bugs at lists.freedesktop.org
          Reporter: hanno at hboeck.de
        QA Contact: gstreamer-bugs at lists.freedesktop.org
     GNOME version: ---

Created attachment 340587
  --> https://bugzilla.gnome.org/attachment.cgi?id=340587&action=edit
poc file causing out of bounds read

The attached file will cause a 4 bytes out of bounds memory read in the
function windows_icon_typefind. Needs G_SLICE=always-malloc set and a memory
safety tool like asan. Current git code, found with afl.

asan error:
==21113==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x60f000002662 at pc 0x7f1fcc1c838c bp 0x7f1fccbf2950 sp 0x7f1fccbf2948
READ of size 4 at 0x60f000002662 thread T1 (typefind:sink)
    #0 0x7f1fcc1c838b in __gst_fast_read32
/usr/include/gstreamer-1.0/gst/gstutils.h:122:10
    #1 0x7f1fcc1c838b in windows_icon_typefind
/f/gstreamer/gst-plugins-base/gst/typefind/gsttypefindfunctions.c:5249
    #2 0x7f1fd85682ec in gst_type_find_factory_call_function
/f/gstreamer/gstreamer/gst/gsttypefindfactory.c:215:7
    #3 0x7f1fd8a7b3ba in gst_type_find_helper_get_range
/f/gstreamer/gstreamer/libs/gst/base/gsttypefindhelper.c:353:5
    #4 0x7f1fcccff64a in gst_type_find_element_loop
/f/gstreamer/gstreamer/plugins/elements/gsttypefindelement.c:1134:13
    #5 0x7f1fd855a5c3 in gst_task_func
/f/gstreamer/gstreamer/gst/gsttask.c:334:5
    #6 0x7f1fd7759867  (/usr/lib64/libglib-2.0.so.0+0x70867)
    #7 0x7f1fd7758ed4  (/usr/lib64/libglib-2.0.so.0+0x6fed4)
    #8 0x7f1fd71d6443 in start_thread (/lib64/libpthread.so.0+0x7443)
    #9 0x7f1fd6d0592c in clone (/lib64/libc.so.6+0xe792c)

0x60f000002662 is located 1 bytes to the right of 161-byte region
[0x60f0000025c0,0x60f000002661)
allocated by thread T1 (typefind:sink) here:
    #0 0x4d4e28 in malloc (/usr/bin/gst-discoverer-1.0+0x4d4e28)
    #1 0x7f1fd77383a8 in g_malloc (/usr/lib64/libglib-2.0.so.0+0x4f3a8)

Thread T1 (typefind:sink) created by T0 here:
    #0 0x42e26d in __interceptor_pthread_create
(/usr/bin/gst-discoverer-1.0+0x42e26d)
    #1 0x7f1fd7776adf  (/usr/lib64/libglib-2.0.so.0+0x8dadf)

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.