Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

global out of bounds read in VC2Decoder::setVideoFormat #18

Open
hannob opened this issue Feb 15, 2018 · 0 comments
Open

global out of bounds read in VC2Decoder::setVideoFormat #18

hannob opened this issue Feb 15, 2018 · 0 comments

Comments

@hannob
Copy link

hannob commented Feb 15, 2018

The attached file causes a global out of bounds read. Found with afl+asan.

globaloob.zip

stack trace:

==18147==ERROR: AddressSanitizer: global-buffer-overflow on address 0x56486df4b240 at pc 0x56486de65f05 bp 0x7ffdacc2f4d0 sp 0x7ffdacc2f4c0
READ of size 96 at 0x56486df4b240 thread T0
    #0 0x56486de65f04 in VC2Decoder::setVideoFormat(_VC2DecoderParamsInternal&) /f/vc2/vc2hqdecode/vc2hqdecode/VC2Decoder.cpp:499
    #1 0x56486de69f4e in VC2Decoder::parseSeqHeader(char*, char const*) /f/vc2/vc2hqdecode/vc2hqdecode/VC2Decoder.cpp:458
    #2 0x56486de71a24 in VC2Decoder::sequenceSynchronise(char**, int, bool) /f/vc2/vc2hqdecode/vc2hqdecode/VC2Decoder.cpp:190
    #3 0x56486de55c28 in vc2decode_synchronise /f/vc2/vc2hqdecode/vc2hqdecode/vc2hqdecode.cpp:109
    #4 0x56486ddfb30f in main /f/vc2/vc2hqdecode/testprogs/vc2decode.cpp:253
    #5 0x7f733b516f85 in __libc_start_main (/lib64/libc.so.6+0x20f85)
    #6 0x56486de02be9 in _start (/r/vc2/vc2decode+0x1abe9)

0x56486df4b240 is located 32 bytes to the left of global variable 'preset_color_specs' defined in 'VideoFormat.hpp:173:18' (0x56486df4b260) of size 60
0x56486df4b240 is located 0 bytes to the right of global variable 'preset_formats' defined in 'VideoFormat.hpp:233:20' (0x56486df4a9a0) of size 2208
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant