Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

A Endless-Loop detected in ok_wav.c:ok_wav_decode_caf_file #23

Open
p0l42 opened this issue Dec 2, 2023 · 1 comment
Open

A Endless-Loop detected in ok_wav.c:ok_wav_decode_caf_file #23

p0l42 opened this issue Dec 2, 2023 · 1 comment

Comments

@p0l42
Copy link

p0l42 commented Dec 2, 2023

Hello,
A endless-loop detected in ok_wav_decode_caf_file by fuzzing.
In detail, my testcase's chunk_length is 0x64, and after casting input_user_data to FILE*, it access a wrong memory,
and the memory here has data fit fseek(input_user_data, 0x64, SEEK_CUR), so the function ok_seek always return true
In the loop in ok_wav_decode_caf_file, while(true), the chunk_header check always goto else branch, so a endless loop triggered in this case.
The gdb info is as follows:
p chunk_length
$13 = 0x64
p decoder->input_user_data
$19 = (void*) 0x55555555c2a0
x/32gx 0x55555555c2a0+0x64
0x55555555c304 0xf7e1a6a000000000 0x0000000300007fff ....
The testcase I'll upload soon.

@p0l42
Copy link
Author

p0l42 commented Dec 2, 2023

The testcase and gdb debug info is here.
endless-loop.zip

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant