bugGnash - The GNU Flash player - Bugs: bug #43865, out-of-bounds read


bug #43865: out-of-bounds read

Submitter:  Joshua Rogers <megamansec3>
Submitted:  Sun 21 Dec 2014 10:55:11 PM UTC
Category:  parser Severity:  6 - Security
Release:  0.8.10 Status:  Ready For Test
Privacy:  Public Assigned to:  strk
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup

Mon 22 Dec 2014 09:16:16 PM UTC, comment #4: 

No point in having this bug private: every change is mailed to a public mailing list...

Bastiaan Jacques <bjacques>
Group Member
Mon 22 Dec 2014 09:01:00 PM UTC, comment #3: 

I think this bug is not exploitable, because the overflow writes into |int spareBits|, changing its value. But |spareBits| is not used after the write.

Bastiaan Jacques <bjacques>
Group Member
Mon 22 Dec 2014 11:30:36 AM UTC, comment #2: 

I don't know how to code swf files, so no. Sorry!

P.S: Should a CVE-ID be assigned to this?


Joshua Rogers <megamansec3>
Mon 22 Dec 2014 11:21:20 AM UTC, comment #1: 

Do you think you can handle to trigger that out-of-bounds read with an automated testcase to add to the testsuite ?

Meanwhile, it's been fixed with commit e8c2a2e55939d1040e8b2099e32158cab7b32a46

Sandro Santilli <strk>
Group Member
Sun 21 Dec 2014 10:55:11 PM UTC, original submission:  


In SWFStream.cpp on line 129, 'bytesToRead' may be up to 4.

129        int bytesToRead = bitcount/8;

But then, it is used here:
            m_current_byte = cache[bytesToRead];

leading to an out-of-bounds read.

cache is:
byte cache[4];


Joshua Rogers <megamansec3>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by bjacques (Posted a comment)
  • -email is unavailable- added by strk (Posted a comment)
  • -email is unavailable- added by megamansec3 (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.


    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-12-22 bjacques PrivacyPrivate Public
    2014-12-22 strk Severity3 - Normal 6 - Security
    2014-12-22 strk CategoryNone parser
        ReleaseNone 0.8.10
        StatusNone Ready For Test
        Assigned toNone strk

    Back to the top

    Powered by Savane 3.13-b921.
    Corresponding source code