bugGnash - The GNU Flash player - Bugs: bug #21609, SIGSEV with corrupt jpeg data

 
 

bug #21609: SIGSEV with corrupt jpeg data

Submitted by:  Benjamin Wolsey <bwy>
Submitted on:  Mon 19 Nov 2007 09:13:28 AM UTC  
 
Category: coreSeverity: 6 - Security
Release: NoneStatus: Fixed
Privacy: PublicAssigned to: Sandro Santilli <strk>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 29 Nov 2007 08:17:48 PM UTC, comment #3:

I have found another crasher, but I don't think it's to do with jpeg data, so I'll close this bug.

Benjamin Wolsey <bwy>
Project Member
Wed 28 Nov 2007 11:19:12 PM UTC, comment #2:

Got away with setjmp/getjump.

zzuf it now.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Wed 21 Nov 2007 09:49:18 PM UTC, comment #1:

Last time I tried to solve similar problems I got stuck in jpeg lib
lack of documentation. I did add support for early exit, but it seems the lib corrupts memory anyway.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Mon 19 Nov 2007 09:13:28 AM UTC, original submission:

I was testing gnash with a fuzzer (just for fun) and found lots of differently malformed SWFs that cause a segfault with bad jpeg data.

1. from frog.swf (7e4e3af39c34034a9674f96c97257770), zzuf seed 23
2. from the doughguy movie (0ecb986f13a8d5bbc50769dc566d7c86), zzuf seed 23
3. from frog.swf, zzuf seed 553.
4. from zoomhenge (00cb6537c4a07b551437737e43bba4de), zzuf seed 4.

Benjamin Wolsey <bwy>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #14430:  crash4.swf added by bwy (232KiB - application/x-shockwave-flash)
file #14429:  crash3.swf added by bwy (384KiB - application/x-shockwave-flash)
file #14428:  crash2.swf added by bwy (392KiB - application/x-shockwave-flash)
file #14427:  crash.swf added by bwy (384KiB - application/x-shockwave-flash)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by strk (Posted a comment)
  • -unavailable- added by mcgrof (Seems pandora could benefit from this being fixed.)
  • -unavailable- added by bwy (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 10 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 29 Nov 2007 08:17:48 PM UTCbwyStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Wed 28 Nov 2007 11:19:12 PM UTCstrkStatusNone=>Ready For Test
      Assigned toNone=>strk
    Wed 21 Nov 2007 09:49:18 PM UTCstrkCategoryNone=>core
    Tue 20 Nov 2007 08:46:21 AM UTCmcgrofCarbon-Copy-=>Added -unavailable-
    Mon 19 Nov 2007 09:17:07 AM UTCbwyAttached File-=>Added crash4.swf, #14430
    Mon 19 Nov 2007 09:16:48 AM UTCbwyAttached File-=>Added crash3.swf, #14429
    Mon 19 Nov 2007 09:16:27 AM UTCbwyAttached File-=>Added crash2.swf, #14428
    Mon 19 Nov 2007 09:13:28 AM UTCbwyAttached File-=>Added crash.swf, #14427

    Back to the top


    Powered by Savane 3.1-cleanup1