bugGnash - The GNU Flash player - Bugs: bug #43865, out-of-bounds read

 
 

bug #43865: out-of-bounds read

Submitted by:  Joshua Rogers <megamansec3>
Submitted on:  Sun 21 Dec 2014 10:55:11 PM UTC  
 
Category: parserSeverity: 6 - Security
Release: 0.8.10Status: Ready For Test
Privacy: PublicAssigned to: Sandro Santilli <strk>
Open/Closed: Open

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 22 Dec 2014 09:16:16 PM UTC, comment #4:

No point in having this bug private: every change is mailed to a public mailing list...

Bastiaan Jacques <bjacques>
Project Member
Mon 22 Dec 2014 09:01:00 PM UTC, comment #3:

I think this bug is not exploitable, because the overflow writes into |int spareBits|, changing its value. But |spareBits| is not used after the write.

Bastiaan Jacques <bjacques>
Project Member
Mon 22 Dec 2014 11:30:36 AM UTC, comment #2:

I don't know how to code swf files, so no. Sorry!

P.S: Should a CVE-ID be assigned to this?

Thanks

Joshua Rogers <megamansec3>
Mon 22 Dec 2014 11:21:20 AM UTC, comment #1:

Thanks!
Do you think you can handle to trigger that out-of-bounds read with an automated testcase to add to the testsuite ?

Meanwhile, it's been fixed with commit e8c2a2e55939d1040e8b2099e32158cab7b32a46

Sandro Santilli <strk>
Project MemberIn charge of this item.
Sun 21 Dec 2014 10:55:11 PM UTC, original submission:

Hi,

In SWFStream.cpp on line 129, 'bytesToRead' may be up to 4.

129 int bytesToRead = bitcount/8;

But then, it is used here:
m_current_byte = cache[bytesToRead];

leading to an out-of-bounds read.

cache is:
byte cache[4];

Thanks

Joshua Rogers <megamansec3>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by bjacques (Posted a comment)
  • -unavailable- added by strk (Posted a comment)
  • -unavailable- added by megamansec3 (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 22 Dec 2014 09:16:16 PM UTCbjacquesPrivacyPrivate=>Public
    Mon 22 Dec 2014 11:24:31 AM UTCstrkSeverity3 - Normal=>6 - Security
    Mon 22 Dec 2014 11:21:20 AM UTCstrkCategoryNone=>parser
      ReleaseNone=>0.8.10
      StatusNone=>Ready For Test
      Assigned toNone=>strk

    Back to the top


    Powered by Savane 3.1-cleanup1