bugGnash - The GNU Flash player - Bugs: bug #43865, out-of-bounds read


bug #43865: out-of-bounds read

Submitted by:  Joshua Rogers <megamansec3>
Submitted on:  Sun 21 Dec 2014 10:55:11 PM UTC  
Category:  parser Severity:  6 - Security
Release:  0.8.10 Status:  Ready For Test
Privacy:  Public Assigned to:  Sandro Santilli <strk>
Open/Closed:  Open

Add a New Comment (Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Mon 22 Dec 2014 09:16:16 PM UTC, comment #4: 

No point in having this bug private: every change is mailed to a public mailing list...

Bastiaan Jacques <bjacques>
Project Member
Mon 22 Dec 2014 09:01:00 PM UTC, comment #3: 

I think this bug is not exploitable, because the overflow writes into |int spareBits|, changing its value. But |spareBits| is not used after the write.

Bastiaan Jacques <bjacques>
Project Member
Mon 22 Dec 2014 11:30:36 AM UTC, comment #2: 

I don't know how to code swf files, so no. Sorry!

P.S: Should a CVE-ID be assigned to this?


Joshua Rogers <megamansec3>
Mon 22 Dec 2014 11:21:20 AM UTC, comment #1: 

Do you think you can handle to trigger that out-of-bounds read with an automated testcase to add to the testsuite ?

Meanwhile, it's been fixed with commit e8c2a2e55939d1040e8b2099e32158cab7b32a46

Sandro Santilli <strk>
Project MemberIn charge of this item.
Sun 21 Dec 2014 10:55:11 PM UTC, original submission:  


In SWFStream.cpp on line 129, 'bytesToRead' may be up to 4.

129        int bytesToRead = bitcount/8;

But then, it is used here:
            m_current_byte = cache[bytesToRead];

leading to an out-of-bounds read.

cache is:
byte cache[4];


Joshua Rogers <megamansec3>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by bjacques (Posted a comment)
  • -email is unavailable- added by strk (Posted a comment)
  • -email is unavailable- added by megamansec3 (Submitted the item)

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-12-22 bjacques PrivacyPrivate => Public
    2014-12-22 strk Severity3 - Normal => 6 - Security
    2014-12-22 strk CategoryNone => parser
        ReleaseNone => 0.8.10
        StatusNone => Ready For Test
        Assigned toNone => strk

    Back to the top

    Powered by Savane 3.6