bugGnash - The GNU Flash player - Bugs: bug #43865, out-of-bounds read

 
 

bug #43865: out-of-bounds read

Submitter:  Joshua Rogers <megamansec3>
Submitted:  Sun 21 Dec 2014 10:55:11 PM UTC
   
 
Category:  parser Severity:  6 - Security
Release:  0.8.10 Status:  Ready For Test
Privacy:  Public Assigned to:  strk
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 22 Dec 2014 09:16:16 PM UTC, comment #4: 

No point in having this bug private: every change is mailed to a public mailing list...

 Bastiaan Jacques <bjacques>
Group Member
Mon 22 Dec 2014 09:01:00 PM UTC, comment #3: 

I think this bug is not exploitable, because the overflow writes into |int spareBits|, changing its value. But |spareBits| is not used after the write.

 Bastiaan Jacques <bjacques>
Group Member
Mon 22 Dec 2014 11:30:36 AM UTC, comment #2: 

I don't know how to code swf files, so no. Sorry!

P.S: Should a CVE-ID be assigned to this?


Thanks

Joshua Rogers <megamansec3>
Mon 22 Dec 2014 11:21:20 AM UTC, comment #1: 

Thanks!
Do you think you can handle to trigger that out-of-bounds read with an automated testcase to add to the testsuite ?

Meanwhile, it's been fixed with commit e8c2a2e55939d1040e8b2099e32158cab7b32a46

Sandro Santilli <strk>
Group Member
Sun 21 Dec 2014 10:55:11 PM UTC, original submission:  

Hi,

In SWFStream.cpp on line 129, 'bytesToRead' may be up to 4.

129        int bytesToRead = bitcount/8;


But then, it is used here:
            m_current_byte = cache[bytesToRead];

leading to an out-of-bounds read.


cache is:
byte cache[4];

Thanks

Joshua Rogers <megamansec3>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bjacques (Posted a comment)
  • -email is unavailable- added by strk (Posted a comment)
  • -email is unavailable- added by megamansec3 (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-12-22 bjacques PrivacyPrivate Public
    2014-12-22 strk Severity3 - Normal 6 - Security
    2014-12-22 strk CategoryNone parser
        ReleaseNone 0.8.10
        StatusNone Ready For Test
        Assigned toNone strk

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.13-8ccc.
    Corresponding source code