bugCompact Disc Input and Control Library - Bugs: bug #45015, Heap overflow / invalid read in...

 
 

bug #45015: Heap overflow / invalid read in function get_rock_ridge_filename()

Submitter:  Hanno Boeck <hanno>
Submitted:  Tue 05 May 2015 07:08:09 AM UTC
   
 
Category:  None Severity:  5 - Average
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  rocky
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Sun 30 Jul 2017 03:23:03 PM UTC, comment #2: 

My analysis in

  http://lists.gnu.org/archive/html/libcdio-devel/2017-07/msg00021.html

is that the problem is caused by a rogue byte that was inserted by the
error generator.

libcdio scanned too eagerly for more directory records when the list
of directory records in the block has already ended. The rogue byte
then lured it into following a false record inside the next block, rather
than to end reading at the next block start, because that block is
after the announced size of the root directory.

The proposed fix in

  http://git.savannah.gnu.org/cgit/libcdio.git/commit/?h=TS-RockRidge-Fix&id=faf6f6d5399c194db876a3ee07b1920e1447e9fb

prevents the attempt to interpret the rogue byte and also would prevent
the reading across a block limit, if the rogue byte would appear at a
plausible position in the root directory block.

Thomas Schmitt <scdbackup>
Group Member
Fri 08 May 2015 09:34:58 PM UTC, comment #1: 

I believe commit 8b96bd3 addresses this.

Rocky Bernstein <rocky>
Group administrator
Tue 05 May 2015 07:08:09 AM UTC, original submission:  

The attached file will trigger a read heap overflow in the function get_rock_ridge_filename() with iso-info -f.

This can be seen with Address Sanitizer or Valgrind. I've attached the output of both tools. Found with american fuzzy lop.

Hanno Boeck <hanno>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by scdbackup (Posted a comment)
  • -email is unavailable- added by scdbackup
  • -email is unavailable- added by rocky (Posted a comment)
  • -email is unavailable- added by hanno (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-07-30 scdbackup Carbon-Copy- Added scdbackup
    2015-05-08 rocky StatusNone Fixed
        Assigned toNone rocky
        Open/ClosedOpen Closed
    2015-05-05 hanno Attached File- Added libcdio-heapoverflow-get_rock_ridge_filename.iso, #33907
        Attached File- Added libcdio-heapoverflow-get_rock_ridge_filename.iso.valgrind.txt, #33908
        Attached File- Added libcdio-heapoverflow-get_rock_ridge_filename.iso.asan.txt, #33909

    Back to the top

    Powered by Savane 3.13-cf05.
    Corresponding source code