bugCompact Disc Input and Control Library - Bugs: bug #45015, Heap overflow / invalid read in...

 
 

bug #45015: Heap overflow / invalid read in function get_rock_ridge_filename()

Submitted by:  Hanno Boeck <hanno>
Submitted on:  Tue 05 May 2015 07:08:09 AM UTC  
 
Category:  None Severity:  5 - Average
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  Rocky Bernstein <rocky>
Open/Closed:  Closed

Add a New Comment (Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 30 Jul 2017 03:23:03 PM UTC, comment #2:

My analysis in

  http://lists.gnu.org/archive/html/libcdio-devel/2017-07/msg00021.html

is that the problem is caused by a rogue byte that was inserted by the
error generator.

libcdio scanned too eagerly for more directory records when the list
of directory records in the block has already ended. The rogue byte
then lured it into following a false record inside the next block, rather
than to end reading at the next block start, because that block is
after the announced size of the root directory.

The proposed fix in

  http://git.savannah.gnu.org/cgit/libcdio.git/commit/?h=TS-RockRidge-Fix&id=faf6f6d5399c194db876a3ee07b1920e1447e9fb

prevents the attempt to interpret the rogue byte and also would prevent
the reading across a block limit, if the rogue byte would appear at a
plausible position in the root directory block.

Thomas Schmitt <scdbackup>
Project Member
Fri 08 May 2015 09:34:58 PM UTC, comment #1:

I believe commit 8b96bd3 addresses this.

Rocky Bernstein <rocky>
Project AdministratorIn charge of this item.
Tue 05 May 2015 07:08:09 AM UTC, original submission:

The attached file will trigger a read heap overflow in the function get_rock_ridge_filename() with iso-info -f.

This can be seen with Address Sanitizer or Valgrind. I've attached the output of both tools. Found with american fuzzy lop.

Hanno Boeck <hanno>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by scdbackup (Posted a comment)
  • -email is unavailable- added by scdbackup
  • -email is unavailable- added by rocky (Posted a comment)
  • -email is unavailable- added by hanno (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-07-30 scdbackup Carbon-Copy- => Added scdbackup
    2015-05-08 rocky StatusNone => Fixed
        Assigned toNone => rocky
        Open/ClosedOpen => Closed
    2015-05-05 hanno Attached File- => Added libcdio-heapoverflow-get_rock_ridge_filename.iso, #33907
        Attached File- => Added libcdio-heapoverflow-get_rock_ridge_filename.iso.valgrind.txt, #33908
        Attached File- => Added libcdio-heapoverflow-get_rock_ridge_filename.iso.asan.txt, #33909

    Back to the top


    Powered by Savane 3.4