bugCompact Disc Input and Control Library - Bugs: bug #45015, Heap overflow / invalid read in...

 
 

bug #45015: Heap overflow / invalid read in function get_rock_ridge_filename()

Submitted by:  Hanno Boeck <hanno>
Submitted on:  Tue 05 May 2015 07:08:09 AM UTC  
 
Category: NoneSeverity: 5 - Average
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: Rocky Bernstein <rocky>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 30 Jul 2017 03:23:03 PM UTC, comment #2:

My analysis in

http://lists.gnu.org/archive/html/libcdio-devel/2017-07/msg00021.html

is that the problem is caused by a rogue byte that was inserted by the
error generator.

libcdio scanned too eagerly for more directory records when the list
of directory records in the block has already ended. The rogue byte
then lured it into following a false record inside the next block, rather
than to end reading at the next block start, because that block is
after the announced size of the root directory.

The proposed fix in

http://git.savannah.gnu.org/cgit/libcdio.git/commit/?h=TS-RockRidge-Fix&id=faf6f6d5399c194db876a3ee07b1920e1447e9fb

prevents the attempt to interpret the rogue byte and also would prevent
the reading across a block limit, if the rogue byte would appear at a
plausible position in the root directory block.

Thomas Schmitt <scdbackup>
Project Member
Fri 08 May 2015 09:34:58 PM UTC, comment #1:

I believe commit 8b96bd3 addresses this.

Rocky Bernstein <rocky>
Project AdministratorIn charge of this item.
Tue 05 May 2015 07:08:09 AM UTC, original submission:

The attached file will trigger a read heap overflow in the function get_rock_ridge_filename() with iso-info -f.

This can be seen with Address Sanitizer or Valgrind. I've attached the output of both tools. Found with american fuzzy lop.

Hanno Boeck <hanno>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by scdbackup (Posted a comment)
  • -unavailable- added by scdbackup
  • -unavailable- added by rocky (Posted a comment)
  • -unavailable- added by hanno (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 30 Jul 2017 03:23:03 PM UTCscdbackupCarbon-Copy-=>Added scdbackup
    Fri 08 May 2015 09:34:58 PM UTCrockyStatusNone=>Fixed
      Assigned toNone=>rocky
      Open/ClosedOpen=>Closed
    Tue 05 May 2015 07:08:09 AM UTChannoAttached File-=>Added libcdio-heapoverflow-get_rock_ridge_filename.iso, #33907
      Attached File-=>Added libcdio-heapoverflow-get_rock_ridge_filename.iso.valgrind.txt, #33908
      Attached File-=>Added libcdio-heapoverflow-get_rock_ridge_filename.iso.asan.txt, #33909

    Back to the top


    Powered by Savane 3.1-cleanup1