#10688: heap-buffer-overflow at libavfilter/bwdifdsp.c:125:5 in
ff_bwdif_filter_intra_c in FFmpeg
-------------------------------------+-------------------------------------
Reporter: | Type: defect
ZengYunxiang |
Status: new | Priority: critical
Component: avfilter | Version:
| unspecified
Keywords: bugs | Blocked By:
Blocking: | Reproduced by developer: 0
Analyzed by developer: 0 |
-------------------------------------+-------------------------------------
Summary of the bug:
Dear developers, hello!
I recently proposed a new fuzzing method named fuzzyx, and found the
following heap-buffer-overflow bug on FFmpeg6.1 when using bwdif filter,
please confirm.
POC file link:
poc3ffmpeg:
[https://github.com/Frank-Z7/z-vulnerabilitys/blob/main/poc3ffmpeg]
How to reproduce:
{{{
git clone https://github.com/FFmpeg/FFmpeg.git ffmpeg6-1
cd ffmpeg6-1
git checkout 466799d
./configure --cc=clang --cxx=clang++ --ld=clang --enable-debug --toolchain
=clang-asan
make -j30
./ffmpeg_g -y -i poc3ffmpeg -filter_complex bwdif tmp.mkv
}}}
ASAN Log:
{{{
=================================================================
==716046==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x61a0000afe40 at pc 0x55871b706904 bp 0x7ffd0ee6d2a0 sp 0x7ffd0ee6d298
READ of size 8 at 0x61a0000afe40 thread T0
#0 0x55871b706903 in ff_bwdif_filter_intra_c
/ffmpeg/libavfilter/bwdifdsp.c:125:5
#1 0x55871ae6ba71 in filter_slice /ffmpeg/libavfilter/vf_bwdif.c:80:17
#2 0x55871ad49638 in worker_func /ffmpeg/libavfilter/pthread.c:49:15
#3 0x55871eddd45e in run_jobs /ffmpeg/libavutil/slicethread.c:65:9
#4 0x55871eddd45e in avpriv_slicethread_execute
/ffmpeg/libavutil/slicethread.c:192:19
#5 0x55871ad494a6 in thread_execute /ffmpeg/libavfilter/pthread.c:71:5
#6 0x55871ae6b021 in ff_filter_execute
/ffmpeg/libavfilter/internal.h:147:12
#7 0x55871ae6b021 in filter /ffmpeg/libavfilter/vf_bwdif.c:132:9
#8 0x55871b4b2867 in return_frame
/ffmpeg/libavfilter/yadif_common.c:57:5
#9 0x55871b4b2fdf in ff_yadif_request_frame
/ffmpeg/libavfilter/yadif_common.c:185:9
#10 0x55871acdabfb in ff_request_frame_to_filter
/ffmpeg/libavfilter/avfilter.c:482:15
#11 0x55871acd5e21 in ff_filter_activate_default
/ffmpeg/libavfilter/avfilter.c:1184:20
#12 0x55871acd5e21 in ff_filter_activate
/ffmpeg/libavfilter/avfilter.c:1331:11
#13 0x55871acea5cc in get_frame_internal
/ffmpeg/libavfilter/buffersink.c:139:19
#14 0x55871ace7030 in avfilter_graph_request_oldest
/afltest/ffmpegasan/libavfilter/avfiltergraph.c:1306:17
#15 0x55871abac97f in fg_transcode_step
/ffmpeg/fftools/ffmpeg_filter.c:2485:11
#16 0x55871ac08326 in transcode_step /ffmpeg/fftools/ffmpeg.c:1134:20
#17 0x55871ac08326 in transcode /ffmpeg/fftools/ffmpeg.c:1205:15
#18 0x55871ac08326 in main /ffmpeg/fftools/ffmpeg.c:1331:11
#19 0x7fe4a2370d8f (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)
(BuildId: a43bfc8428df6623cd498c9c0caeb91aec9be4f9)
#20 0x7fe4a2370e3f in __libc_start_main (/lib/x86_64-linux-
gnu/libc.so.6+0x29e3f) (BuildId: a43bfc8428df6623cd498c9c0caeb91aec9be4f9)
#21 0x55871aab6824 in _start (/ffmpeg/ffmpeg_g+0x90e824) (BuildId:
9832a23ddc031de766b82a345766231d990b42d2)
0x61a0000afe40 is located 64 bytes to the left of 1167-byte region
[0x61a0000afe80,0x61a0000b030f)
allocated by thread T11 (av:h264:df10) here:
#0 0x55871ab3a1e7 in __interceptor_posix_memalign
(/ffmpeg/ffmpeg_g+0x9921e7) (BuildId:
9832a23ddc031de766b82a345766231d990b42d2)
#1 0x55871ed98c21 in av_malloc /ffmpeg/libavutil/mem.c:105:9
#2 0x55871ed376ec in av_buffer_alloc /ffmpeg/libavutil/buffer.c:82:12
#3 0x55871ed376ec in av_buffer_allocz /ffmpeg/libavutil/buffer.c:95:24
#4 0x55871ed3a156 in pool_alloc_buffer
/ffmpeg/libavutil/buffer.c:363:26
#5 0x55871ed3a156 in av_buffer_pool_get
/ffmpeg/libavutil/buffer.c:401:15
#6 0x55871c548777 in video_get_buffer
/ffmpeg/libavcodec/get_buffer.c:240:23
#7 0x55871c548777 in avcodec_default_get_buffer2
/ffmpeg/libavcodec/get_buffer.c:276:16
#8 0x55871c1c2d6f in ff_get_buffer /ffmpeg/libavcodec/decode.c:1672:11
#9 0x55871cf4a87f in thread_get_buffer_internal
/ffmpeg/libavcodec/pthread_frame.c:969:11
#10 0x55871cf4a87f in ff_thread_get_buffer
/ffmpeg/libavcodec/pthread_frame.c:978:15
Thread T11 (av:h264:df10) created by T0 here:
#0 0x55871ab22aec in __interceptor_pthread_create
(/ffmpeg/ffmpeg_g+0x97aaec) (BuildId:
9832a23ddc031de766b82a345766231d990b42d2)
#1 0x55871a9b0d4b in init_thread
/ffmpeg/libavcodec/pthread_frame.c:844:11
SUMMARY: AddressSanitizer: heap-buffer-overflow
/ffmpeg/libavfilter/bwdifdsp.c:125:5 in ff_bwdif_filter_intra_c
Shadow bytes around the buggy address:
0x0c348000df70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c348000df80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c348000df90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c348000dfa0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c348000dfb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c348000dfc0: fa fa fa fa fa fa fa fa[fa]fa fa fa fa fa fa fa
0x0c348000dfd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c348000dfe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c348000dff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c348000e000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c348000e010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==716046==ABORTING
}}}
ffmpeg version:
{{{
# ./ffmpeg -version
ffmpeg version n6.1-3-g466799d4f5 Copyright (c) 2000-2023 the FFmpeg
developers
built with clang version 9.0.0 (https://github.com/llvm-mirror/llvm
c62b24f070c9a4bb1a76409e623042a740cac4cd)
configuration: --cc=clang --cxx=clang++ --ld=clang --enable-debug
--toolchain=clang-asan
libavutil 58. 29.100 / 58. 29.100
libavcodec 60. 31.102 / 60. 31.102
libavformat 60. 16.100 / 60. 16.100
libavdevice 60. 3.100 / 60. 3.100
libavfilter 9. 12.100 / 9. 12.100
libswscale 7. 5.100 / 7. 5.100
libswresample 4. 12.100 / 4. 12.100
}}}
Credit:
{{{
Zeng Yunxiang , HUST
Song Jiaxuan , HUST
}}}
Thanks for your time!
--
Ticket URL: <https://trac.ffmpeg.org/ticket/10688>
FFmpeg <https://ffmpeg.org>
FFmpeg issue tracker_______________________________________________
FFmpeg-trac mailing list
FFmpeg-trac@avcodec.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-trac
To unsubscribe, visit link above, or email
ffmpeg-trac-requ...@ffmpeg.org with subject "unsubscribe".
