Package: x264 Version: 2:0.148.2748+git97eaef2-1 Severity: normal Dear Maintainer,
Running x264 with the attached poc file raises a heap buffer overflow. Following gdb log shows the program resulting in segfault. jason@debian-amd64-stretch:~/report/debian-latest/x264$ gdb x264 -q Reading symbols from x264...(no debugging symbols found)...done. (gdb) run --crf 24 -o output.264 ./poc_ovf Starting program: /usr/bin/x264 --crf 24 -o output.264 ./poc_ovf [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". ffms [info]: 352x288p 12:11 @ 250000/8839 fps (vfr) x264 [info]: using SAR=12/11 x264 [info]: using cpu capabilities: MMX2 SSE2Fast SSSE3 SSE4.2 AVX FMA3 AVX2 LZCNT BMI2 x264 [info]: profile High, level 1.3 Program received signal SIGSEGV, Segmentation fault. __memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:364 364 ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S: No such file or directory. (gdb) x/i $rip => 0x7ffff4735f50 <__memmove_avx_unaligned_erms+368>: vmovdqu -0x20(%rsi,%rdx,1),%ymm5 (gdb) info reg rsi rdx rsi 0x555555d21ee0 93825000414944 rdx 0x160 352 (gdb) bt 10 #0 __memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:364 #1 0x00005555555665b6 in ?? () #2 0x00005555555666df in ?? () #3 0x000055555556840b in ?? () #4 0x000055555555b5b9 in ?? () #5 0x00007ffff462d2e1 in __libc_start_main (main=0x55555555a030, argc=6, argv=0x7fffffffe5f8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe5e8) at ../csu/libc-start.c:291 #6 0x000055555555cb3a in ?? () When we compiled the source with AddressSanitizer, the program reports a heap-buffer-overflow error in x264_cli_plane_copy() function as follow. jason@debian-amd64-stretch:~/report/source-latest/x264$ ./x264-0.148/x264 --crf 24 -o output.264 poc_ovf ffms [info]: 352x288p 12:11 @ 250000/8839 fps (vfr) x264 [info]: using SAR=12/11 x264 [info]: using cpu capabilities: none! x264 [info]: profile High, level 1.3 ================================================================= ==6186==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62c000007a2f at pc 0x0000004aac55 bp 0x7fffffffcf90 sp 0x7fffffffc740 READ of size 352 at 0x62c000007a2f thread T0 #0 0x4aac54 in __asan_memcpy (/home/jason/report/source-latest/x264/x264-0.148/x264+0x4aac54) #1 0x5174f9 in x264_cli_plane_copy /home/jason/report/source-latest/x264/x264-0.148/filters/video/internal.c:33:9 #2 0x5174f9 in x264_cli_pic_copy /home/jason/report/source-latest/x264/x264-0.148/filters/video/internal.c:55 #3 0x51cc46 in get_frame /home/jason/report/source-latest/x264/x264-0.148/filters/video/fix_vfr_pts.c:100:13 #4 0x4f667d in encode /home/jason/report/source-latest/x264/x264-0.148/x264.c:1921:13 #5 0x4f667d in main /home/jason/report/source-latest/x264/x264-0.148/x264.c:382 #6 0x7ffff45b02e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0) #7 0x422969 in _start (/home/jason/report/source-latest/x264/x264-0.148/x264+0x422969) 0x62c000007a2f is located 0 bytes to the right of 30767-byte region [0x62c000000200,0x62c000007a2f) allocated by thread T0 here: #0 0x4c18d0 in __interceptor_posix_memalign (/home/jason/report/source-latest/x264/x264-0.148/x264+0x4c18d0) #1 0x7ffff552b93f in av_malloc (/usr/lib/x86_64-linux-gnu/libavutil.so.55+0x2b93f) SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/jason/report/source-latest/x264/x264-0.148/x264+0x4aac54) in __asan_memcpy Shadow bytes around the buggy address: 0x0c587fff8ef0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c587fff8f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c587fff8f10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c587fff8f20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c587fff8f30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c587fff8f40: 00 00 00 00 00[07]fa fa fa fa fa fa fa fa fa fa 0x0c587fff8f50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c587fff8f60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c587fff8f70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c587fff8f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c587fff8f90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa -- System Information: Debian Release: 9.1 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 4.9.0-3-amd64 (SMP w/1 CPU core) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages x264 depends on: ii libavcodec57 7:3.2.10-1~deb9u1 ii libavformat57 7:3.2.10-1~deb9u1 ii libavutil55 7:3.2.10-1~deb9u1 ii libc6 2.24-11+deb9u3 ii libffms2-4 2.23-1 ii libgpac4 0.5.2-426-gc5ad4e4+dfsg5-3+b1 ii libswscale4 7:3.2.10-1~deb9u1 ii libx264-148 2:0.148.2748+git97eaef2-1 ii zlib1g 1:1.2.8.dfsg-5 x264 recommends no packages. x264 suggests no packages. -- no debconf information
poc_ovf
Description: Binary data