Your message dated Wed, 29 Nov 2023 18:47:19 +0000
with message-id <e1r8pah-0038mz...@fasolo.debian.org>
and subject line Bug#1055019: Removed package(s) from unstable
has caused the Debian Bug report #883200,
regarding ffmpeg2theora: null pointer dereference while running ffmpege2theora
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
883200: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=883200
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: ffmpeg2theora
Version: 0.30-1+b2
Severity: normal
Tags: security
null pointer dereference while running ffmpeg2theora
Running 'ffmpeg2theora poc' with the attached file raises null pointer
dereference
which may allow a remote attack to cause a denial-of-service attack
I expected the program to terminate without segfault, but the program crashes
as follow
=======================================================
(gdb) r poc
Starting program:
/home/june/project/analyze/bins/ffmpeg2theora-0.30/ffmpeg2theora poc
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[wsd @ 0x61b000000080] reserved channel assignment
[wsd @ 0x61b000000080] Lr-middle is not implemented. Update your FFmpeg version
to the newest one from Git. If the problem still occurs, it means that your
file has a feature which has not been implemented.
[wsd @ 0x61b000000080] If you want to help, upload a sample of this file to
ftp://upload.ffmpeg.org/incoming/ and contact the ffmpeg-devel mailing list.
(ffmpeg-de...@ffmpeg.org)
[wsd @ 0x61b000000080] reserved channel assignment
[wsd @ 0x61b000000080] reserved channel assignment
[wsd @ 0x61b000000080] reserved channel assignment
[wsd @ 0x61b000000080] reserved channel assignment
[wsd @ 0x61b000000080] reserved channel assignment
[wsd @ 0x61b000000080] reserved channel assignment
[wsd @ 0x61b000000080] reserved channel assignment
[wsd @ 0x61b000000080] reserved channel assignment
[wsd @ 0x61b000000080] reserved channel assignment
[wsd @ 0x61b000000080] reserved channel assignment
[wsd @ 0x61b000000080] reserved channel assignment
[wsd @ 0x61b000000080] reserved channel assignment
[wsd @ 0x61b000000080] reserved channel assignment
[wsd @ 0x61b000000080] emphasis is not implemented. Update your FFmpeg version
to the newest one from Git. If the problem still occurs, it means that your
file has a feature which has not been implemented.
[wsd @ 0x61b000000080] If you want to help, upload a sample of this file to
ftp://upload.ffmpeg.org/incoming/ and contact the ffmpeg-devel mailing list.
(ffmpeg-de...@ffmpeg.org)
[dsd_msbf @ 0x619000000580] Channel layout '5 channels (FL+FR+BL+BR+FLC)' with
5 channels does not match specified number of channels 6: ignoring specified
channel layout
[wsd @ 0x61b000000080] Estimating duration from bitrate, this may be inaccurate
Input #0, wsd, from 'poc':
Metadata:
playback_time : 00:00:00:00
Duration: 00:00:00.00, bitrate: 118545 kb/s
Stream #0:0: Audio: dsd_msbf, 198656 Hz, 6 channels, fltp, 9535 kb/s
[dsd_msbf @ 0x619000000080] Multiple frames in a packet.
[dsd_msbf @ 0x619000000080] get_buffer() failed
Program received signal SIGSEGV, Segmentation fault.
0x00005555555883a7 in oggmux_add_audio (info=0x5555557cd060 <info>,
buffer=0x616000003380, samples=1, e_o_s=1) at src/theorautils.c:1254
1254 vorbis_buffer[k][i] = ((const float *)buffer[j])[i];
(gdb) bt
#0 0x00005555555883a7 in oggmux_add_audio (info=0x5555557cd060 <info>,
buffer=0x616000003380, samples=1, e_o_s=1) at src/theorautils.c:1254
#1 0x00005555555792c5 in ff2theora_output (this=0x61a000000080) at
src/ffmpeg2theora.c:1688
#2 0x0000555555580ad9 in main (argc=2, argv=0x7fffffffe0c8) at
src/ffmpeg2theora.c:3095
(gdb) x/i $rip
=> 0x5555555883a7 <oggmux_add_audio+735>: movss (%rsi),%xmm0
(gdb) i r rsi
rsi 0x0 0
(gdb)
=======================================================
This bug was found with a fuzzer developed by 'SoftSec' group at KAIST.
-- System Information:
Debian Release: buster/sid
APT prefers unstable-debug
APT policy: (500, 'unstable-debug'), (500, 'testing-debug'), (500,
'stable-updates'), (500, 'testing'), (500, 'stable'), (1, 'experimental-debug')
Architecture: amd64 (x86_64)
Kernel: Linux 4.9.0-3-amd64 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8),
LANGUAGE=en_US:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages ffmpeg2theora depends on:
ii libavcodec57 7:3.4-3
ii libavdevice57 7:3.4-3
ii libavfilter6 7:3.4-3
ii libavformat57 7:3.4-3
ii libavutil55 7:3.4-3
ii libc6 2.24-17
ii libkate1 0.4.1-7+b1
ii libogg0 1.3.2-1+b1
ii liboggkate1 0.4.1-7+b1
ii libpostproc54 7:3.4-3
ii libswresample2 7:3.4-3
ii libswscale4 7:3.4-3
ii libtheora0 1.1.1+dfsg.1-14+b1
ii libvorbis0a 1.3.5-4
ii libvorbisenc2 1.3.5-4
ffmpeg2theora recommends no packages.
ffmpeg2theora suggests no packages.
-- no debconf information
poc
Description: Binary data
--- End Message ---
--- Begin Message ---
Version: 0.30-2+rm
Dear submitter,
as the package ffmpeg2theora has just been removed from the Debian archive
unstable we hereby close the associated bug reports. We are sorry
that we couldn't deal with your issue properly.
For details on the removal, please see https://bugs.debian.org/1055019
The version of this package that was in Debian prior to this removal
can still be found using https://snapshot.debian.org/.
Please note that the changes have been done on the master archive and
will not propagate to any mirrors until the next dinstall run at the
earliest.
This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmas...@ftp-master.debian.org.
Debian distribution maintenance software
pp.
Thorsten Alteholz (the ftpmaster behind the curtain)
--- End Message ---
