Closed Marsman1996 closed 5 years ago
i make a new commit
commit b3039ae8022da67078c130bd19bc3008a037adb3
which fix issue #10 #11 and #12
can you test again ?
Hi, I tested it with commit b3039ae
but there still exists some buffer overflows in jfif.c:195; jfif.c:216, jfif.c:228 and jfif.c:231
here are the POCs and asan log asan.log ffjpeg_poc.zip
pls test commit 6bc54edd36fa7b984aa134725f4748d46e372c7a
Hi,
I tested it with commit 6bc54ed
and AddressSanitizer still reports heap-buffer-overflow in jfif.c:216 and jfif.c:231, which is caused by id:000026 & id:000029 in the ffjpeg_poc.zip above.
to use AddressSanitizer you can compile program with cmd
$ CC="gcc -fsanitize=address -g" CXX="g++ -fsanitize=address -g" cmake .
$ make
Cheers
are the test case 16 & 25 pass your testing ? and the case 26 & 29 still failed ?
I don't have the test enviroment, can you tell me how to install the AddressSanitizer?
Hi,
are the test case 16 & 25 pass your testing ? and the case 26 & 29 still failed ?
Yes, 26 & 29 still fail while 16 & 25 pass.
I don't have the test enviroment, can you tell me how to install the AddressSanitizer?
AddressSanitizer is part of gcc since gcc-4.8, not sure whether it can be installed separately. Here (ASANwiki) is the guide to build the ASAN from source, though I think use ASAN in gcc cost less effort
Cheers
please test commit d003dd61abfe7ab68fd89bbdb5608882ac128e61
Hi,
I tested commit 2ad299a and ASAN reports heap buffer overflow in https://github.com/rockcarry/ffjpeg/blob/2ad299a390c63895333f8ea51ff54f8765678494/jfif.c#L228
Maybe it should be changed to
for (i=1; i<1+16 && dht+i<end; i++) len += dht[i];
This would fix the overflow problem but I'm not sure if this logic is right.
Best wishes
pls test commit 58b6f94b82c4d81f5bd237d919c907cf62853680 i think it‘s ok now.
Hi,
I tested commit 58b6f94. Since no more ASAN reports, I think this series of heap-overflow problems are fixed now.
Cheers!
Test Environment
Ubuntu 14.04, 64bit, ffjpeg(master 627c8a9)
How to trigger
$ ./ffjpeg -d $POC
POC file
https://github.com/Marsman1996/pocs/blob/master/ffjpeg/poc22-jfif_load-heapoverflow
Details
Asan report
GDB report