Describe the bug
A heap-based buffer overflow was discovered in ffjpeg, during the src of memcpy () points to an inaccessible address. The issue is being triggered in the function jfif_decode() at jfif.c:516.
Expected behavior
An attacker can exploit this vulnerability by submitting a malicious jpeg that exploits this issue. This will result in a Denial of Service (DoS) and when the application attempts to process the file.
Screenshots
ASAN Reports
==115406==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7ffff3aff900 at pc 0x7ffff6ef6904 bp 0x7fffffffd580 sp 0x7fffffffcd28
WRITE of size 32 at 0x7ffff3aff900 thread T0
#0 0x7ffff6ef6903 in __asan_memcpy (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x8c903)
#1 0x405642 in jfif_decode /home/test/Desktop/evaulation/ffjpeg/ffjpeg/src/jfif.c:516
#2 0x4011b0 in main /home/test/Desktop/evaulation/ffjpeg/ffjpeg/src/ffjpeg.c:24
#3 0x7ffff6ac082f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#4 0x400f78 in _start (/home/test/Desktop/evaulation/ffjpeg/ffjpeg/src/ffjpeg+0x400f78)
0x7ffff3aff900 is located 256 bytes to the right of 2097152-byte region [0x7ffff38ff800,0x7ffff3aff800)
allocated by thread T0 here:
#0 0x7ffff6f02602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
#1 0x404c0e in jfif_decode /home/test/Desktop/evaulation/ffjpeg/ffjpeg/src/jfif.c:442
#2 0x4011b0 in main /home/test/Desktop/evaulation/ffjpeg/ffjpeg/src/ffjpeg.c:24
#3 0x7ffff6ac082f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 __asan_memcpy
Shadow bytes around the buggy address:
0x10007e757ed0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007e757ee0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007e757ef0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007e757f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x10007e757f10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x10007e757f20:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x10007e757f30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x10007e757f40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x10007e757f50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x10007e757f60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x10007e757f70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
==115406==ABORTING
Describe the bug A heap-based buffer overflow was discovered in ffjpeg, during the src of memcpy () points to an inaccessible address. The issue is being triggered in the function jfif_decode() at jfif.c:516.
To Reproduce Steps to reproduce the behavior:
poc can be found here.
Expected behavior An attacker can exploit this vulnerability by submitting a malicious jpeg that exploits this issue. This will result in a Denial of Service (DoS) and when the application attempts to process the file.
Screenshots ASAN Reports
gdb debug
Possible causes of vulnerabilitie The 'memcpy' function copies from an invalid address pointed by 'isrc', resulting to a seg fault.
System (please complete the following information):