Describe the bug
A stack-based buffer overflow was discovered in ffjpeg, during the out bound of read in array 'yuv_datbuf'. The issue is being triggered in the function jfif_decode() at jfif.c:513.
Expected behavior
An attacker can exploit this vulnerability by submitting a malicious jpeg that exploits this issue. This will result in a Denial of Service (DoS) when the application attempts to process the file.
Screenshots
ASAN Reports
=================================================================
==102581==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fffffffd778 at pc 0x00000040557b bp 0x7fffffffd5a0 sp 0x7fffffffd590
READ of size 8 at 0x7fffffffd778 thread T0
#0 0x40557a in jfif_decode /home/test/Desktop/evaulation/ffjpeg/ffjpeg/src/jfif.c:513
#1 0x4011b0 in main /home/test/Desktop/evaulation/ffjpeg/ffjpeg/src/ffjpeg.c:24
#2 0x7ffff6ac082f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#3 0x400f78 in _start (/home/test/Desktop/evaulation/ffjpeg/ffjpeg/src/ffjpeg+0x400f78)
Address 0x7fffffffd778 is located in stack of thread T0 at offset 248 in frame
#0 0x40448a in jfif_decode /home/test/Desktop/evaulation/ffjpeg/ffjpeg/src/jfif.c:378
This frame has 6 object(s):
[32, 44) 'yuv_stride'
[96, 108) 'yuv_height'
[160, 176) 'dc'
[224, 248) 'yuv_datbuf' <== Memory access at offset 248 overflows this variable
[288, 416) 'ftab'
[448, 704) 'du'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /home/test/Desktop/evaulation/ffjpeg/ffjpeg/src/jfif.c:513 jfif_decode
Shadow bytes around the buggy address:
0x10007fff7a90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007fff7aa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007fff7ab0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007fff7ac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007fff7ad0: f1 f1 f1 f1 00 04 f4 f4 f2 f2 f2 f2 00 04 f4 f4
=>0x10007fff7ae0: f2 f2 f2 f2 00 00 f4 f4 f2 f2 f2 f2 00 00 00[f4]
0x10007fff7af0: f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00
0x10007fff7b00: 00 00 00 00 f2 f2 f2 f2 00 00 00 00 00 00 00 00
0x10007fff7b10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007fff7b20: 00 00 00 00 00 00 00 00 f3 f3 f3 f3 f3 f3 f3 f3
0x10007fff7b30: 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
==102581==ABORTING
Describe the bug A stack-based buffer overflow was discovered in ffjpeg, during the out bound of read in array 'yuv_datbuf'. The issue is being triggered in the function jfif_decode() at jfif.c:513.
To Reproduce Steps to reproduce the behavior:
poc can be found here.
Expected behavior An attacker can exploit this vulnerability by submitting a malicious jpeg that exploits this issue. This will result in a Denial of Service (DoS) when the application attempts to process the file.
Screenshots ASAN Reports
gdb debug
Possible causes of vulnerabilitie Missing value check for variable c leads to out-of-bounds reading of array yuv_datbuf:
System (please complete the following information):