Closed cemonatk closed 2 years ago
This issue is the same as #28 (assigned with CVE-2020-23852) and #24 (assigned CVE-2020-13439).
The overflow is caused by the accessing to the memory buffer without checking the boundary. https://github.com/rockcarry/ffjpeg/blob/0fa4cf8a86d7f23a3e8336343c1895aa634fdc76/src/jfif.c#L550-L552
ffjpeg access yuv_datbuf[1]
with offset uy * yuv_stride[1] + ux
without checking whether it is over the buffer size
https://github.com/rockcarry/ffjpeg/blob/0fa4cf8a86d7f23a3e8336343c1895aa634fdc76/src/jfif.c#L443-L444
An ugly solution is to add check before the access, such as
if (usrc >= yuv_datbuf[1] + yuv_stride[1] * yuv_height[1] * sizeof(int)) {
printf("usrc overflow\n");
return -1;
}
if (vsrc >= yuv_datbuf[2] + yuv_stride[2] * yuv_height[2] * sizeof(int)) {
printf("vsrc overflow\n");
return -1;
}
Describe Two Heap-buffer-overflows were discovered in ffjpeg. The issues are being triggered in function jfif_decode at jfif.c:552:31 and 552:38.
Found by Cem Onat Karagun of Diesec
System info OS version : Ubuntu 21.04 ffjpeg Version : master 0fa4cf8a86
Reproduce
Compile ffjpeg with address sanitizer.
POC Files: decode_poc1.zip decode_poc2.zip
Run POCs with the commands below.
Asan output-1:
Asan output-2: