Closed cemonatk closed 2 years ago
I reproduced your situation on my ubuntu 20.04 machine.
albert @ albert-TM1701 in ~/GitRepos/c/ffjpeg on git:0fa4cf8 x [3:17:07] $ ./src/ffjpeg -e encode_poc1
==263835==ERROR: AddressSanitizer: requested allocation size 0xeb06213d11f6dbc0 (0xeb06213d11f6ebc0 after adjustments for alignment, red zones etc.) exceeds maximum supported size of 0x10000000000 (thread T0)
0 0x7fb35c91dbc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
1 0x5620722fbbf4 in bmp_load /home/albert/GitRepos/c/ffjpeg/src/bmp.c:48
2 0x5620722fb733 in main (/home/albert/GitRepos/c/ffjpeg/src/ffjpeg+0x2733)
3 0x7fb35c6450b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
==263835==HINT: if you don't care about these errors you may set allocator_may_return_null=1 SUMMARY: AddressSanitizer: allocation-size-too-big (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8) in malloc ==263835==ABORTING
downlowded and extracted encode_poc1 the file
command shows it is a jpeg file.
After ln -s encode_poc1 encode_poc1.jpg
xdg-open can not load the image and "Eye of MATE 1.24.0" shows
Error interpreting JPEGimage File (Unsupported marker type 0x30)
I guess your poc file is not encode with jpeg correctly.
I reproduced your situation on my ubuntu 20.04 machine.
albert @ albert-TM1701 in ~/GitRepos/c/ffjpeg on git:0fa4cf8 x [3:17:07] $ ./src/ffjpeg -e encode_poc1
==263835==ERROR: AddressSanitizer: requested allocation size 0xeb06213d11f6dbc0 (0xeb06213d11f6ebc0 after adjustments for alignment, red zones etc.) exceeds maximum supported size of 0x10000000000 (thread T0)
0 0x7fb35c91dbc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
1 0x5620722fbbf4 in bmp_load /home/albert/GitRepos/c/ffjpeg/src/bmp.c:48
2 0x5620722fb733 in main (/home/albert/GitRepos/c/ffjpeg/src/ffjpeg+0x2733)
3 0x7fb35c6450b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
==263835==HINT: if you don't care about these errors you may set allocator_may_return_null=1 SUMMARY: AddressSanitizer: allocation-size-too-big (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8) in malloc ==263835==ABORTING
downlowded and extracted encode_poc1 the
file
command shows it is a jpeg file. Afterln -s encode_poc1 encode_poc1.jpg
xdg-open can not load the image and "Eye of MATE 1.24.0" showsError interpreting JPEGimage File (Unsupported marker type 0x30)
I guess your poc file is not encode with jpeg correctly.
It's not his poc file's problem. He is using some test case poc files to test and find if there are some bug in ffjpeg. so we need fix the issue no matter what the poc file is.
Hello, yes @rockcarry is right. Is there any updates on this one and the issue https://github.com/rockcarry/ffjpeg/issues/43 ?
The reproduce command should be ASAN_OPTIONS="allocator_may_return_null=1" ./src/ffjpeg -e encode_poc1
otherwise we will get the allocation-size-too-big
error.
This issue is same as the #25 (assigned with CVE-2020-23705), they are both caused by the oversized memcpy
.
(i.e. the length of STD_HUFTAB_LUMIN_AC is 178, and the length of STD_HUFTAB_LUMIN_DC is 28, but ffjpeg copies 272 from them).
And I create a PR #45 to fix them.
Describe A global-buffer-overflow was discovered in ffjpeg. The issue is being triggered in function jfif_encode at jfif.c:708.
Found by Cem Onat Karagun of Diesec
System info OS version : Ubuntu 21.04 ffjpeg Version : master(0fa4cf8a86)
Reproduce
Compile ffjpeg with address sanitizer.
PoC file: encode_poc1.zip
Run with the following command.
Asan output: