[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[bug-libextractor] NULL Pointer Dereference vulneribility in libextracto

From: Leon Zhao
Subject: [bug-libextractor] NULL Pointer Dereference vulneribility in libextractor EXTRACTOR_sid_extract_method
Date: Wed, 1 Nov 2017 14:22:50 +0800

Tested Version:
libextractor v1.6

Tested System:
Linux leon-virtual-machine 4.10.0-35-generic #39~16.04.1-Ubuntu SMP Wed Sep 13 09:02:42 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

In function EXTRACTOR_sid_extract_method at sid_extractor.c 
 179   if (sizeof (struct header) >
 180       ec->read (ec->cls,
 181                 &data,
 182                 sizeof (struct header)))
 183     return;
 184   head = data;
 186   /* Check "magic" id bytes */
 187   if ( (0 != memcmp (head->magicid, "PSID", 4)) &&
 188        (0 != memcmp (head->magicid, "RSID", 4)) )
 189     return;
 191   /* Mime-type */
 192   ADD ("audio/prs.sid", EXTRACTOR_METATYPE_MIMETYPE);
ec->read function set data to NULL.
Crash Information:
The output with address sanitizer enabled
./extract -i extract.EXTRACTOR_sid_extract_method.sid_extractor.187.crash 
Keywords for file extract.EXTRACTOR_sid_extract_method.sid_extractor.187.crash:
==41155==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f047403cfe4 bp 0x7ffd91e2f930 sp 0x7ffd91e2f0b8 T0)
    #0 0x7f047403cfe3  (/lib/x86_64-linux-gnu/libc.so.6+0x16efe3)
    #1 0x7f047456b74e in memcmp (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x7774e)
    #2 0x7f046c67ef93 in EXTRACTOR_sid_extract_method /root/libextractor-1.6/src/plugins/sid_extractor.c:187
    #3 0x7f04742b49a1 in do_extract /root/libextractor-1.6/src/main/extractor.c:583
    #4 0x7f04742b4db5 in EXTRACTOR_extract /root/libextractor-1.6/src/main/extractor.c:662
    #5 0x4044f9 in main /root/libextractor-1.6/src/main/extract.c:983
    #6 0x7f0473eee82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #7 0x4017c8 in _start (/opt/asan/bin/extract+0x4017c8)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ??:0 ??

Zhao Liang, Huawei Weiran Labs

Attachment is POC file

Attachment: extract.EXTRACTOR_sid_extract_method.sid_extractor.187.crash
Description: Binary data

reply via email to

[Prev in Thread] Current Thread [Next in Thread]