Source: sox Version: 14.4.1-5 Severity: important Tags: security upstream Hi,
the following vulnerability was published for sox.
CVE-2017-15370[0]:
| There is a heap-based buffer overflow in the ImaExpandS function of
| ima_rw.c in Sound eXchange (SoX) 14.4.2. A Crafted input will lead to a
| denial of service attack during conversion of an audio file.
With attached reproducer (from the original reference in case it would
disapear):
$ ./src/sox ~/02-heap-buffer-over tt.snd
=================================================================
==4925==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x619000000952
at pc 0x7ff7f48bc233 bp 0x7ffd29283c90 sp 0x7ffd29283c88
WRITE of size 2 at 0x619000000952 thread T0
#0 0x7ff7f48bc232 in ImaExpandS src/ima_rw.c:126
#1 0x7ff7f48bc2a2 in lsx_ima_block_expand_i src/ima_rw.c:142
#2 0x7ff7f48bd402 in ImaAdpcmReadBlock src/wav.c:139
#3 0x7ff7f48c4564 in read_samples src/wav.c:1027
#4 0x7ff7f47951fb in sox_read src/formats.c:973
#5 0x406096 in sox_read_wide src/sox.c:490
#6 0x406a6e in combiner_drain src/sox.c:552
#7 0x7ff7f47c8fe1 in drain_effect src/effects.c:318
#8 0x7ff7f47c9ffe in sox_flow_effects src/effects.c:387
#9 0x4122da in process src/sox.c:1794
#10 0x41b386 in main src/sox.c:3012
#11 0x7ff7f3c692e0 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x202e0)
#12 0x402f49 in _start (/root/sox-14.4.1/src/.libs/sox+0x402f49)
0x619000000952 is located 0 bytes to the right of 978-byte region
[0x619000000580,0x619000000952)
allocated by thread T0 here:
#0 0x7ff7f4c39fd0 in __interceptor_realloc
(/usr/lib/x86_64-linux-gnu/libasan.so.4+0xd9fd0)
#1 0x7ff7f479bd6d in lsx_realloc src/xmalloc.c:37
#2 0x7ff7f48c1d3b in startread src/wav.c:730
#3 0x7ff7f4790d17 in open_read src/formats.c:540
#4 0x7ff7f4791563 in sox_open_read src/formats.c:580
#5 0x41a81f in main src/sox.c:2949
#6 0x7ff7f3c692e0 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x202e0)
SUMMARY: AddressSanitizer: heap-buffer-overflow src/ima_rw.c:126 in ImaExpandS
Shadow bytes around the buggy address:
0x0c327fff80d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c327fff80e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c327fff80f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c327fff8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c327fff8110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c327fff8120: 00 00 00 00 00 00 00 00 00 00[02]fa fa fa fa fa
0x0c327fff8130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c327fff8140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c327fff8150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c327fff8160: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c327fff8170: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==4925==ABORTING
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2017-15370
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15370
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
02-heap-buffer-over
Description: Wave audio
