1109371 - invalid memcpy in openh264p

Status: RESOLVED FIXED

(Core :: Audio/Video: GMP, defect)

Description

[Al Billings [:abillings - ex-MoCo]]

Attachment: ASAN log

[e-mail] received the following report:

Attached file will expose an invalid memcpy in openh264. I haven't done
a thorough analysis (and I feel I'm probably not skilled enough to
judge exploitability).

I've attached address sanitizer output and a gdb backtrace for
further analysis.

This was found with american fuzzy lop.

cu,
-- Hanno Böck http://hboeck.de/ mail/jabber: [e-mail] GPG: BBB51E42

Comment 1

[Al Billings [:abillings - ex-MoCo]]

Attachment: gdb-backtrace.log

Comment 2

[Al Billings [:abillings - ex-MoCo]]

Attachment: openh264-crash-minimal case

Comment 3

[Daniel Veditz [:dveditz]]

Ethan: the symptoms seem like they might be exploitable. Can you tell?

Comment 4

[Ethan Hugg [:ehugg]]

I will have the team analyze it tonight.  The crash looks like it's in CabacContextInit which is not in the v1.1-Firefox34 branch that we are shipping, but is in the master branch which I'm hoping to branch from soon for our next FF build.  We will make sure it's fixed before we call our next build.

Comment 5

[Ethan Hugg [:ehugg]]

Fix reviewed here:
https://rbcommons.com/s/OpenH264/r/1008/
And merged here:
https://github.com/cisco/openh264/commit/7f27198c6857096d755b592c7f55f7b1469c50ab

So it should be in OpenH264 v1.3

Comment 6

[Al Billings [:abillings - ex-MoCo]]

Randell, when are we going to take OpenH264 1.3 on Firefox?

Comment 7

[Ethan Hugg [:ehugg]]

The bug to get OpenH264 1.3 into Firefox is here - Bug 1113777

Comment 8

[Randell Jesup [:jesup] (needinfo me)]

From bug 1113777: "My assumption is that we'll put this version in for 36+ and let it ride the train from there."

Comment 9

[Ethan Hugg [:ehugg]]

OpenH264 1.3 has this fix and is now downloaded for Firefox 34+ so marking this as fixed.