1170344 - int oveflow in libstagefright during mp4 parsing

Status: RESOLVED FIXED

(Core :: Audio/Video, defect)

Description

[laf.intel]

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.81 Safari/537.36

Steps to reproduce:

A specially crafted mp4 file can cause an integer overflow in VectorImpl::setCapacity. If there is a 'saio' tag in a mp4 file MPEG4Extractor::parseChunk calls SampleTable::setSampleAuxiliaryInformationOffsetParams. The latter function calls  mCencOffsets.setCapacity(cencOffsetCount) with cencOffsetCount fully controlled by an attacker. The setCapacity is implemented in VectorImpl::setCapacity. In this function SharedBuffer::alloc(new_capacity * mItemSize) is called with new_capacity under attacker control. Multiplication with mItemSize (8 in this particular case) might causes an integer overflow. For example new_capacity set to 0x20000001 results in a 8 byte allocation.

Comment 1

[Andrew McCreight [:mccr8]]

Is this something you could look into, jya? Thanks.

Comment 2

[Jean-Yves Avenard [:jya]]

I shake my head in disbelief whenever I look at stagefright :(

Comment 3

[Daniel Veditz [:dveditz]]

Jean-Yves: is this a duplicate of bug 1185115? we never got a testcase but the description fits.

laf.intel: can you reproduce this bug in today's nightly? If it's the other bug the fix landed yesterday.

Comment 5

[Jean-Yves Avenard [:jya]]

Yes, it's the same bug.

sorry it took so long to review. 2 months since report, that's no good :(

Comment 6

[laf.intel]

Yes, the commit fixed the bug in this ticket as well. It seems to be a duplicate.

Comment 7

[Daniel Veditz [:dveditz]]

Thanks. I'm going to mark this "Depends on" and FIXED rather than as a duplicate so the bounty request doesn't get overlooked. This may not have been the bug that sparked the fix but that's _our_ fault not yours.