Bug#884232: ffmpeg: CVE-2017-17555

2017-12-12 Thread Salvatore Bonaccorso 
Control: reassign -1 src:aubio 0.4.5-1

Hi Carl,

On Tue, Dec 12, 2017 at 11:20:42PM +0100, Carl Eugen Hoyos wrote:
> This is not a bug in FFmpeg:
> aubio initializes libswresample with 2 channels and then passes data
> that contains just one channel.
> 
> That cant really work or how could it ?
> swresample has no knowledge about what is in the array except what it
> is told
> There are multiple ways to provide this information to swr
> 
> (Answer from Michael on ffmpeg-security)

Thanks for your's and MIchael's analysis/comment. So let's reassign
this to src:aubio since it would need to be fixed there.

Regards,
Salvatore

Bug#884232: ffmpeg: CVE-2017-17555

2017-12-12 Thread Carl Eugen Hoyos 
This is not a bug in FFmpeg:
aubio initializes libswresample with 2 channels and then passes data
that contains just one channel.

That cant really work or how could it ?
swresample has no knowledge about what is in the array except what it
is told
There are multiple ways to provide this information to swr

(Answer from Michael on ffmpeg-security)

Carl Eugen

Bug#884232: ffmpeg: CVE-2017-17555

2017-12-12 Thread Salvatore Bonaccorso 
Source: ffmpeg
Version: 7:3.4-4
Severity: normal
Tags: security upstream
Control: found -1 7:3.4.1-1

Hi,

the following vulnerability was published for ffmpeg.

CVE-2017-17555[0]:
| The swri_audio_convert function in audioconvert.c in FFmpeg
| libswresample through 3.0.101, as used in FFmpeg 3.4.1, aubio 0.4.6,
| and other products, allows remote attackers to cause a denial of
| service (NULL pointer dereference and application crash) via a crafted
| audio file.

The issue is triggerable/demostrable with the POC attached to [1]:

$ ./aubio/build/examples/aubiomfcc ./crash-2-null-ptr
[mp3 @ 0x61b00080] Format mp3 detected only with low score of 1, 
misdetection possible!
[mp3 @ 0x61b00080] Skipping 3350 bytes of junk at 0.
[mp3 @ 0x61b00080] Estimating duration from bitrate, this may be inaccurate
0.00-18.015953 -0.012183 -0.867832 -0.616462 0.813869 -1.063807 
-0.276262 -0.236723 -1.673019 1.016008 -0.041898 0.450148 -0.699137
ASAN:DEADLYSIGNAL
=
==13255==ERROR: AddressSanitizer: SEGV on unknown address 0x (pc 
0x7fd18a85df33 bp 0x0004 sp 0x7ffec8afd8e8 T0)
==13255==The signal is caused by a READ memory access.
==13255==Hint: address points to the zero page.
#0 0x7fd18a85df32  (/usr/lib/x86_64-linux-gnu/libswresample.so.2+0x11f32)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV 
(/usr/lib/x86_64-linux-gnu/libswresample.so.2+0x11f32)
==13255==ABORTING

Backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x72af0f33 in ff_int16_to_float_a_sse2.next ()
at src/libswresample/x86/audio_convert.asm:656
656 src/libswresample/x86/audio_convert.asm: No such file or directory.
(gdb) bt
#0  0x72af0f33 in ff_int16_to_float_a_sse2.next ()
at src/libswresample/x86/audio_convert.asm:656
#1  0x72ae78de in swri_audio_convert (ctx=0x60701740, 
out=out@entry=0x632037d0, in=in@entry=0x632035b0, len=len@entry=384) at 
src/libswresample/audioconvert.c:226
#2  0x72aee190 in swr_convert_internal (s=s@entry=0x63200800, 
out=out@entry=0x63203e30, out_count=out_count@entry=384, 
in=in@entry=0x632035b0, in_count=in_count@entry=384)
at src/libswresample/swresample.c:633
#3  0x72aef252 in swr_convert_internal (in_count=384, 
in=0x632035b0, out_count=384, out=0x63203e30, s=0x63200800) at 
src/libswresample/swresample.c:470
#4  0x72aef252 in swr_convert (s=0x63200800, out_arg=, out_count=, in_arg=, in_count=)
at src/libswresample/swresample.c:800
#5  0x76c08af5 in aubio_source_avcodec_readframe ()
at /usr/lib/x86_64-linux-gnu/libaubio.so.5
#6  0x76c08c65 in aubio_source_avcodec_do () at 
/usr/lib/x86_64-linux-gnu/libaubio.so.5
#7  0x9db4 in examples_common_process (process_func=0x91fb 
, print=0x9266 ) at 
../examples/utils.c:160
#8  0x9875 in main (argc=2, argv=0x7fffeb88) at 
../examples/aubiomfcc.c:66


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-17555
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17555
[1] 
https://github.com/IvanCql/vulnerability/blob/master/An%20NULL%20pointer%20dereference(DoS)%20Vulnerability%20was%20found%20in%20function%20swri_audio_convert%20of%20ffmpeg%20libswresample.md

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore