Source file:   mov.c

chrome_child!mov_read_uuid

chrome_child.dll version: 53.0.2785.89


int64_t truncation results in av_malloc(0), and subsequent memory corruption. Might be semi-useless heap corruption bugs (requires >4GB file, and is likely just a DOS).

This bug is nearly identical to the mov_read_hdlr, but while I have observed the mov_read_hdlr heap allocation size wrap. All this info was statically determined; I see no reason why it wouldn't yield the same result, but I have not demo'd this bug.


---- Breakpoints ----

bu chrome_child!mov_read_uuid


static int mov_read_uuid(MOVContext *c, AVIOContext *pb, MOVAtom atom)
{
    int ret;
    uint8_t uuid[16];
    static const uint8_t uuid_isml_manifest[] = {
        0xa5, 0xd4, 0x0b, 0x30, 0xe8, 0x14, 0x11, 0xdd,
        0xba, 0x2f, 0x08, 0x00, 0x20, 0x0c, 0x9a, 0x66
    };
    static const uint8_t uuid_xmp[] = {
        0xbe, 0x7a, 0xcf, 0xcb, 0x97, 0xa9, 0x42, 0xe8,
        0x9c, 0x71, 0x99, 0x94, 0x91, 0xe3, 0xaf, 0xac
    };

    if (atom.size < sizeof(uuid) || atom.size == INT64_MAX)
        return AVERROR_INVALIDDATA;

    ret = avio_read(pb, uuid, sizeof(uuid));
    if (ret < 0) {
        return ret;
    } else if (ret != sizeof(uuid)) {
        return AVERROR_INVALIDDATA;
    }
    if (!memcmp(uuid, uuid_isml_manifest, sizeof(uuid))) {
        uint8_t *buffer, *ptr;
        char *endptr;
        size_t len = atom.size - sizeof(uuid);

        if (len < 4) {
            return AVERROR_INVALIDDATA;
        }
        ret = avio_skip(pb, 4); // zeroes
        len -= 4;

        buffer = av_mallocz(len + 1);
        if (!buffer) {
            return AVERROR(ENOMEM);
        }
        ret = avio_read(pb, buffer, len);
        if (ret < 0) {
            av_free(buffer);
            return ret;
        } else if (ret != len) {
            av_free(buffer);
            return AVERROR_INVALIDDATA;
        }

        ptr = buffer;
        while ((ptr = av_stristr(ptr, "systemBitrate=\""))) {
            ptr += sizeof("systemBitrate=\"") - 1;
            c->bitrates_count++;
            c->bitrates = av_realloc_f(c->bitrates, c->bitrates_count, sizeof(*c->bitrates));
            if (!c->bitrates) {
                c->bitrates_count = 0;
                av_free(buffer);
                return AVERROR(ENOMEM);
            }
            errno = 0;
            ret = strtol(ptr, &endptr, 10);
            if (ret < 0 || errno || *endptr != '"') {
                c->bitrates[c->bitrates_count - 1] = 0;
            } else {
                c->bitrates[c->bitrates_count - 1] = ret;
            }
        }

        av_free(buffer);
    } else if (!memcmp(uuid, uuid_xmp, sizeof(uuid))) {
        uint8_t *buffer;
        size_t len = atom.size - sizeof(uuid);  // <------------------------------------------------------------------ when atom.size (int64_t) == 0xFFFFFFFF + sizeof(uuid);

        buffer = av_mallocz(len + 1); // results in a allocation of size == 0
        if (!buffer) {
            return AVERROR(ENOMEM);
        }
        ret = avio_read(pb, buffer, len); // and subsequent memory corruption
        if (ret < 0) {
            av_free(buffer);
            return ret;
        } else if (ret != len) {
            av_free(buffer);
            return AVERROR_INVALIDDATA;
        }
        if (c->export_xmp) {
            buffer[len] = '\0';
            av_dict_set(&c->fc->metadata, "xmp", buffer, 0);
        }
        av_free(buffer);
    }
    return 0;
}




--------------------------------------------------- DISASSEMBLY ---------------------------------------------------


.text:11595A61 loc_11595A61:                           ; CODE XREF: mov_read_uuid+84j
.text:11595A61                 mov     eax, [ebx+ecx*4]
.text:11595A64                 mov     ebx, offset uuid_isml_manifest
.text:11595A69                 cmp     eax, [ebx+ecx*4]
.text:11595A6C                 lea     ebx, [ebp+uuid]
.text:11595A6F                 jnz     loc_11595B98
.text:11595A75                 inc     ecx
.text:11595A76                 cmp     ecx, edx
.text:11595A78                 jnz     short loc_11595A61
.text:11595A7A                 mov     ebx, dword ptr [ebp+atom.size]
.text:11595A7D                 add     ebx, 0FFFFFFF0h
.text:11595A80                 cmp     ebx, edx
.text:11595A82                 jb      loc_11595C26
.text:11595A88                 push    0
.text:11595A8A                 push    edx             ; offset
.text:11595A8B                 push    edi             ; s
.text:11595A8C                 call    _avio_skip
.text:11595A91                 sub     ebx, 4
.text:11595A94                 lea     eax, [ebx+1]				<------------------------------ Allocation wrap when atom.size (int64_t) == 0xFFFFFFFF + sizeof(uuid);
.text:11595A97                 push    eax             ; size
.text:11595A98                 call    _av_mallocz
.text:11595A9D                 add     esp, 10h
.text:11595AA0                 mov     [ebp+block], eax
.text:11595AA3                 test    eax, eax
.text:11595AA5                 jnz     short loc_11595AAF