VULNERABILITY DETAILS
Integer overflow happens in ChunkDemuxer of Chrome(Android), leading to Out-of-bounds Write.

FFmpegDemuxer and ChunkDemuxer in Chrome.

https://cs.chromium.org/chromium/src/media/blink/webmediaplayer_impl.cc?dr=CSs&sq=package:chromium&rcl=1484007841&l=1643

	void WebMediaPlayerImpl::StartPipeline() {
		//...

		#if !defined(MEDIA_DISABLE_FFMPEG)
		    Demuxer::MediaTracksUpdatedCB media_tracks_updated_cb =
		        BIND_TO_RENDER_LOOP(&WebMediaPlayerImpl::OnFFmpegMediaTracksUpdated);

		    demuxer_.reset(new FFmpegDemuxer(media_task_runner_, data_source_.get(),
		                                     encrypted_media_init_data_cb,
		                                     media_tracks_updated_cb, media_log_));
		#else
		    OnError(PipelineStatus::DEMUXER_ERROR_COULD_NOT_OPEN);
		    return;
		#endif
		} else {
		  DCHECK(!chunk_demuxer_);
		  DCHECK(!data_source_);

		  chunk_demuxer_ = new ChunkDemuxer(
		      BIND_TO_RENDER_LOOP(&WebMediaPlayerImpl::OnDemuxerOpened),
		      encrypted_media_init_data_cb, media_log_);
		  demuxer_.reset(chunk_demuxer_);
		}

		//...
	}

When playing video by Media Source Extentions(MSE), chrome will call ChunkDemuxer to parse video.

ChunkDemuxer provide some media formats, such as https://cs.chromium.org/chromium/src/media/formats/.

When parsing 'ELST' box of MP4 in file box_definitions.cc, integer overflow happens. 

	https://cs.chromium.org/chromium/src/media/formats/mp4/box_definitions.cc

	bool EditList::Parse(BoxReader* reader) {
	  uint32_t count;
	  RCHECK(reader->ReadFullBoxHeader() && reader->Read4(&count));

	  if (reader->version() == 1) {
	    RCHECK(reader->HasBytes(count * 20));
	  } else {
	    RCHECK(reader->HasBytes(count * 12));
	  }
	  edits.resize(count);

	  for (std::vector<EditListEntry>::iterator edit = edits.begin();
	       edit != edits.end(); ++edit) {
	    if (reader->version() == 1) {
	      RCHECK(reader->Read8(&edit->segment_duration) &&
	             reader->Read8s(&edit->media_time));
	    } else {
	      RCHECK(reader->Read4Into8(&edit->segment_duration) &&
	             reader->Read4sInto8s(&edit->media_time));
	    }
	    RCHECK(reader->Read2s(&edit->media_rate_integer) &&
	           reader->Read2s(&edit->media_rate_fraction));
	  }
	  return true;
	}

count is read from mp4 file, which is between 0x0 and 0xffffffff. when reader->version() == 1, count * 20 will integer overflow, which bypass reader->HasBytes RCHECK.
What's more, edits is defined as std::vector<EditListEntry> edits;, edits.resize(count); will malloc count * sizeof(EditListEntry) bytes, this will also overflow, leading to out-of-bounds write.

VERSION
Chrome Version: [55.0.2883.91] + [stable]
Operating System: [Android OS, 6.0.1, Nexus 6P]

REPRODUCTION CASE
PoC is attached as follow.

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
Type of crash: [tag]
Crash State: 
	Program received signal SIGSEGV, Segmentation fault.
	[Switching to Thread 28739]
	0x40121108 in memset () from /home/ubuntu/ext/Android/NDK/my-ndk-tool-arm/bin/debug_nexus5_4.4.0_chrome/lib/libc.so
	(gdb) bt
	#0  0x40121108 in memset () from /home/ubuntu/ext/Android/NDK/my-ndk-tool-arm/bin/debug_nexus5_4.4.0_chrome/lib/libc.so
	#1  0x7788607c in ?? () from /home/ubuntu/ext/Android/NDK/my-ndk-tool-arm/bin/debug_nexus5_4.4.0_chrome/lib/libchrome.so
	Backtrace stopped: previous frame identical to this frame (corrupt stack?)
	(gdb) i r
	r0             0x76b37ff8	1991475192
	r1             0x0	0
	r2             0x18	24
	r3             0x76df3d25	1994341669
	r4             0x7a88dac0	2055789248
	r5             0x7ffff19f	2147479967
	r6             0x76b226c8	1991386824
	r7             0x76b226e0	1991386848
	r8             0x76b37ff8	1991475192
	r9             0x76b2d890	1991432336
	r10            0x0	0
	r11            0x31804000	830488576
	r12            0x796ffa74	2037381748
	sp             0x75909d6c	0x75909d6c
	lr             0x7788607d	2005426301
	pc             0x40121108	0x40121108 <memset+44>
	cpsr           0x80d0010	135069712

PATCH:
	--- box_definitions_a.cc	2017-01-10 14:53:55.000000000 +0800
	+++ box_definitions_b.cc	2017-01-10 15:13:42.000000000 +0800
	@@ -473,10 +473,13 @@
	   RCHECK(reader->ReadFullBoxHeader() && reader->Read4(&count));
	 
	   if (reader->version() == 1) {
	+    RCHECK(((count * 20) / 20) == count);
	     RCHECK(reader->HasBytes(count * 20));
	   } else {
	+    RCHECK(((count * 12) / 12) == count);
	     RCHECK(reader->HasBytes(count * 12));
	   }
	+  RCHECK(((count * sizeof(EditListEntry)) / sizeof(EditListEntry)) == count);
	   edits.resize(count);
	 
	   for (std::vector<EditListEntry>::iterator edit = edits.begin();


 

Deleted: PoC.zip 4.8 MB

PoC.zip 4.8 MB Download

Deleted: patch.diff 605 bytes

patch.diff 605 bytes Download