New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 849062 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Jun 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows
Pri: 1
Type: Bug-Security



Sign in to add a comment

Heap-buffer-overflow in avio_read

Project Member Reported by ClusterFuzz, Jun 3 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5015143155761152

Fuzzer: inferno_layout_test_unmodified
Job Type: windows_asan_content_shell
Platform Id: windows

Crash Type: Heap-buffer-overflow WRITE {*}
Crash Address: 0x12218662cc77
Crash State:
  avio_read
  mov_read_sample_encryption_info
  mov_parse_auxiliary_info
  
Sanitizer: address (ASAN)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=560376:560384

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5015143155761152

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jun 3 2018

Components: Internals>Media>FFmpeg
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Jun 3 2018

Cc: modmaker...@ffmpeg.org modma...@google.com
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

avformat/mov: Increase support for common encryption. by modmaker@google.com - https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/f7221d8e670ec05471a16cc4cc1cc8e0040b5b5f

avformat/mov: Fix parsing of saio/siaz atoms in encrypted content. by modmaker@google.com - https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/e5ba5fab493bd2edb24da47940626b024ebd0371

avformat/mov: Fix memory leak in encryption info. by modmaker-at-google.com@ffmpeg.org - https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/606c5c7f3ad1d289ef745b9053024ad318646c7e

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
Project Member

Comment 3 by sheriffbot@chromium.org, Jun 3 2018

Labels: M-68 Target-68
Project Member

Comment 4 by sheriffbot@chromium.org, Jun 3 2018

Labels: ReleaseBlock-Stable
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 5 by sheriffbot@chromium.org, Jun 3 2018

Labels: Pri-1
Project Member

Comment 6 by sheriffbot@chromium.org, Jun 4 2018

Labels: -Security_Impact-Head Security_Impact-Beta
Cc: -modmaker...@ffmpeg.org
Owner: modma...@google.com
Status: Assigned (was: Untriaged)
I think this is caused by the same thing as  http://crbug.com/847060 .
Project Member

Comment 8 by bugdroid1@chromium.org, Jun 4 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/third_party/ffmpeg/+/5e5a8e81925df95a88356b410c1374b33b920455

commit 5e5a8e81925df95a88356b410c1374b33b920455
Author: Jacob Trimble <modmaker@google.com>
Date: Mon Jun 04 21:20:16 2018

Fix heap buffer overflow.

Bug:  847060 
Bug:  849062 
Change-Id: Ibf18b3c0fd375ddd09addb019888bdd6ec576355
Reviewed-on: https://chromium-review.googlesource.com/1081148
Reviewed-by: Frank Liberato <liberato@chromium.org>

[modify] https://crrev.com/5e5a8e81925df95a88356b410c1374b33b920455/libavformat/mov.c
[modify] https://crrev.com/5e5a8e81925df95a88356b410c1374b33b920455/chromium/patches/README

Status: Fixed (was: Assigned)
Project Member

Comment 10 by sheriffbot@chromium.org, Jun 6 2018

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 11 by sheriffbot@chromium.org, Jun 8 2018

Labels: Merge-Request-68
Project Member

Comment 12 by sheriffbot@chromium.org, Jun 8 2018

Labels: -Merge-Request-68 Hotlist-Merge-Review Merge-Review-68
This bug requires manual review: M68 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), kariahda@(iOS), bhthompson@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Labels: -Merge-Review-68 Merge-Approved-68
Approved. branch:3440
Project Member

Comment 14 by sheriffbot@chromium.org, Jun 12 2018

Cc: abdulsyed@google.com
This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 15 by ClusterFuzz, Jun 12 2018

Labels: Needs-Feedback
ClusterFuzz testcase 5015143155761152 is still reproducing on tip-of-tree build (trunk).

Please re-test your fix against this testcase and if the fix was incorrect or incomplete, please re-open the bug. Otherwise, ignore this notification and add ClusterFuzz-Wrong label.
Project Member

Comment 16 by ClusterFuzz, Jun 14 2018

Labels: OS-Linux
Project Member

Comment 17 by sheriffbot@chromium.org, Jun 18 2018

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Owner: liber...@chromium.org
=>liberato for handling any merge necessities.
Cc: abdulsyed@chromium.org
Pls merge you change to M68 branch 3440 ASAP so we can pick it up for this week Beta release. Merge has to happen latest by 1:00 PM PT tomorrow, Tuesday (06/19), so we can pick it up for Wednesday Beta release.




Project Member

Comment 20 by bugdroid1@chromium.org, Jun 18 2018

Labels: -merge-approved-68 merge-merged-3440
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/90cefb3857c34972d1bd0fa88627846c2b4236fa

commit 90cefb3857c34972d1bd0fa88627846c2b4236fa
Author: liberato@chromium.org <liberato@chromium.org>
Date: Mon Jun 18 22:55:04 2018

Roll deps for ffmpeg fixes.

This rolls the following into the ffmpeg tree:

commit 8f9a277d4e4870586365f168a4e38c2b381401ec
Author: liberato@chromium.org <liberato@chromium.org>
  Add null check for encryption info.

commit beef790ce19168db60da173f04028d6bba8c9127
Author: Jacob Trimble <modmaker@google.com>
  Fix heap buffer overflow.

Bug:  849062 
Change-Id: I7944a0e02fc5b01871e4b8efc8d3d1ee7fdb51df
Reviewed-on: https://chromium-review.googlesource.com/1105318
Reviewed-by: Dale Curtis <dalecurtis@chromium.org>
Cr-Commit-Position: refs/branch-heads/3440@{#429}
Cr-Branched-From: 010ddcfda246975d194964ccf20038ebbdec6084-refs/heads/master@{#561733}
[modify] https://crrev.com/90cefb3857c34972d1bd0fa88627846c2b4236fa/DEPS

Labels: -ReleaseBlock-Stable
Project Member

Comment 22 by bugdroid1@chromium.org, Jun 22 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/0d0c062e8cefdfdc777cd36ab23a2b4ddac65fcd

commit 0d0c062e8cefdfdc777cd36ab23a2b4ddac65fcd
Author: Dale Curtis <dalecurtis@chromium.org>
Date: Fri Jun 22 16:57:36 2018

Update ffmpeg DEPs for rest of iv size fixes.

BUG= 849062 , 853416 

Change-Id: Ida5bff50f4095dadd9314c49c836ec6b80101a4b
Reviewed-on: https://chromium-review.googlesource.com/1111276
Reviewed-by: Frank Liberato <liberato@chromium.org>
Cr-Commit-Position: refs/branch-heads/3440@{#490}
Cr-Branched-From: 010ddcfda246975d194964ccf20038ebbdec6084-refs/heads/master@{#561733}
[modify] https://crrev.com/0d0c062e8cefdfdc777cd36ab23a2b4ddac65fcd/DEPS

Project Member

Comment 23 by sheriffbot@chromium.org, Sep 12

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment