bugCompact Disc Input and Control Library - Bugs: bug #45014, Heap overflow / invalid read on...

 
 

bug #45014: Heap overflow / invalid read on malformed iso in function _iso9660_dir_to_statbuf()

Submitter:  Hanno Boeck <hanno>
Submitted:  Tue 05 May 2015 07:03:02 AM UTC
   
 
Category:  run-time error Severity:  5 - Average
Item Group:  libiso9660 Status:  Fixed
Privacy:  Public Assigned to:  rocky
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 08 May 2015 10:34:26 PM UTC, comment #1: 

With commit 8be41a3, I believe this is fixed.

Rocky Bernstein <rocky>
Group administrator
Tue 05 May 2015 07:03:02 AM UTC, original submission:  

Attached file will trigger a heap overflow with iso-info -f.

To see it one needs to use either Address Sanitizer or Valgrind. I've attached the output of both. This was found with american fuzzy lop.

Hanno Boeck <hanno>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by rocky (Updated the item)
  • -email is unavailable- added by hanno (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 8 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-03-25 rocky Open/ClosedOpen Closed
    2015-05-08 rocky StatusNone Fixed
        Assigned toNone rocky
    2015-05-06 rocky CategoryNone run-time error
        Item GroupNone libiso9660
    2015-05-05 hanno Attached File- Added libcdio-heapoverflow-_iso9660_dir_to_statbuf.iso, #33904
        Attached File- Added libcdio-heapoverflow-_iso9660_dir_to_statbuf.iso.valgrind.txt, #33905
        Attached File- Added libcdio-heapoverflow-_iso9660_dir_to_statbuf.iso.asan.txt, #33906

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code