<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof">
Hi,</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0">
We found one heap-use-after-free bug in live.2023.05.10 while running in Ubuntu:20.04. This bug happens while calling the function `MatroskaFileParser::continueParsing`. </div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0">
<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0">
You can reproduce this bug as the README in the attachment as follows:</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0 ContentPasted2">
1. build the docker image:
<div class="ContentPasted2"> docker build . -t uaf</div>
<div class="ContentPasted2">2. create the docker container:</div>
<div class="ContentPasted2"> docker run -it -u root --privileged --name reproduce-uaf uaf bash</div>
<div class="ContentPasted2">3. open two terminals:</div>
<div class="ContentPasted2"> 3.1 one run live555:</div>
<div class="ContentPasted2"> cd /home/ubuntu/experiments/live/testProgs && ./testOnDemandRTSPServer</div>
<div class="ContentPasted2"> 3.2 another one to run the client to send requests:</div>
<div class="ContentPasted2"> cd /home/ubuntu/experiments && aflnet-replay client-request1 RTSP 8554 30</div>
<div class="ContentPasted2"> You can also try other client requests:</div>
cd /home/ubuntu/experiments && aflnet-replay client-request2 RTSP 8554 30<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0">
<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0">
<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0">
The following is the ASAN bug report:</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0">
<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0 ContentPasted1">
=================================================================
<div class="ContentPasted1">==98331==ERROR: AddressSanitizer: heap-use-after-free on address 0x7ffff3969810 at pc 0x0000004957e5 bp 0x7fffffffe0d0 sp 0x7fffffffd898</div>
<div class="ContentPasted1">WRITE of size 270 at 0x7ffff3969810 thread T0</div>
<div class="ContentPasted1"> #0 0x4957e4 in __asan_memmove (/home/ubuntu/experiments/live/testProgs/testOnDemandRTSPServer+0x4957e4)</div>
<div class="ContentPasted1"> #1 0x5d06f0 in StreamParser::testBytes(unsigned char*, unsigned int) /home/ubuntu/experiments/live/liveMedia/./StreamParser.hh:96:5</div>
<div class="ContentPasted1"> #2 0x5d06f0 in StreamParser::getBytes(unsigned char*, unsigned int) /home/ubuntu/experiments/live/liveMedia/./StreamParser.hh:90:5</div>
<div class="ContentPasted1"> #3 0x5d06f0 in MatroskaFileParser::deliverFrameBytes() /home/ubuntu/experiments/live/liveMedia/MatroskaFileParser.cpp:1240:7</div>
<div class="ContentPasted1"> #4 0x5c761c in MatroskaFileParser::parse() /home/ubuntu/experiments/live/liveMedia/MatroskaFileParser.cpp:173:4</div>
<div class="ContentPasted1"> #5 0x5c62c8 in MatroskaFileParser::continueParsing() /home/ubuntu/experiments/live/liveMedia/MatroskaFileParser.cpp:100:10</div>
<div class="ContentPasted1"> #6 0x5c62c8 in MatroskaFileParser::continueParsing(void*, unsigned char*, unsigned int, timeval) /home/ubuntu/experiments/live/liveMedia/MatroskaFileParser.cpp:95:38</div>
<div class="ContentPasted1"> #7 0x605e86 in BasicTaskScheduler::SingleStep(unsigned int) /home/ubuntu/experiments/live/BasicUsageEnvironment/BasicTaskScheduler.cpp:171:2</div>
<div class="ContentPasted1"> #8 0x60c409 in BasicTaskScheduler0::doEventLoop(char volatile*) /home/ubuntu/experiments/live/BasicUsageEnvironment/BasicTaskScheduler0.cpp:82:5</div>
<div class="ContentPasted1"> #9 0x4ca479 in main /home/ubuntu/experiments/live/testProgs/testOnDemandRTSPServer.cpp:462:24</div>
<div class="ContentPasted1"> #10 0x7ffff770a082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16</div>
<div class="ContentPasted1"> #11 0x41d73d in _start (/home/ubuntu/experiments/live/testProgs/testOnDemandRTSPServer+0x41d73d)</div>
<div><br class="ContentPasted1">
</div>
<div class="ContentPasted1">0x7ffff3969810 is located 16 bytes inside of 300564-byte region [0x7ffff3969800,0x7ffff39b2e14)</div>
<div class="ContentPasted1">freed by thread T0 here:</div>
<div class="ContentPasted1"> #0 0x4c5f4d in operator delete[](void*) (/home/ubuntu/experiments/live/testProgs/testOnDemandRTSPServer+0x4c5f4d)</div>
<div class="ContentPasted1"> #1 0x5a3674 in MultiFramedRTPSink::~MultiFramedRTPSink() /home/ubuntu/experiments/live/liveMedia/MultiFramedRTPSink.cpp:60:3</div>
<div><br class="ContentPasted1">
</div>
<div class="ContentPasted1">previously allocated by thread T0 here:</div>
<div class="ContentPasted1"> #0 0x4c56fd in operator new[](unsigned long) (/home/ubuntu/experiments/live/testProgs/testOnDemandRTSPServer+0x4c56fd)</div>
<div class="ContentPasted1"> #1 0x4cbc82 in OutPacketBuffer::OutPacketBuffer(unsigned int, unsigned int, unsigned int) /home/ubuntu/experiments/live/liveMedia/MediaSink.cpp:122:10</div>
<div class="ContentPasted1"> #2 0x57d752 in MPEG4GenericRTPSink::createNew(UsageEnvironment&, Groupsock*, unsigned char, unsigned int, char const*, char const*, char const*, unsigned int) /home/ubuntu/experiments/live/liveMedia/MPEG4GenericRTPSink.cpp:88:14</div>
<div><br class="ContentPasted1">
</div>
<div class="ContentPasted1">SUMMARY: AddressSanitizer: heap-use-after-free (/home/ubuntu/experiments/live/testProgs/testOnDemandRTSPServer+0x4957e4) in __asan_memmove</div>
<div class="ContentPasted1">Shadow bytes around the buggy address:</div>
<div class="ContentPasted1"> 0x10007e7252b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa</div>
<div class="ContentPasted1"> 0x10007e7252c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa</div>
<div class="ContentPasted1"> 0x10007e7252d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa</div>
<div class="ContentPasted1"> 0x10007e7252e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa</div>
<div class="ContentPasted1"> 0x10007e7252f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa</div>
<div class="ContentPasted1">=>0x10007e725300: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd</div>
<div class="ContentPasted1"> 0x10007e725310: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd</div>
<div class="ContentPasted1"> 0x10007e725320: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd</div>
<div class="ContentPasted1"> 0x10007e725330: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd</div>
<div class="ContentPasted1"> 0x10007e725340: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd</div>
<div class="ContentPasted1"> 0x10007e725350: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd</div>
<div class="ContentPasted1">Shadow byte legend (one shadow byte represents 8 application bytes):</div>
<div class="ContentPasted1"> Addressable: 00</div>
<div class="ContentPasted1"> Partially addressable: 01 02 03 04 05 06 07 </div>
<div class="ContentPasted1"> Heap left redzone: fa</div>
<div class="ContentPasted1"> Freed heap region: fd</div>
<div class="ContentPasted1"> Stack left redzone: f1</div>
<div class="ContentPasted1"> Stack mid redzone: f2</div>
<div class="ContentPasted1"> Stack right redzone: f3</div>
<div class="ContentPasted1"> Stack after return: f5</div>
<div class="ContentPasted1"> Stack use after scope: f8</div>
<div class="ContentPasted1"> Global redzone: f9</div>
<div class="ContentPasted1"> Global init order: f6</div>
<div class="ContentPasted1"> Poisoned by user: f7</div>
<div class="ContentPasted1"> Container overflow: fc</div>
<div class="ContentPasted1"> Array cookie: ac</div>
<div class="ContentPasted1"> Intra object redzone: bb</div>
<div class="ContentPasted1"> ASan internal: fe</div>
<div class="ContentPasted1"> Left alloca redzone: ca</div>
<div class="ContentPasted1"> Right alloca redzone: cb</div>
<div class="ContentPasted1"> Shadow gap: cc</div>
<div class="ContentPasted1">==98331==ABORTING</div>
Aborted (core dumped)<br>
</div>
<div class="elementToProof">
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
</div>
<div style="font-family: "Times New Roman", Times, serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-size: 11pt; font-family: Verdana, Geneva, sans-serif;">------</span></div>
<div style="font-family: "Times New Roman", Times, serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-size: 11pt; font-family: Verdana, Geneva, sans-serif;">Kind Regards,</span></div>
<div style="font-family: "Times New Roman", Times, serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-size: 11pt; font-family: Verdana, Geneva, sans-serif;">Ruijie</span></div>
</div>
</div>
</div>
</body>
</html>