<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof">
Hi,</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0">
We found one heap-use-after-free in live.2023.05.10 running in Ubuntu 20.04. It happens while handling the PLAY client request by calling the function `MultiFramedRTPSink::continuePlaying`.</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0">
<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0">
We attached the relevant files to reproduce this bug and hope it could help you fix it. You can reproduce it as follows/README:</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0">
<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0 ContentPasted1">
1. build the docker image:
<div class="ContentPasted1"> docker build . -t uaf3</div>
<div class="ContentPasted1">2. create the docker container:</div>
<div class="ContentPasted1"> docker run -it -u root --privileged --name reproduce-uaf3 uaf3 bash</div>
<div class="ContentPasted1">3. open two terminals:</div>
<div class="ContentPasted1"> 3.1 one run live555:</div>
<div class="ContentPasted1"> cd /home/ubuntu/experiments/live/testProgs && ./testOnDemandRTSPServer</div>
<div class="ContentPasted1"> 3.2 another one run client to send requests:</div>
<div class="ContentPasted1"> cd /home/ubuntu/experiments && aflnet-replay uaf3-client-request1 RTSP 8554 30</div>
<div class="ContentPasted1"> You can also try other client requests:</div>
cd /home/ubuntu/experiments && aflnet-replay uaf3-client-request2 RTSP 8554 30<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0 ContentPasted1">
<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0 ContentPasted1 ContentPasted2">
The following is the ASAN bug report:<br>
<br>
=================================================================
<div class="ContentPasted2">==98372==ERROR: AddressSanitizer: heap-use-after-free on address 0x7ffff37b5810 at pc 0x0000004957e5 bp 0x7fffffffdaf0 sp 0x7fffffffd2b8</div>
<div class="ContentPasted2">WRITE of size 270 at 0x7ffff37b5810 thread T0</div>
<div class="ContentPasted2"> #0 0x4957e4 in __asan_memmove (/home/ubuntu/experiments/live/testProgs/testOnDemandRTSPServer+0x4957e4)</div>
<div class="ContentPasted2"> #1 0x5d06f0 in StreamParser::testBytes(unsigned char*, unsigned int) /home/ubuntu/experiments/live/liveMedia/./StreamParser.hh:96:5</div>
<div class="ContentPasted2"> #2 0x5d06f0 in StreamParser::getBytes(unsigned char*, unsigned int) /home/ubuntu/experiments/live/liveMedia/./StreamParser.hh:90:5</div>
<div class="ContentPasted2"> #3 0x5d06f0 in MatroskaFileParser::deliverFrameBytes() /home/ubuntu/experiments/live/liveMedia/MatroskaFileParser.cpp:1240:7</div>
<div class="ContentPasted2"> #4 0x5c761c in MatroskaFileParser::parse() /home/ubuntu/experiments/live/liveMedia/MatroskaFileParser.cpp:173:4</div>
<div class="ContentPasted2"> #5 0x5c6348 in MatroskaFileParser::continueParsing() /home/ubuntu/experiments/live/liveMedia/MatroskaFileParser.cpp:100:10</div>
<div class="ContentPasted2"> #6 0x5a4844 in MultiFramedRTPSink::packFrame() /home/ubuntu/experiments/live/liveMedia/MultiFramedRTPSink.cpp:223:14</div>
<div class="ContentPasted2"> #7 0x5a3fdf in MultiFramedRTPSink::buildAndSendPacket(unsigned char) /home/ubuntu/experiments/live/liveMedia/MultiFramedRTPSink.cpp:199:3</div>
<div class="ContentPasted2"> #8 0x5a3fdf in MultiFramedRTPSink::continuePlaying() /home/ubuntu/experiments/live/liveMedia/MultiFramedRTPSink.cpp:159:3</div>
<div class="ContentPasted2"> #9 0x5bbe7e in StreamState::startPlaying(Destinations*, unsigned int, void (*)(void*), void*, void (*)(void*, unsigned char), void*) /home/ubuntu/experiments/live/liveMedia/OnDemandServerMediaSubsession.cpp:575:17</div>
<div class="ContentPasted2"> #10 0x5bb691 in OnDemandServerMediaSubsession::startStream(unsigned int, void*, void (*)(void*), void*, unsigned short&, unsigned int&, void (*)(void*, unsigned char), void*) /home/ubuntu/experiments/live/liveMedia/OnDemandServerMediaSubsession.cpp:229:18</div>
<div class="ContentPasted2"> #11 0x4dd3d3 in RTSPServer::RTSPClientSession::handleCmd_PLAY(RTSPServer::RTSPClientConnection*, ServerMediaSubsession*, char const*) /home/ubuntu/experiments/live/liveMedia/RTSPServer.cpp:1943:36</div>
<div class="ContentPasted2"> #12 0x4dba3e in RTSPServer::RTSPClientSession::handleCmd_withinSession(RTSPServer::RTSPClientConnection*, char const*, char const*, char const*, char const*) /home/ubuntu/experiments/live/liveMedia/RTSPServer.cpp</div>
<div class="ContentPasted2"> #13 0x4d6ba9 in RTSPServer::RTSPClientConnection::handleRequestBytes(int) /home/ubuntu/experiments/live/liveMedia/RTSPServer.cpp:996:22</div>
<div class="ContentPasted2"> #14 0x5b7a66 in GenericMediaServer::ClientConnection::incomingRequestHandler() /home/ubuntu/experiments/live/liveMedia/GenericMediaServer.cpp:324:3</div>
<div class="ContentPasted2"> #15 0x605e35 in BasicTaskScheduler::SingleStep(unsigned int) /home/ubuntu/experiments/live/BasicUsageEnvironment/BasicTaskScheduler.cpp:153:7</div>
<div class="ContentPasted2"> #16 0x60c409 in BasicTaskScheduler0::doEventLoop(char volatile*) /home/ubuntu/experiments/live/BasicUsageEnvironment/BasicTaskScheduler0.cpp:82:5</div>
<div class="ContentPasted2"> #17 0x4ca479 in main /home/ubuntu/experiments/live/testProgs/testOnDemandRTSPServer.cpp:462:24</div>
<div class="ContentPasted2"> #18 0x7ffff770a082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16</div>
<div class="ContentPasted2"> #19 0x41d73d in _start (/home/ubuntu/experiments/live/testProgs/testOnDemandRTSPServer+0x41d73d)</div>
<div><br class="ContentPasted2">
</div>
<div class="ContentPasted2">0x7ffff37b5810 is located 16 bytes inside of 300564-byte region [0x7ffff37b5800,0x7ffff37fee14)</div>
<div class="ContentPasted2">freed by thread T0 here:</div>
<div class="ContentPasted2"> #0 0x4c5f4d in operator delete[](void*) (/home/ubuntu/experiments/live/testProgs/testOnDemandRTSPServer+0x4c5f4d)</div>
<div class="ContentPasted2"> #1 0x5a3674 in MultiFramedRTPSink::~MultiFramedRTPSink() /home/ubuntu/experiments/live/liveMedia/MultiFramedRTPSink.cpp:60:3</div>
<div><br class="ContentPasted2">
</div>
<div class="ContentPasted2">previously allocated by thread T0 here:</div>
<div class="ContentPasted2"> #0 0x4c56fd in operator new[](unsigned long) (/home/ubuntu/experiments/live/testProgs/testOnDemandRTSPServer+0x4c56fd)</div>
<div class="ContentPasted2"> #1 0x4cbc82 in OutPacketBuffer::OutPacketBuffer(unsigned int, unsigned int, unsigned int) /home/ubuntu/experiments/live/liveMedia/MediaSink.cpp:122:10</div>
<div class="ContentPasted2"> #2 0x57d752 in MPEG4GenericRTPSink::createNew(UsageEnvironment&, Groupsock*, unsigned char, unsigned int, char const*, char const*, char const*, unsigned int) /home/ubuntu/experiments/live/liveMedia/MPEG4GenericRTPSink.cpp:88:14</div>
<div><br class="ContentPasted2">
</div>
<div class="ContentPasted2">SUMMARY: AddressSanitizer: heap-use-after-free (/home/ubuntu/experiments/live/testProgs/testOnDemandRTSPServer+0x4957e4) in __asan_memmove</div>
<div class="ContentPasted2">Shadow bytes around the buggy address:</div>
<div class="ContentPasted2"> 0x10007e6eeab0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa</div>
<div class="ContentPasted2"> 0x10007e6eeac0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa</div>
<div class="ContentPasted2"> 0x10007e6eead0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa</div>
<div class="ContentPasted2"> 0x10007e6eeae0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa</div>
<div class="ContentPasted2"> 0x10007e6eeaf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa</div>
<div class="ContentPasted2">=>0x10007e6eeb00: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd</div>
<div class="ContentPasted2"> 0x10007e6eeb10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd</div>
<div class="ContentPasted2"> 0x10007e6eeb20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd</div>
<div class="ContentPasted2"> 0x10007e6eeb30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd</div>
<div class="ContentPasted2"> 0x10007e6eeb40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd</div>
<div class="ContentPasted2"> 0x10007e6eeb50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd</div>
<div class="ContentPasted2">Shadow byte legend (one shadow byte represents 8 application bytes):</div>
<div class="ContentPasted2"> Addressable: 00</div>
<div class="ContentPasted2"> Partially addressable: 01 02 03 04 05 06 07 </div>
<div class="ContentPasted2"> Heap left redzone: fa</div>
<div class="ContentPasted2"> Freed heap region: fd</div>
<div class="ContentPasted2"> Stack left redzone: f1</div>
<div class="ContentPasted2"> Stack mid redzone: f2</div>
<div class="ContentPasted2"> Stack right redzone: f3</div>
<div class="ContentPasted2"> Stack after return: f5</div>
<div class="ContentPasted2"> Stack use after scope: f8</div>
<div class="ContentPasted2"> Global redzone: f9</div>
<div class="ContentPasted2"> Global init order: f6</div>
<div class="ContentPasted2"> Poisoned by user: f7</div>
<div class="ContentPasted2"> Container overflow: fc</div>
<div class="ContentPasted2"> Array cookie: ac</div>
<div class="ContentPasted2"> Intra object redzone: bb</div>
<div class="ContentPasted2"> ASan internal: fe</div>
<div class="ContentPasted2"> Left alloca redzone: ca</div>
<div class="ContentPasted2"> Right alloca redzone: cb</div>
<div class="ContentPasted2"> Shadow gap: cc</div>
<div class="ContentPasted2">==98372==ABORTING</div>
<div class="ContentPasted2">Aborted (core dumped)</div>
<br>
</div>
<div class="elementToProof">
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
</div>
<div style="font-family: "Times New Roman", Times, serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-size: 11pt; font-family: Verdana, Geneva, sans-serif;">------</span></div>
<div style="font-family: "Times New Roman", Times, serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-size: 11pt; font-family: Verdana, Geneva, sans-serif;">Kind Regards,</span></div>
<div style="font-family: "Times New Roman", Times, serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-size: 11pt; font-family: Verdana, Geneva, sans-serif;">Ruijie</span></div>
</div>
</div>
</div>
</body>
</html>