Bug#881123: ffmpeg2theora: null pointer dereference while running ffmpeg2theora

[Joonun Jang]

Package: ffmpeg2theora
Version: 0.30-1+b2
Severity: normal
Tags: security

null pointer dereference while running ffmpeg2theora with "poc" option

Running 'ffmpeg2theora poc' with the attached file raises null pointer dereference
which may allow a remote attack to cause a denial-of-service attack
I expected the program to terminate without segfault, but the program crashes as follow

-------------------------------------------

june at yuweol:~/poc/ffmpeg2theora/crash4$ ffmpeg2theora poc
[aac @ 0x55a00e699840] Format aac detected only with low score of 1, misdetection possible!
[aac @ 0x55a00e69abc0] More than one AAC RDB per ADTS frame is not implemented. Update your FFmpeg version to the newest one from Git. If the problem still occurs, it means that your file has a feature which has not been implemented.
[aac @ 0x55a00e69abc0] Assuming an incorrectly encoded 7.1 channel layout instead of a spec-compliant 7.1(wide) layout, use -strict 1 to decode according to the specification instead.
[aac @ 0x55a00e69abc0] Multiple frames in a packet.
Input #0, aac, from 'poc':
  Duration: N/A, bitrate: N/A
    Stream #0:0: Audio: aac (LC), 16000 Hz, 7.1, fltp
[aac @ 0x55a00e69a5e0] Assuming an incorrectly encoded 7.1 channel layout instead of a spec-compliant 7.1(wide) layout, use -strict 1 to decode according to the specification instead.
WARNING: Can't get duration of media, not indexing, writing Skeleton 3 track.
[aac @ 0x55a00e69a5e0] More than one AAC RDB per ADTS frame is not implemented. Update your FFmpeg version to the newest one from Git. If the problem still occurs, it means that your file has a feature which has not been implemented.
[aac @ 0x55a00e69a5e0] Assuming an incorrectly encoded 7.1 channel layout instead of a spec-compliant 7.1(wide) layout, use -strict 1 to decode according to the specification instead.
[aac @ 0x55a00e69a5e0] Multiple frames in a packet.
[aac @ 0x55a00e69a5e0] Reserved bit set.
[aac @ 0x55a00e69a5e0] Prediction is not allowed in AAC-LC.
Segmentation fault

-------------------------------------------

Program received signal SIGSEGV, Segmentation fault.
0x0000555555560ab1 in ?? ()
(gdb) bt
#0  0x0000555555560ab1 in ?? ()
#1  0x0000555555564ab4 in ?? ()
#2  0x000055555555c8da in main ()
(gdb) x/i $rip
=> 0x555555560ab1:  movss  (%r10,%r8,1),%xmm0
(gdb) i r r10 r8
r10            0x0  0
r8             0x0  0

-------------------------------------------

This bug was found with a fuzzer developed by 'SoftSec' group at KAIST.

-- System Information:
Debian Release: buster/sid
  APT prefers unstable-debug
  APT policy: (500, 'unstable-debug'), (500, 'testing-debug'), (500, 'stable-updates'), (500, 'testing'), (500, 'stable'), (1, 'experimental-debug')
Architecture: amd64 (x86_64)

Kernel: Linux 4.9.0-3-amd64 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages ffmpeg2theora depends on:
ii  libavcodec57    7:3.3.4-2+b2
ii  libavdevice57   7:3.3.4-2+b2
ii  libavfilter6    7:3.3.4-2+b2
ii  libavformat57   7:3.3.4-2+b2
ii  libavutil55     7:3.3.4-2+b2
ii  libc6           2.24-17
ii  libkate1        0.4.1-7+b1
ii  libogg0         1.3.2-1+b1
ii  liboggkate1     0.4.1-7+b1
ii  libpostproc54   7:3.3.4-2+b2
ii  libswresample2  7:3.3.4-2+b2
ii  libswscale4     7:3.3.4-2+b2
ii  libtheora0      1.1.1+dfsg.1-14+b1
ii  libvorbis0a     1.3.5-4
ii  libvorbisenc2   1.3.5-4

ffmpeg2theora recommends no packages.

ffmpeg2theora suggests no packages.

-- no debconf information
-------------- next part --------------
A non-text attachment was scrubbed...
Name: poc
Type: audio/x-hx-aac-adts
Size: 61 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-multimedia-maintainers/attachments/20171108/4efd1ef2/attachment-0001.bin>