Bug#890014: wavpack: null dereference while running wavpack

[Joonun Jang]

Package: wavpack
Version: 5.1.0-2
Severity: important
Tags: security

null dereference running wavpack with "-y poc.wav" option

Running 'wavpack -y poc.wav' with the attached file raises null dereference
which may allow a remote attacker to cause denial-of-service attack
I expected the program to terminate without segfault, but the program crashes as follow

june at june:~/temp/report/wavpack/null$ ASAN_OPTIONS=allocator_may_return_null=1 ../../binary/wavpack-5.1.0/cli/.libs/wavpack -y poc.wav

 WAVPACK  Hybrid Lossless Audio Compressor  Linux Version 5.1.0
 Copyright (c) 1998 - 2017 David Bryant.  All Rights Reserved.

creating poc.wv,==4142==WARNING: AddressSanitizer failed to allocate 0xffffffff82828282 bytes
ASAN:DEADLYSIGNAL
=================================================================
==4142==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7ffff65f3e7f bp 0x000000000014 sp 0x7fffffffb148 T0)
    #0 0x7ffff65f3e7e in memcpy (/lib/x86_64-linux-gnu/libc.so.6+0x83e7e)
    #1 0x7ffff65e2b0d  (/lib/x86_64-linux-gnu/libc.so.6+0x72b0d)
    #2 0x7ffff65d7aa8 in fread (/lib/x86_64-linux-gnu/libc.so.6+0x67aa8)
    #3 0x55555557ec68 in DoReadFile /home/june/temp/report/binary/wavpack-5.1.0/cli/utils.c:618
    #4 0x5555555793ef in ParseCaffHeaderConfig /home/june/temp/report/binary/wavpack-5.1.0/cli/caff.c:506
    #5 0x555555567c3a in pack_file /home/june/temp/report/binary/wavpack-5.1.0/cli/wavpack.c:1774
    #6 0x555555565e5e in main /home/june/temp/report/binary/wavpack-5.1.0/cli/wavpack.c:1270
    #7 0x7ffff65902b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
    #8 0x5555555609a9 in _start (/home/june/temp/report/binary/wavpack-5.1.0/cli/.libs/wavpack+0xc9a9)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0x83e7e) in memcpy
==4142==ABORTING

This bug was found with a fuzzer developed by 'SoftSec' group at KAIST

-- System Information:
Debian Release: 9.3
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'unstable'), (500, 'testing'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.9.0-3-amd64 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages wavpack depends on:
ii  libc6        2.24-11+deb9u1
ii  libwavpack1  5.1.0-2

wavpack recommends no packages.

wavpack suggests no packages.

-- no debconf information
-------------- next part --------------
A non-text attachment was scrubbed...
Name: poc.wav
Type: application/octet-stream
Size: 40 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-multimedia-maintainers/attachments/20180210/ded0cf64/attachment.obj>