AddressSanitizer: heap-buffer-overflow at mbitstr_getc in bitstr.c:49

[ambrosecm]

Desctiption

When I used the bitstr_getc function to handle a specific input, AddressSanitizer: heap-buffer-overflow at mbitstr_getc in bitstr.c:49

ffjpeg/src/bitstr.c

Lines 197 to 207 in caade60

	int bitstr_getc(void *stream)
	{
	int type;
	if (!stream) return EOF;
	type = *(int*)stream;
	switch (type) {
	case BITSTR_MEM : return mbitstr_getc(stream);
	case BITSTR_FILE: return fbitstr_getc(stream);
	}
	return EOF;
	}

ffjpeg/src/bitstr.c

Lines 46 to 51 in caade60

	static int mbitstr_getc(void *stream)
	{
	MBITSTR *context = (MBITSTR*)stream;
	if (!context || context->curpos >= context->memlen) return EOF;
	return context->membuf[context->curpos++];
	}

Test Environment

Ubuntu 22.04.1, 64bit
ffjpeg(master caade60)
program source file

How to trigger

Download the poc file , program and run the following cmd:

 $ ./bitstr_getc ./poc1

Detail

ASAN report

(gdb) r
Starting program: /home/ambrose/vsproject/HIMFuzz/harness/output/ffjpeg_deepseek24/crashes/bitstr.c/bitstr_getb/bitstr_getc/bitstr_getc output/default/crashes/id:000000,sig:06,src:000004,time:1067,execs:508,op:havoc,rep:2
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
=================================================================
==1184883==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c1ff6e2002c at pc 0x555555669c3a bp 0x7fffffffd7b0 sp 0x7fffffffd7a8
READ of size 4 at 0x7c1ff6e2002c thread T0
[Detaching after fork from child process 1187296]
    #0 0x555555669c39 in mbitstr_getc /home/ambrose/vsproject/TestLib/ffjpeg/src/bitstr.c:49:30
    #1 0x555555669a2e in bitstr_getc /home/ambrose/vsproject/TestLib/ffjpeg/src/bitstr.c:203:30
    #2 0x55555566fe4c in main /home/ambrose/vsproject/HIMFuzz/harness/output/ffjpeg_deepseek24/harness/code/bitstr.c/bitstr_getb/bitstr_getc.c:38:18
    #3 0x7ffff7c29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #4 0x7ffff7c29e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #5 0x555555582424 in _start (/home/ambrose/vsproject/HIMFuzz/harness/output/ffjpeg_deepseek24/crashes/bitstr.c/bitstr_getb/bitstr_getc/bitstr_getc+0x2e424) (BuildId: de57bcafc186e2bb5ccf4acbbcc82e2d9f1e0193)

0x7c1ff6e2002c is located 24 bytes after 4-byte region [0x7c1ff6e20010,0x7c1ff6e20014)
allocated by thread T0 here:
    #0 0x555555625414 in malloc (/home/ambrose/vsproject/HIMFuzz/harness/output/ffjpeg_deepseek24/crashes/bitstr.c/bitstr_getb/bitstr_getc/bitstr_getc+0xd1414) (BuildId: de57bcafc186e2bb5ccf4acbbcc82e2d9f1e0193)
    #1 0x55555566fccf in main /home/ambrose/vsproject/HIMFuzz/harness/output/ffjpeg_deepseek24/harness/code/bitstr.c/bitstr_getb/bitstr_getc.c:28:20
    #2 0x7ffff7c29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/ambrose/vsproject/TestLib/ffjpeg/src/bitstr.c:49:30 in mbitstr_getc
Shadow bytes around the buggy address:
  0x7c1ff6e1fd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7c1ff6e1fe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7c1ff6e1fe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7c1ff6e1ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7c1ff6e1ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x7c1ff6e20000: fa fa 04 fa fa[fa]fa fa fa fa fa fa fa fa fa fa
  0x7c1ff6e20080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c1ff6e20100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c1ff6e20180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c1ff6e20200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c1ff6e20280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==1184883==ABORTING