| Titel | MP3Gain mp3gain 1.6.2 stack-buffer-overflow |
|---|
| Beschreibung | Bug file: Please refer to the given link for the bug file.
CMD:
```
./mp3gain Bug1
```
OUTPUT:
```
==11200==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff1aaaacc4 at pc 0x7fa36f94104f bp 0x7fff1aaaaa00 sp 0x7fff1aaaa190
WRITE of size 148 at 0x7fff1aaaacc4 thread T0
#0 0x7fa36f94104e in __interceptor_vsprintf ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:1687
#1 0x7fa36f94127e in __interceptor_sprintf ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:1730
#2 0x559b8033db84 in WriteMP3GainAPETag /experiments/programs_AFLplusplus/unibench/mp3gain-newest/apetag.c:592
#3 0x559b8033078d in main_impl /experiments/programs_AFLplusplus/unibench/mp3gain-newest/mp3gain.c:2722
#4 0x7fa36f59fd8f (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)
#5 0x7fa36f59fe3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f)
#6 0x559b80318d44 in _start (/experiments/programs_AFLplusplus/aflasan/mp3gain+0x9d44)
Address 0x7fff1aaaacc4 is located in stack of thread T0 at offset 276 in frame
#0 0x559b8033abdf in WriteMP3GainAPETag /experiments/programs_AFLplusplus/unibench/mp3gain-newest/apetag.c:404
This frame has 3 object(s):
[48, 80) 'newFooter' (line 413)
[112, 144) 'newHeader' (line 414)
[176, 276) 'valueString' (line 411) <== Memory access at offset 276 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:1687 in __interceptor_vsprintf
Shadow bytes around the buggy address:
0x10006354d540: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10006354d550: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10006354d560: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10006354d570: 00 00 00 00 00 00 f1 f1 f1 f1 f1 f1 00 00 00 00
0x10006354d580: f2 f2 f2 f2 00 00 00 00 f2 f2 f2 f2 00 00 00 00
=>0x10006354d590: 00 00 00 00 00 00 00 00[04]f3 f3 f3 f3 f3 00 00
0x10006354d5a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10006354d5b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10006354d5c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10006354d5d0: 00 00 00 00 f1 f1 f1 f1 f1 f1 01 f2 01 f2 04 f2
0x10006354d5e0: 04 f2 04 f2 00 f2 f2 f2 00 f2 f2 f2 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==11200==ABORTING
``` |
|---|
| Quelle | ⚠️ https://sourceforge.net/p/mp3gain/bugs/55/ |
|---|
| Benutzer | SecRookie (UID 80567) |
|---|
| Einreichung | 22.01.2025 04:25 (vor 2 Jahren) |
|---|
| Moderieren | 30.01.2025 09:48 (8 days later) |
|---|
| Status | Duplikat |
|---|
| VulDB Eintrag | 248852 [MP3Gain 1.6.2 apetag.c WriteMP3GainAPETag Pufferüberlauf] |
|---|
| Punkte | 0 |
|---|