AddressSanitizer: heap-buffer-overflow at fbitstr_getc in bitstr.c:129

[ambrosecm]

Desctiption

When I used the bitstr_getc function to handle a specific input, AddressSanitizer: heap-buffer-overflow at fbitstr_getc in bitstr.c:129

ffjpeg/src/bitstr.c

Lines 126 to 131 in caade60

	static int fbitstr_getc(void *stream)
	{
	FBITSTR *context = (FBITSTR*)stream;
	if (!context || !context->fp) return EOF;
	return fgetc(context->fp);
	}

ffjpeg/src/bitstr.c

Lines 46 to 51 in caade60

	static int mbitstr_getc(void *stream)
	{
	MBITSTR *context = (MBITSTR*)stream;
	if (!context || context->curpos >= context->memlen) return EOF;
	return context->membuf[context->curpos++];
	}

Test Environment

Ubuntu 22.04.1, 64bit
ffjpeg(master caade60)
program source file

How to trigger

Download the poc file , program and run the following cmd:

 $ ./bitstr_getc ./poc2

Detail

ASAN report

(gdb) r
Starting program: /home/ambrose/vsproject/HIMFuzz/harness/output/ffjpeg_deepseek24/crashes/bitstr.c/bitstr_getb/bitstr_getc/bitstr_getc output/default/crashes/id:000001,sig:06,src:000004,time:2562,execs:1197,op:havoc,rep:3
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
=================================================================
==3330442==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c1ff6e20020 at pc 0x55555566a270 bp 0x7fffffffd820 sp 0x7fffffffd818
READ of size 8 at 0x7c1ff6e20020 thread T0
[Detaching after fork from child process 3332926]
    #0 0x55555566a26f in fbitstr_getc /home/ambrose/vsproject/TestLib/ffjpeg/src/bitstr.c:129:31
    #1 0x555555669a76 in bitstr_getc /home/ambrose/vsproject/TestLib/ffjpeg/src/bitstr.c:204:30
    #2 0x55555566fe4c in main /home/ambrose/vsproject/HIMFuzz/harness/output/ffjpeg_deepseek24/harness/code/bitstr.c/bitstr_getb/bitstr_getc.c:38:18
    #3 0x7ffff7c29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #4 0x7ffff7c29e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #5 0x555555582424 in _start (/home/ambrose/vsproject/HIMFuzz/harness/output/ffjpeg_deepseek24/crashes/bitstr.c/bitstr_getb/bitstr_getc/bitstr_getc+0x2e424) (BuildId: de57bcafc186e2bb5ccf4acbbcc82e2d9f1e0193)

0x7c1ff6e20020 is located 12 bytes after 4-byte region [0x7c1ff6e20010,0x7c1ff6e20014)
allocated by thread T0 here:
    #0 0x555555625414 in malloc (/home/ambrose/vsproject/HIMFuzz/harness/output/ffjpeg_deepseek24/crashes/bitstr.c/bitstr_getb/bitstr_getc/bitstr_getc+0xd1414) (BuildId: de57bcafc186e2bb5ccf4acbbcc82e2d9f1e0193)
    #1 0x55555566fccf in main /home/ambrose/vsproject/HIMFuzz/harness/output/ffjpeg_deepseek24/harness/code/bitstr.c/bitstr_getb/bitstr_getc.c:28:20
    #2 0x7ffff7c29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/ambrose/vsproject/TestLib/ffjpeg/src/bitstr.c:129:31 in fbitstr_getc
Shadow bytes around the buggy address:
  0x7c1ff6e1fd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7c1ff6e1fe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7c1ff6e1fe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7c1ff6e1ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7c1ff6e1ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x7c1ff6e20000: fa fa 04 fa[fa]fa fa fa fa fa fa fa fa fa fa fa
  0x7c1ff6e20080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c1ff6e20100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c1ff6e20180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c1ff6e20200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7c1ff6e20280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==3330442==ABORTING