================
Author : qflb.wu
===============
Introduction:
=============
https://www.linuxsampler.org/libgig/
libgig is a C++ library for loading, modifying existing and creating new Gigasampler (.gig) files and DLS (Downloadable Sounds) Level 1/2 files, KORG sample based instruments (.KSF and .KMP files), SoundFont v2 (.sf2) files and AKAI sampler data.
Affected version:
=====
4.0.0
Vulnerability Description:
==========================
1.
the gig::Region::Region function in gig.cpp in libgig 4.0.0 can cause a denial of service(Null pointer dereference and application crash) via a crafted gig file.
./gigdump libgig_4.0.0_null_pointer_dereference_1.gig
----debug info:----
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7bc07df in gig::Region::Region (this=0x614ce0,
pInstrument=<optimized out>, rgnList=0x610230) at gig.cpp:2970
2970 if (file->pWavePoolTable) pDimensionRegions[i]->pSample = GetSampleFromWavePool(wavepoolindex);
(gdb) bt
#0 0x00007ffff7bc07df in gig::Region::Region (this=0x614ce0,
pInstrument=<optimized out>, rgnList=0x610230) at gig.cpp:2970
#1 0x00007ffff7bc0b36 in gig::Instrument::Instrument (this=0x60ef80,
pFile=<optimized out>, insList=0x60eea0, pProgress=0x7fffffffdda0)
at gig.cpp:4404
#2 0x00007ffff7bc103e in gig::File::LoadInstruments (this=0x609160,
pProgress=0x0) at gig.cpp:5576
#3 0x00007ffff7bbade6 in gig::File::GetFirstInstrument (
this=this@entry=0x609160) at gig.cpp:5378
#4 0x000000000040533b in PrintInstruments (gig=gig@entry=0x609160)
at gigdump.cpp:205
#5 0x0000000000401f34 in main (argc=<optimized out>, argv=<optimized out>)
at gigdump.cpp:79
(gdb) disassemble 0x00007ffff7bc07ca,0x00007ffff7bc07f0
Dump of assembler code from 0x7ffff7bc07ca to 0x7ffff7bc07f0:
0x00007ffff7bc07ca <gig::Region::Region(gig::Instrument*, RIFF::List*)+666>:je 0x7ffff7bc07e3 <gig::Region::Region(gig::Instrument*, RIFF::List*)+691>
0x00007ffff7bc07cc <gig::Region::Region(gig::Instrument*, RIFF::List*)+668>:xor %edx,%edx
0x00007ffff7bc07ce <gig::Region::Region(gig::Instrument*, RIFF::List*)+670>:mov %eax,%esi
0x00007ffff7bc07d0 <gig::Region::Region(gig::Instrument*, RIFF::List*)+672>:mov %rbx,%rdi
0x00007ffff7bc07d3 <gig::Region::Region(gig::Instrument*, RIFF::List*)+675>:mov 0x138(%r13),%r14
0x00007ffff7bc07da <gig::Region::Region(gig::Instrument*, RIFF::List*)+682>:callq 0x7ffff7b9ede0 <_ZN3gig6Region21GetSampleFromWavePoolEjPN4RIFF10progress_tE@plt>
=> 0x00007ffff7bc07df <gig::Region::Region(gig::Instrument*, RIFF::List*)+687>:mov %rax,0x38(%r14)
0x00007ffff7bc07e3 <gig::Region::Region(gig::Instrument*, RIFF::List*)+691>:add $0x1,%ebp
0x00007ffff7bc07e6 <gig::Region::Region(gig::Instrument*, RIFF::List*)+694>:add $0x8,%r13
0x00007ffff7bc07ea <gig::Region::Region(gig::Instrument*, RIFF::List*)+698>:cmp %ebp,0x130(%rbx)
End of assembler dump.
(gdb) i r
rax 0x60ca906343312
rbx 0x614ce06376672
rcx 0x33
rdx 0x60a3006333184
rsi 0x00
rdi 0x6091606328672
rbp 0x00x0
rsp 0x7fffffffdcc00x7fffffffdcc0
r8 0x00
r9 0x22
r10 0x00
r11 0x246582
r12 0x6159506379856
r13 0x614ce06376672
r14 0x00
r15 0x00
rip 0x7ffff7bc07df0x7ffff7bc07df <gig::Region::Region(gig::Instrument*, RIFF::List*)+687>
eflags 0x10246[ PF ZF IF RF ]
cs 0x3351
ss 0x2b43
ds 0x00
es 0x00
---Type <return> to continue, or q <return> to quit---
fs 0x00
gs 0x00
(gdb)
ASAN:SIGSEGV
=================================================================
==40516== ERROR: AddressSanitizer: SEGV on unknown address 0x000000000038 (pc 0x7f4f87126260 sp 0x7ffd0b22ec80 bp 0x600e0000c3b0 T0)
AddressSanitizer can not provide additional info.
#0 0x7f4f8712625f in gig::Region::Region(gig::Instrument*, RIFF::List*) /home/a/Documents/libgig-4.0.0/src/gig.cpp:2970
#1 0x7f4f87127f4a in gig::Instrument::Instrument(gig::File*, RIFF::List*, RIFF::progress_t*) /home/a/Documents/libgig-4.0.0/src/gig.cpp:4404
#2 0x7f4f87129fdc in gig::File::LoadInstruments(RIFF::progress_t*) /home/a/Documents/libgig-4.0.0/src/gig.cpp:5576
#3 0x7f4f870fb6a0 in gig::File::GetFirstInstrument() /home/a/Documents/libgig-4.0.0/src/gig.cpp:5378
#4 0x40fca6 in PrintInstruments(gig::File*) /home/a/Documents/libgig-4.0.0/src/tools/gigdump.cpp:205
#5 0x4027aa in main /home/a/Documents/libgig-4.0.0/src/tools/gigdump.cpp:79
#6 0x7f4f86749ec4 (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)
#7 0x402e5c in _start (/home/a/Documents/libgig-4.0.0/src/tools/.libs/gigdump+0x402e5c)
SUMMARY: AddressSanitizer: SEGV /home/a/Documents/libgig-4.0.0/src/gig.cpp:2970 gig::Region::Region(gig::Instrument*, RIFF::List*)
==40516== ABORTING
POC:
libgig_4.0.0_null_pointer_dereference_1.gig
CVE:
CVE-2017-12950
2.
the gig::DimensionRegion::CreateVelocityTable function in gig.cpp in libgig 4.0.0 can cause a denial of service(stack buffer overflow and application crash) via a crafted gig file.
./gigdump libgig_4.0.0_stack_buffer_overflow.gig
----debug info:----
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7bb8b44 in gig::DimensionRegion::CreateVelocityTable (
this=<optimized out>, curveType=<optimized out>, depth=<optimized out>,
scaling=<optimized out>) at gig.cpp:2884
2884 table[0] = 0;
(gdb) bt
#0 0x00007ffff7bb8b44 in gig::DimensionRegion::CreateVelocityTable (
this=<optimized out>, curveType=<optimized out>, depth=<optimized out>,
scaling=<optimized out>) at gig.cpp:2884
#1 0x00007ffff7bbf535 in gig::DimensionRegion::GetVelocityTable (
this=<optimized out>, curveType=<optimized out>, depth=<optimized out>,
scaling=<optimized out>) at gig.cpp:2054
#2 0x00007ffff7bbf6f3 in gig::DimensionRegion::GetCutoffVelocityTable (
this=this@entry=0x60d3f0, vcfVelocityCurve=<optimized out>,
vcfVelocityDynamicRange=<optimized out>, vcfVelocityScale=<optimized out>,
vcfCutoffController=<optimized out>) at gig.cpp:2042
#3 0x00007ffff7bbffa4 in gig::DimensionRegion::DimensionRegion (
this=0x60d3f0, pParent=<optimized out>, _3ewl=<optimized out>)
at gig.cpp:1617
#4 0x00007ffff7bc0464 in gig::Region::LoadDimensionRegions (
this=this@entry=0x60c3a0, rgn=rgn@entry=0x60b330) at gig.cpp:3075
#5 0x00007ffff7bc05fc in gig::Region::Region (this=0x60c3a0,
pInstrument=<optimized out>, rgnList=0x60b330) at gig.cpp:2923
#6 0x00007ffff7bc0b36 in gig::Instrument::Instrument (this=0x60a280,
pFile=<optimized out>, insList=0x60a1a0, pProgress=0x7fffffffdd90)
at gig.cpp:4404
#7 0x00007ffff7bc103e in gig::File::LoadInstruments (this=0x609160,
pProgress=0x0) at gig.cpp:5576
#8 0x00007ffff7bbade6 in gig::File::GetFirstInstrument (
---Type <return> to continue, or q <return> to quit---
this=this@entry=0x609160) at gig.cpp:5378
#9 0x000000000040533b in PrintInstruments (gig=gig@entry=0x609160)
at gigdump.cpp:205
#10 0x0000000000401f34 in main (argc=<optimized out>, argv=<optimized out>)
at gigdump.cpp:79
(gdb) disassemble
Dump of assembler code for function gig::DimensionRegion::CreateVelocityTable(gig::curve_type_t, unsigned char, unsigned char):
...
0x00007ffff7bb8b27 <+2119>:mov 0x2e0(%rsp,%rdx,8),%rsi
0x00007ffff7bb8b2f <+2127>:je 0x7ffff7bb8c5c <gig::DimensionRegion::CreateVelocityTable(gig::curve_type_t, unsigned char, unsigned char)+2428>
0x00007ffff7bb8b35 <+2133>:movzbl %bpl,%ebx
0x00007ffff7bb8b39 <+2137>:cvtsi2sd %ebx,%xmm6
0x00007ffff7bb8b3d <+2141>:movq $0x0,(%rax)
=> 0x00007ffff7bb8b44 <+2148>:mov 0x8(%rsi),%edi
0x00007ffff7bb8b47 <+2151>:lea 0x8(%rax),%rcx
---Type <return> to continue, or q <return> to quit---
0x00007ffff7bb8b4b <+2155>:mov 0xc(%rsi),%r10d
0x00007ffff7bb8b4f <+2159>:mov $0x1,%edx
...
(gdb) i r
rax 0x60e0506348880
rbx 0x1420
rcx 0x7ffff7669760140737344083808
rdx 0xfe254
rsi 0x2f736c6f6f742f633419195767971393379
rdi 0x22
rbp 0x00x0
rsp 0x7fffffffd8600x7fffffffd860
r8 0x60dbc06347712
r9 0x4064
r10 0x7fffffffd9f0140737488345584
r11 0x7ffff7bbf601140737349678593
r12 0x44
r13 0x60d7706346608
r14 0x60c3a06341536
r15 0x60c3a06341536
rip 0x7ffff7bb8b440x7ffff7bb8b44 <gig::DimensionRegion::CreateVelocityTable(gig::curve_type_t, unsigned char, unsigned char)+2148>
eflags 0x10246[ PF ZF IF RF ]
cs 0x3351
ss 0x2b43
ds 0x00
es 0x00
---Type <return> to continue, or q <return> to quit---
fs 0x00
gs 0x00
(gdb) x/20x $rsi+0x8
0x2f736c6f6f742f6b:Cannot access memory at address 0x2f736c6f6f742f6b
(gdb)
0x2f736c6f6f742f6f:Cannot access memory at address 0x2f736c6f6f742f6f
(gdb)
==40504== ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffc9ca05fa0 at pc 0x7fbea070c58b bp 0x7ffc9ca051c0 sp 0x7ffc9ca051b8
READ of size 8 at 0x7ffc9ca05fa0 thread T0
#0 0x7fbea070c58a in gig::DimensionRegion::CreateVelocityTable(gig::curve_type_t, unsigned char, unsigned char) /home/a/Documents/libgig-4.0.0/src/gig.cpp:2881
#1 0x7fbea0743964 in gig::DimensionRegion::GetVelocityTable(gig::curve_type_t, unsigned char, unsigned char) /home/a/Documents/libgig-4.0.0/src/gig.cpp:2054
#2 0x7fbea0747739 in gig::DimensionRegion::DimensionRegion(gig::Region*, RIFF::List*) /home/a/Documents/libgig-4.0.0/src/gig.cpp:1617
#3 0x7fbea074bfda in gig::Region::LoadDimensionRegions(RIFF::List*) /home/a/Documents/libgig-4.0.0/src/gig.cpp:3075
#4 0x7fbea074c7d7 in gig::Region::Region(gig::Instrument*, RIFF::List*) /home/a/Documents/libgig-4.0.0/src/gig.cpp:2923
#5 0x7fbea074ef4a in gig::Instrument::Instrument(gig::File*, RIFF::List*, RIFF::progress_t*) /home/a/Documents/libgig-4.0.0/src/gig.cpp:4404
#6 0x7fbea0750fdc in gig::File::LoadInstruments(RIFF::progress_t*) /home/a/Documents/libgig-4.0.0/src/gig.cpp:5576
#7 0x7fbea07226a0 in gig::File::GetFirstInstrument() /home/a/Documents/libgig-4.0.0/src/gig.cpp:5378
#8 0x40fca6 in PrintInstruments(gig::File*) /home/a/Documents/libgig-4.0.0/src/tools/gigdump.cpp:205
#9 0x4027aa in main /home/a/Documents/libgig-4.0.0/src/tools/gigdump.cpp:79
#10 0x7fbe9fd70ec4 (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)
#11 0x402e5c in _start (/home/a/Documents/libgig-4.0.0/src/tools/.libs/gigdump+0x402e5c)
Address 0x7ffc9ca05fa0 is located at offset 144 in frame <PrintInstruments> of T0's stack:
This frame has 2 object(s):
[32, 40) 'name'
[96, 104) 'name'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /home/a/Documents/libgig-4.0.0/src/gig.cpp:2877 gig::DimensionRegion::CreateVelocityTable(gig::curve_type_t, unsigned char, unsigned char)
Shadow bytes around the buggy address:
0x100013938ba0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100013938bb0: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00
0x100013938bc0: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
0x100013938bd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100013938be0: 00 00 f1 f1 f1 f1 00 f4 f4 f4 f2 f2 f2 f2 00 f4
=>0x100013938bf0: f4 f4 f3 f3[f3]f3 00 00 00 00 00 00 00 00 00 00
0x100013938c00: 00 00 f1 f1 f1 f1 00 00 f4 f4 f3 f3 f3 f3 00 00
0x100013938c10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100013938c20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100013938c30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100013938c40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap righ redzone: fb
Freed Heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
ASan internal: fe
==40504== ABORTING
POC:
libgig_4.0.0_stack_buffer_overflow.gig
CVE:
CVE-2017-12951
3.
the LoadString function in helper.h in libgig 4.0.0 can cause a denial of service(Null pointer dereference and application crash) via a crafted gig file.
./gigdump libgig_4.0.0_null_pointer_dereference_2.gig
----debug info:----
Program received signal SIGSEGV, Segmentation fault.
LoadString (s="", ck=0x6095d0) at helper.h:148
148 if (str[len] == '\0') break;
(gdb) bt
#0 LoadString (s="", ck=0x6095d0) at helper.h:148
#1 DLS::Info::LoadString (ChunkID=ChunkID@entry=1146241865,
lstINFO=lstINFO@entry=0x609330, s="") at DLS.cpp:307
#2 0x00007ffff7ba8095 in DLS::Info::Info (this=0x609220, list=<optimized out>)
at DLS.cpp:263
#3 0x00007ffff7ba8448 in DLS::Resource::Resource (this=this@entry=0x609160,
Parent=Parent@entry=0x0, lstResource=lstResource@entry=0x609090)
at DLS.cpp:448
#4 0x00007ffff7baaa02 in DLS::File::File (this=0x609160, pRIFF=0x609090)
at DLS.cpp:1435
#5 0x00007ffff7bbab2e in gig::File::File (this=0x609160,
pRIFF=<optimized out>) at gig.cpp:5201
#6 0x0000000000401ee4 in main (argc=<optimized out>, argv=<optimized out>)
at gigdump.cpp:70
(gdb) disassemble
Dump of assembler code for function DLS::Info::LoadString(unsigned int, RIFF::List*, std::string&):
0x00007ffff7ba7f30 <+0>:push %rbp
0x00007ffff7ba7f31 <+1>:mov %edi,%eax
0x00007ffff7ba7f33 <+3>:mov %rsi,%rdi
0x00007ffff7ba7f36 <+6>:mov %eax,%esi
0x00007ffff7ba7f38 <+8>:push %rbx
0x00007ffff7ba7f39 <+9>:mov %rdx,%rbx
0x00007ffff7ba7f3c <+12>:sub $0x8,%rsp
0x00007ffff7ba7f40 <+16>:callq 0x7ffff7b9ed80 <_ZN4RIFF4List11GetSubChunkEj@plt>
0x00007ffff7ba7f45 <+21>:test %rax,%rax
0x00007ffff7ba7f48 <+24>:mov %rax,%rbp
0x00007ffff7ba7f4b <+27>:je 0x7ffff7ba7fa8 <DLS::Info::LoadString(unsigned int, RIFF::List*, std::string&)+120>
0x00007ffff7ba7f4d <+29>:mov %rax,%rdi
0x00007ffff7ba7f50 <+32>:callq 0x7ffff7b9e3e0 <_ZN4RIFF5Chunk13LoadChunkDataEv@plt>
0x00007ffff7ba7f55 <+37>:mov 0xc(%rbp),%r10d
0x00007ffff7ba7f59 <+41>:mov %rax,%rsi
0x00007ffff7ba7f5c <+44>:test %r10d,%r10d
0x00007ffff7ba7f5f <+47>:jle 0x7ffff7ba7faf <DLS::Info::LoadString(unsigned int, RIFF::List*, std::string&)+127>
---Type <return> to continue, or q <return> to quit---
=> 0x00007ffff7ba7f61 <+49>:cmpb $0x0,(%rax)
0x00007ffff7ba7f64 <+52>:je 0x7ffff7ba7faf <DLS::Info::LoadString(unsigned int, RIFF::List*, std::string&)+127>
0x00007ffff7ba7f66 <+54>:mov $0x1,%r9d
0x00007ffff7ba7f6c <+60>:xor %ecx,%ecx
0x00007ffff7ba7f6e <+62>:jmp 0x7ffff7ba7f7e <DLS::Info::LoadString(unsigned int, RIFF::List*, std::string&)+78>
0x00007ffff7ba7f70 <+64>:cmpb $0x0,(%rsi,%r9,1)
0x00007ffff7ba7f75 <+69>:lea 0x1(%r9),%r8
0x00007ffff7ba7f79 <+73>:je 0x7ffff7ba7fa0 <DLS::Info::LoadString(unsigned int, RIFF::List*, std::string&)+112>
0x00007ffff7ba7f7b <+75>:mov %r8,%r9
0x00007ffff7ba7f7e <+78>:add $0x1,%ecx
0x00007ffff7ba7f81 <+81>:cmp %r10d,%ecx
0x00007ffff7ba7f84 <+84>:jne 0x7ffff7ba7f70 <DLS::Info::LoadString(unsigned int, RIFF::List*, std::string&)+64>
0x00007ffff7ba7f86 <+86>:movslq %ecx,%rdx
0x00007ffff7ba7f89 <+89>:mov %rbx,%rdi
0x00007ffff7ba7f8c <+92>:callq 0x7ffff7b9f030 <_ZNSs6assignEPKcm@plt>
0x00007ffff7ba7f91 <+97>:add $0x8,%rsp
0x00007ffff7ba7f95 <+101>:mov %rbp,%rdi
0x00007ffff7ba7f98 <+104>:pop %rbx
0x00007ffff7ba7f99 <+105>:pop %rbp
---Type <return> to continue, or q <return> to quit---q
Quit
(gdb) i r
rax 0x00
rbx 0x6092386328888
rcx 0x7ffff739f9f7140737341159927
rdx 0x7ffff5d9f000140737318088704
rsi 0x00
rdi 0x7ffff5d9f000140737318088704
rbp 0x6095d00x6095d0
rsp 0x7fffffffdd800x7fffffffdd80
r8 0xffffffff4294967295
r9 0x00
r10 0x100001a16777242
r11 0x247583
r12 0x6092206328864
r13 0x7fffffffdfa0140737488347040
r14 0x00
r15 0x6091a06328736
rip 0x7ffff7ba7f610x7ffff7ba7f61 <DLS::Info::LoadString(unsigned int, RIFF::List*, std::string&)+49>
eflags 0x10202[ IF RF ]
cs 0x3351
ss 0x2b43
ds 0x00
es 0x00
---Type <return> to continue, or q <return> to quit---
fs 0x00
gs 0x00
(gdb)
ASAN:SIGSEGV
=================================================================
==41244== ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f260c0db52b sp 0x7fffc62477e0 bp 0x600e0000ded0 T0)
AddressSanitizer can not provide additional info.
#0 0x7f260c0db52a in LoadString /home/a/Documents/libgig-4.0.0/src/helper.h:148
#1 0x7f260c0db52a in DLS::Info::LoadString(unsigned int, RIFF::List*, std::string&) /home/a/Documents/libgig-4.0.0/src/DLS.cpp:307
#2 0x7f260c0dbfcb in DLS::Info::Info(RIFF::List*) /home/a/Documents/libgig-4.0.0/src/DLS.cpp:263
#3 0x7f260c0dcf82 in DLS::Resource::Resource(DLS::Resource*, RIFF::List*) /home/a/Documents/libgig-4.0.0/src/DLS.cpp:448
#4 0x7f260c0ee958 in DLS::File::File(RIFF::File*) /home/a/Documents/libgig-4.0.0/src/DLS.cpp:1435
#5 0x7f260c173e75 in gig::File::File(RIFF::File*) /home/a/Documents/libgig-4.0.0/src/gig.cpp:5201
#6 0x40275a in main /home/a/Documents/libgig-4.0.0/src/tools/gigdump.cpp:70
#7 0x7f260b7c3ec4 (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)
#8 0x402e5c in _start (/home/a/Documents/libgig-4.0.0/src/tools/.libs/gigdump+0x402e5c)
SUMMARY: AddressSanitizer: SEGV /home/a/Documents/libgig-4.0.0/src/helper.h:148 LoadString
==41244== ABORTING
POC:
libgig_4.0.0_null_pointer_dereference_2.gig
CVE:
CVE-2017-12952
4.
the gig::Instrument::UpdateRegionKeyTable function in gig.cpp in libgig 4.0.0 can cause a denial of service(invalid memory write and application crash) via a crafted gig file.
./gigdump libgig_4.0.0_invalid_memory_write.gig
----debug info:----
Program received signal SIGSEGV, Segmentation fault.
gig::Instrument::UpdateRegionKeyTable (this=this@entry=0x60a1a0) at gig.cpp:4445
4445 RegionKeyTable[iKey] = pRegion;
(gdb) bt
#0 gig::Instrument::UpdateRegionKeyTable (this=this@entry=0x60a1a0)
at gig.cpp:4445
#1 0x00007ffff7bc0b75 in gig::Instrument::Instrument (this=0x60a1a0,
pFile=<optimized out>, insList=0x60a0c0, pProgress=0x7fffffffdd90)
at gig.cpp:4409
#2 0x00007ffff7bc103e in gig::File::LoadInstruments (this=0x609160,
pProgress=0x0) at gig.cpp:5576
#3 0x00007ffff7bbade6 in gig::File::GetFirstInstrument (
this=this@entry=0x609160) at gig.cpp:5378
#4 0x000000000040533b in PrintInstruments (gig=gig@entry=0x609160)
at gigdump.cpp:205
#5 0x0000000000401f34 in main (argc=<optimized out>, argv=<optimized out>)
at gigdump.cpp:79
(gdb) disassemble
Dump of assembler code for function gig::Instrument::UpdateRegionKeyTable():
0x00007ffff7bba240 <+0>:xor %eax,%eax
0x00007ffff7bba242 <+2>:nopw 0x0(%rax,%rax,1)
0x00007ffff7bba248 <+8>:movq $0x0,0x80(%rdi,%rax,1)
0x00007ffff7bba254 <+20>:add $0x8,%rax
0x00007ffff7bba258 <+24>:cmp $0x400,%rax
0x00007ffff7bba25e <+30>:jne 0x7ffff7bba248 <gig::Instrument::UpdateRegionKeyTable()+8>
0x00007ffff7bba260 <+32>:mov 0x60(%rdi),%r9
0x00007ffff7bba264 <+36>:mov (%r9),%r8
0x00007ffff7bba267 <+39>:cmp %r9,%r8
0x00007ffff7bba26a <+42>:je 0x7ffff7bba2a4 <gig::Instrument::UpdateRegionKeyTable()+100>
0x00007ffff7bba26c <+44>:nopl 0x0(%rax)
0x00007ffff7bba270 <+48>:mov 0x10(%r8),%rcx
0x00007ffff7bba274 <+52>:movzwl 0x78(%rcx),%eax
0x00007ffff7bba278 <+56>:movzwl 0x7a(%rcx),%esi
0x00007ffff7bba27c <+60>:cmp %esi,%eax
0x00007ffff7bba27e <+62>:jg 0x7ffff7bba29a <gig::Instrument::UpdateRegionKeyTable()+90>
0x00007ffff7bba280 <+64>:add $0x1,%esi
0x00007ffff7bba283 <+67>:nopl 0x0(%rax,%rax,1)
0x00007ffff7bba288 <+72>:movslq %eax,%rdx
---Type <return> to continue, or q <return> to quit---
0x00007ffff7bba28b <+75>:add $0x1,%eax
0x00007ffff7bba28e <+78>:cmp %esi,%eax
=> 0x00007ffff7bba290 <+80>:mov %rcx,0x80(%rdi,%rdx,8)
0x00007ffff7bba298 <+88>:jne 0x7ffff7bba288 <gig::Instrument::UpdateRegionKeyTable()+72>
0x00007ffff7bba29a <+90>:mov (%r8),%r8
0x00007ffff7bba29d <+93>:cmp %r8,%r9
0x00007ffff7bba2a0 <+96>:jne 0x7ffff7bba270 <gig::Instrument::UpdateRegionKeyTable()+48>
0x00007ffff7bba2a2 <+98>:repz retq
0x00007ffff7bba2a4 <+100>:repz retq
End of assembler dump.
(gdb) i r
rax 0x3fbd16317
rbx 0x60a1a06332832
rcx 0x60d5806346112
rdx 0x3fbc16316
rsi 0x420116897
rdi 0x60a1a06332832
rbp 0x7fffffffdd900x7fffffffdd90
rsp 0x7fffffffdd080x7fffffffdd08
r8 0x60e7406350656
r9 0x60b0f06336752
r10 0x7fffffffdad0140737488345808
r11 0x7ffff7bba240140737349657152
r12 0x00
r13 0x60a0c06332608
r14 0x60a9806334848
r15 0x60d5806346112
rip 0x7ffff7bba2900x7ffff7bba290 <gig::Instrument::UpdateRegionKeyTable()+80>
eflags 0x10283[ CF SF IF RF ]
cs 0x3351
ss 0x2b43
ds 0x00
es 0x00
---Type <return> to continue, or q <return> to quit---
fs 0x00
gs 0x00
(gdb)
ASAN:SIGSEGV
=================================================================
==43045== ERROR: AddressSanitizer: SEGV on unknown address 0x60460003dd80 (pc 0x7fb8f7cfcd88 sp 0x7ffcb179db10 bp 0x60460001f500 T0)
AddressSanitizer can not provide additional info.
#0 0x7fb8f7cfcd87 in gig::Instrument::UpdateRegionKeyTable() /home/a/Documents/libgig-4.0.0/src/gig.cpp:4444
#1 0x7fb8f7d2efe2 in gig::Instrument::Instrument(gig::File*, RIFF::List*, RIFF::progress_t*) /home/a/Documents/libgig-4.0.0/src/gig.cpp:4409
#2 0x7fb8f7d30fdc in gig::File::LoadInstruments(RIFF::progress_t*) /home/a/Documents/libgig-4.0.0/src/gig.cpp:5576
#3 0x7fb8f7d026a0 in gig::File::GetFirstInstrument() /home/a/Documents/libgig-4.0.0/src/gig.cpp:5378
#4 0x40fca6 in PrintInstruments(gig::File*) /home/a/Documents/libgig-4.0.0/src/tools/gigdump.cpp:205
#5 0x4027aa in main /home/a/Documents/libgig-4.0.0/src/tools/gigdump.cpp:79
#6 0x7fb8f7350ec4 (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)
#7 0x402e5c in _start (/home/a/Documents/libgig-4.0.0/src/tools/.libs/gigdump+0x402e5c)
SUMMARY: AddressSanitizer: SEGV /home/a/Documents/libgig-4.0.0/src/gig.cpp:4445 gig::Instrument::UpdateRegionKeyTable()
==43045== ABORTING
POC:
libgig_4.0.0_invalid_memory_write.gig
CVE:
CVE-2017-12953
5.
the gig::Region::GetSampleFromWavePool function in gig.cpp in gig.cpp in libgig 4.0.0 can cause a denial of service(invalid memory read and application crash) via a crafted gig file.
./gigdump libgig_4.0.0_invalid_memory_read.gig
----debug info:----
Program received signal SIGSEGV, Segmentation fault.
gig::Region::GetSampleFromWavePool (this=0x609160, this@entry=0x612520,
WavePoolTableIndex=0, pProgress=pProgress@entry=0x0) at gig.cpp:3849
3849 unsigned long soughtoffset = file->pWavePoolTable[WavePoolTableIndex];
(gdb) bt
#0 gig::Region::GetSampleFromWavePool (this=0x609160, this@entry=0x612520,
WavePoolTableIndex=0, pProgress=pProgress@entry=0x0) at gig.cpp:3849
#1 0x00007ffff7bc07df in gig::Region::Region (this=0x612520,
pInstrument=<optimized out>, rgnList=0x6100f0) at gig.cpp:2970
#2 0x00007ffff7bc0b36 in gig::Instrument::Instrument (this=0x60ef80,
pFile=<optimized out>, insList=0x60eea0, pProgress=0x7fffffffdd90)
at gig.cpp:4404
#3 0x00007ffff7bc103e in gig::File::LoadInstruments (this=0x609160,
pProgress=0x0) at gig.cpp:5576
#4 0x00007ffff7bbade6 in gig::File::GetFirstInstrument (
this=this@entry=0x609160) at gig.cpp:5378
#5 0x000000000040533b in PrintInstruments (gig=gig@entry=0x609160)
at gigdump.cpp:205
#6 0x0000000000401f34 in main (argc=<optimized out>, argv=<optimized out>)
at gigdump.cpp:79
(gdb) disassemble
Dump of assembler code for function gig::Region::GetSampleFromWavePool(unsigned int, RIFF::progress_t*):
0x00007ffff7bbac00 <+0>:cmp $0xffffffff,%esi
0x00007ffff7bbac03 <+3>:je 0x7ffff7bbac63 <gig::Region::GetSampleFromWavePool(unsigned int, RIFF::progress_t*)+99>
0x00007ffff7bbac05 <+5>:push %r12
0x00007ffff7bbac07 <+7>:push %rbp
0x00007ffff7bbac08 <+8>:push %rbx
0x00007ffff7bbac09 <+9>:mov 0x18(%rdi),%rax
0x00007ffff7bbac0d <+13>:mov 0x18(%rax),%rbx
0x00007ffff7bbac11 <+17>:mov 0x78(%rbx),%rax
0x00007ffff7bbac15 <+21>:test %rax,%rax
0x00007ffff7bbac18 <+24>:je 0x7ffff7bbac5c <gig::Region::GetSampleFromWavePool(unsigned int, RIFF::progress_t*)+92>
0x00007ffff7bbac1a <+26>:mov %esi,%ecx
0x00007ffff7bbac1c <+28>:mov %rbx,%rdi
0x00007ffff7bbac1f <+31>:mov %rdx,%rsi
=> 0x00007ffff7bbac22 <+34>:mov (%rax,%rcx,4),%ebp
0x00007ffff7bbac25 <+37>:mov 0x80(%rbx),%rax
0x00007ffff7bbac2c <+44>:mov (%rax,%rcx,4),%r12d
0x00007ffff7bbac30 <+48>:callq 0x7ffff7b9e400 <_ZN3gig4File14GetFirstSampleEPN4RIFF10progress_tE@plt>
0x00007ffff7bbac35 <+53>:test %rax,%rax
---Type <return> to continue, or q <return> to quit---q
Quit
(gdb) i r
rax 0x609f806332288
rbx 0x6091606328672
rcx 0xff0000004278190080
rdx 0x00
rsi 0x00
rdi 0x6091606328672
rbp 0x00x0
rsp 0x7fffffffdc900x7fffffffdc90
r8 0x00
r9 0x22
r10 0x00
r11 0x246582
r12 0x6131906369680
r13 0x6125206366496
r14 0x00
r15 0x00
rip 0x7ffff7bbac220x7ffff7bbac22 <gig::Region::GetSampleFromWavePool(unsigned int, RIFF::progress_t*)+34>
eflags 0x10202[ IF RF ]
cs 0x3351
ss 0x2b43
ds 0x00
es 0x00
---Type <return> to continue, or q <return> to quit---
fs 0x00
gs 0x00
(gdb)
ASAN:SIGSEGV
=================================================================
==44028== ERROR: AddressSanitizer: SEGV on unknown address 0x6009fc00ed70 (pc 0x7fea916446ac sp 0x7ffd026ec040 bp 0x0c08c0003ea3 T0)
AddressSanitizer can not provide additional info.
#0 0x7fea916446ab in gig::Region::GetSampleFromWavePool(unsigned int, RIFF::progress_t*) /home/a/Documents/libgig-4.0.0/src/gig.cpp:3850
#1 0x7fea91670247 in gig::Region::Region(gig::Instrument*, RIFF::List*) /home/a/Documents/libgig-4.0.0/src/gig.cpp:2970
#2 0x7fea91671f4a in gig::Instrument::Instrument(gig::File*, RIFF::List*, RIFF::progress_t*) /home/a/Documents/libgig-4.0.0/src/gig.cpp:4404
#3 0x7fea91673fdc in gig::File::LoadInstruments(RIFF::progress_t*) /home/a/Documents/libgig-4.0.0/src/gig.cpp:5576
#4 0x7fea916456a0 in gig::File::GetFirstInstrument() /home/a/Documents/libgig-4.0.0/src/gig.cpp:5378
#5 0x40fca6 in PrintInstruments(gig::File*) /home/a/Documents/libgig-4.0.0/src/tools/gigdump.cpp:205
#6 0x4027aa in main /home/a/Documents/libgig-4.0.0/src/tools/gigdump.cpp:79
#7 0x7fea90c93ec4 (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)
#8 0x402e5c in _start (/home/a/Documents/libgig-4.0.0/src/tools/.libs/gigdump+0x402e5c)
SUMMARY: AddressSanitizer: SEGV /home/a/Documents/libgig-4.0.0/src/gig.cpp:3849 gig::Region::GetSampleFromWavePool(unsigned int, RIFF::progress_t*)
==44028== ABORTING
POC:
libgig_4.0.0_invalid_memory_read.gig
CVE:
CVE-2017-12954
Proof of Concept:
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/42546.zip
