#367 heap-buffer-overflow in SoX 14.4.3git（src/formats_i.c:98:16）

[babybus]

We found a heap-buffer-overflow in SoX 14.4.3git（src/formats_i.c:98:16）.

Command Input

sox --single-threaded poc_file -t aiff /dev/null

poc_file is attached.

Sanitizer Dump

==1135341==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6250000020f8 at pc 0x000000434f0e bp 0x7fff01eb3ba0 sp 0x7fff01eb3368
WRITE of size 2 at 0x6250000020f8 thread T0
    #0 0x434f0d in fread /root/test/fuzzing_python/llvm-project-llvmorg-12.0.0/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1029:16
    #1 0x4f55f4 in lsx_readbuf /root/target/Invariants/sox/src/formats_i.c:98:16
    #2 0x4f6b28 in lsx_read_w_buf /root/target/Invariants/sox/src/formats_i.c:376:1
    #3 0x4f7c61 in lsx_readw /root/target/Invariants/sox/src/formats_i.c:395:1
    #4 0x5d6dac in lsx_readsw /root/target/Invariants/sox/src/./sox_i.h:180:9
    #5 0x5d4537 in startread /root/target/Invariants/sox/src/hcom.c:157:17
    #6 0x4e9b50 in open_read /root/target/Invariants/sox/src/formats.c:600:32
    #7 0x4e8813 in sox_open_read /root/target/Invariants/sox/src/formats.c:640:10
    #8 0x4ca925 in main /root/target/Invariants/sox/src/sox.c:2924:20
    #9 0x7f54e0e8c082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #10 0x41d70d in _start (/root/target/Invariants/sox/src/sox+0x41d70d)

0x6250000020f8 is located 8 bytes to the right of 8176-byte region [0x625000000100,0x6250000020f0)
allocated by thread T0 here:
    #0 0x49896d in malloc /root/test/fuzzing_python/llvm-project-llvmorg-12.0.0/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3
    #1 0x4fb348 in lsx_malloc /root/target/Invariants/sox/src/xmalloc.c:52:23
    #2 0x5d441d in startread /root/target/Invariants/sox/src/hcom.c:153:25
    #3 0x4e9b50 in open_read /root/target/Invariants/sox/src/formats.c:600:32
    #4 0x4e8813 in sox_open_read /root/target/Invariants/sox/src/formats.c:640:10
    #5 0x4ca925 in main /root/target/Invariants/sox/src/sox.c:2924:20
    #6 0x7f54e0e8c082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-buffer-overflow /root/test/fuzzing_python/llvm-project-llvmorg-12.0.0/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1029:16 in fread
Shadow bytes around the buggy address:
  0x0c4a7fff83c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a7fff83d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a7fff83e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a7fff83f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a7fff8400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c4a7fff8410: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa[fa]
  0x0c4a7fff8420: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7fff8430: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7fff8440: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7fff8450: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7fff8460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==1135341==ABORTING

Environment

• OS: Ubuntu 20.04.1
• clang:12.0.0
• SoX:14.4.3git
  we built sox with AddressSanitizer (ASAN) .
  make CC=clang CXX=clang++ CFLAGS="-fsanitize=address -g3 -O0" CXXFLAGS="-fsanitize=address -g3 -O0"

[roucaries bastien]

This is CVE-2023-34432

[roucaries bastien]

Debian fix of CVE-2021-23159 and CVE-2021-23172. fix it
https://salsa.debian.org/lts-team/packages/sox/-/blob/debian/stretch/debian/patches/CVE-2021-23159.patch

[Martin Guy]

Confirmed in plain 14.4.2:

malloc(): corrupted top size
Aborted (core dumped))

Absent in plain 42b355, Debian, sox_ng.14.5.0.3
and sox_ng-14.5.0.3 with address sanitizer:

sox FAIL formats: can't open input file `poc_file': Implausible dictionary size in HCOM header

Confirmed in 42b355 and current git master with address sanitizer:

ERROR: AddressSanitizer: heap-buffer-overflow