#368 heap-buffer-overflow in SoX 14.4.3git（src/hcom.c:160:41 in startread）

[babybus]

We found a heap-buffer-overflow in SoX 14.4.3git（src/hcom.c:160:41 in startread）.

Command Input

sox --single-threaded poc_file -t aiff /dev/null

poc_file is attached.

Sanitizer Dump

==1135707==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6250000020f8 at pc 0x0000005d4669 bp 0x7ffc34d838d0 sp 0x7ffc34d838c8
READ of size 2 at 0x6250000020f8 thread T0
    #0 0x5d4668 in startread /root/target/Invariants/sox/src/hcom.c:160:41
    #1 0x4e9b50 in open_read /root/target/Invariants/sox/src/formats.c:600:32
    #2 0x4e8813 in sox_open_read /root/target/Invariants/sox/src/formats.c:640:10
    #3 0x4ca925 in main /root/target/Invariants/sox/src/sox.c:2924:20
    #4 0x7f71c6993082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #5 0x41d70d in _start (/root/target/Invariants/sox/src/sox+0x41d70d)

0x6250000020f8 is located 8 bytes to the right of 8176-byte region [0x625000000100,0x6250000020f0)
allocated by thread T0 here:
    #0 0x49896d in malloc /root/test/fuzzing_python/llvm-project-llvmorg-12.0.0/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3
    #1 0x4fb348 in lsx_malloc /root/target/Invariants/sox/src/xmalloc.c:52:23
    #2 0x5d441d in startread /root/target/Invariants/sox/src/hcom.c:153:25
    #3 0x4e9b50 in open_read /root/target/Invariants/sox/src/formats.c:600:32
    #4 0x4e8813 in sox_open_read /root/target/Invariants/sox/src/formats.c:640:10
    #5 0x4ca925 in main /root/target/Invariants/sox/src/sox.c:2924:20
    #6 0x7f71c6993082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-buffer-overflow /root/target/Invariants/sox/src/hcom.c:160:41 in startread
Shadow bytes around the buggy address:
  0x0c4a7fff83c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a7fff83d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a7fff83e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a7fff83f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a7fff8400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c4a7fff8410: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa[fa]
  0x0c4a7fff8420: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7fff8430: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7fff8440: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7fff8450: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7fff8460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==1135707==ABORTING

Environment

• OS: Ubuntu 20.04.1
• clang:12.0.0
• SoX:14.4.3git
  we built sox with AddressSanitizer (ASAN) .
  make CC=clang CXX=clang++ CFLAGS="-fsanitize=address -g3 -O0" CXXFLAGS="-fsanitize=address -g3 -O0"

[roucaries bastien]

This is CVE-2023-34318

[roucaries bastien]

Fixed by debian fix for CVE-2021-23159

[Martin Guy]

Confirmed in 14.4.2 and 42b355 and current sox.sf.net HEAD

Absent in Debian and sox_ng-14.5.0:

sox_ng FAIL formats: can't open input file `poc_file': Implausible dictionary size in HCOM header