sox: CVE-2017-18189: null pointer dereference while running sox

Debian Bug report logs - #881121
sox: CVE-2017-18189: null pointer dereference while running sox

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Joonun Jang <joonun.jang@gmail.com>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: sox: null pointer dereference while running sox

Date: Wed, 08 Nov 2017 11:05:12 +0900

[Message part 1 (text/plain, inline)]

Package: sox
Version: 14.4.1-5+b2
Severity: normal
Tags: security

null pointer dereference while running sox with "poc.aiff output.aiff speed 1.027" option

Running 'sox poc.aiff output.aiff speed 1.027' with the attached file raises null pointer dereference
which may allow a remote attack to cause a denial-of-service attack
I expected the program to terminate without segfault, but the program crashes as follow

-------------------------------------------

june@yuweol:~/poc/sox/crash4$ sox ./poc.aiff output.aiff speed 1.027
Segmentation fault

-------------------------------------------

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7ba7ff8 in ?? () from /usr/lib/x86_64-linux-gnu/libsox.so.2
(gdb) bt
#0  0x00007ffff7ba7ff8 in ?? () from /usr/lib/x86_64-linux-gnu/libsox.so.2
#1  0x00007ffff7b5cb17 in sox_read () from /usr/lib/x86_64-linux-gnu/libsox.so.2
#2  0x000055555555fc74 in ?? ()
#3  0x00007ffff7b6cb4e in sox_flow_effects () from /usr/lib/x86_64-linux-gnu/libsox.so.2
#4  0x0000555555558e21 in ?? ()
#5  0x00007ffff70772e1 in __libc_start_main (main=0x555555557980, argc=5, argv=0x7fffffffe268,
    init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe258)
    at ../csu/libc-start.c:291
#6  0x000055555555a45a in ?? ()
(gdb) x/i $rip
=> 0x7ffff7ba7ff8:  movzbl (%r11,%rsi,1),%edi
(gdb) i r r11 rsi
r11            0x0  0
rsi            0x0  0

-------------------------------------------

This bug was found with a fuzzer developed by 'SoftSec' group at KAIST.

-- System Information:
Debian Release: buster/sid
  APT prefers unstable-debug
  APT policy: (500, 'unstable-debug'), (500, 'testing-debug'), (500, 'stable-updates'), (500, 'testing'), (500, 'stable'), (1, 'experimental-debug')
Architecture: amd64 (x86_64)

Kernel: Linux 4.9.0-3-amd64 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages sox depends on:
ii  libc6             2.24-17
ii  libgomp1          7.2.0-12
ii  libsox-fmt-alsa   14.4.1-5+b2
ii  libsox-fmt-ao     14.4.1-5+b2
ii  libsox-fmt-base   14.4.1-5+b2
ii  libsox-fmt-oss    14.4.1-5+b2
ii  libsox-fmt-pulse  14.4.1-5+b2
ii  libsox2           14.4.1-5+b2

sox recommends no packages.

Versions of packages sox suggests:
ii  libsox-fmt-all  14.4.1-5+b2

-- no debconf information

[poc.aiff (application/octet-stream, attachment)]

Message #10 received at 881121@bugs.debian.org (full text, mbox, reply):

From: Eric Wong <normalperson@yhbt.net>

To: Joonun Jang <joonun.jang@gmail.com>, 881121@bugs.debian.org

Cc: Mans Rullgard <mans@mansr.com>, sox-devel@lists.sourceforge.net

Subject: Re: Bug#881121: sox: null pointer dereference while running sox

Date: Sat, 18 Nov 2017 21:54:50 +0000

Joonun Jang <joonun.jang@gmail.com> wrote:
> Package: sox
> Version: 14.4.1-5+b2
> Severity: normal
> Tags: security
> 
> null pointer dereference while running sox with "poc.aiff output.aiff speed 1.027" option
> 
> Running 'sox poc.aiff output.aiff speed 1.027' with the attached file raises null pointer dereference
> which may allow a remote attack to cause a denial-of-service attack
> I expected the program to terminate without segfault, but the program crashes as follow

Thanks for the report, Mans fixed this the other day on the
sox-devel list:

https://public-inbox.org/sox-devel/20171109114554.16297-1-mans@mansr.com/raw

Also pushed as commit c9a48c055398f171128573bbeab4e4de4c761058
in my unofficial "pu" (potential updates) branch @ https://bogomips.org/sox.git

Message #15 received at 881121-submitter@bugs.debian.org (full text, mbox, reply):

From: Jaromír Mikeš <mira.mikes@seznam.cz>

To: 881121-submitter@bugs.debian.org

Subject: Bug#881121 marked as pending

Date: Sat, 18 Nov 2017 22:48:11 +0000

tag 881121 pending
thanks

Hello,

Bug #881121 reported by you has been fixed in the Git repository. You can
see the changelog below, and you can check the diff of the fix at:

    http://anonscm.debian.org/git/pkg-multimedia/sox.git/commit/?id=d365640

---
commit d365640ba8f8481deae80ec4bab691a7dae61287
Author: Jaromír Mikeš <mira.mikes@seznam.cz>
Date:   Sat Nov 18 23:47:56 2017 +0100

    Update changelog.

diff --git a/debian/changelog b/debian/changelog
index 1d5d825..aabfc39 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -30,11 +30,12 @@ sox (14.4.2-1) UNRELEASED; urgency=medium
   * Add 0010-wavpack_check_errors.patch. (Closes: #881145)
   * Add bug-presubj file.
   * Add man page fixing patch.
+  * Add xa-validate-channel-count patch. (Closes: #881121)
 
   [ Sebastian Ramacher ]
   * Remove shlibs file, symbols file already present
 
- -- Jaromír Mikeš <mira.mikes@seznam.cz>  Sat, 18 Nov 2017 19:30:28 +0100
+ -- Jaromír Mikeš <mira.mikes@seznam.cz>  Sat, 18 Nov 2017 23:46:50 +0100
 
 sox (14.4.1-5) unstable; urgency=medium
 

Message #20 received at 881121-close@bugs.debian.org (full text, mbox, reply):

From: Jaromír Mikeš <mira.mikes@seznam.cz>

To: 881121-close@bugs.debian.org

Subject: Bug#881121: fixed in sox 14.4.2-1

Date: Sun, 19 Nov 2017 17:00:56 +0000

Source: sox
Source-Version: 14.4.2-1

We believe that the bug you reported is fixed in the latest version of
sox, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 881121@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Jaromír Mikeš <mira.mikes@seznam.cz> (supplier of updated sox package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Sun, 19 Nov 2017 12:56:03 +0100
Source: sox
Binary: sox libsox3 libsox-fmt-base libsox-fmt-alsa libsox-fmt-ao libsox-fmt-mp3 libsox-fmt-oss libsox-fmt-pulse libsox-fmt-all libsox-dev
Architecture: source amd64
Version: 14.4.2-1
Distribution: experimental
Urgency: medium
Maintainer: Debian Multimedia Maintainers <pkg-multimedia-maintainers@lists.alioth.debian.org>
Changed-By: Jaromír Mikeš <mira.mikes@seznam.cz>
Description:
 libsox-dev - Development files for the SoX library
 libsox-fmt-all - All SoX format libraries
 libsox-fmt-alsa - SoX alsa format I/O library
 libsox-fmt-ao - SoX Libao format I/O library
 libsox-fmt-base - Minimal set of SoX format libraries
 libsox-fmt-mp3 - SoX MP2 and MP3 format library
 libsox-fmt-oss - SoX OSS format I/O library
 libsox-fmt-pulse - SoX PulseAudio format I/O library
 libsox3    - SoX library of audio effects and processing
 sox        - Swiss army knife of sound processing
Closes: 800344 870328 876904 878809 878810 881121 881145
Changes:
 sox (14.4.2-1) experimental; urgency=medium
 .
   [ Jaromír Mikeš ]
   * New upstream version 14.4.2 (Closes: #800344)
   * Set compat/dh 10.
   * Bump Standards.
   * Adopt package.(Closes: #876904)
   * Update Homepage to avoid redirecting.
   * Update Vcs entry.
   * Improve description of dev package.
   * Drop unused patches.
   * Delete dirs files.
   * Simplify install files.
   * Simplify rules file.
   * Set hardening all.
   * Try avoid useless linking.
   * Update copyright file.
   * Introduce symbols file.
   * Bump soname.
   * Use secure uri in watch file.
   * Introduce postclone.sh script.
   * Add patch to fix build.
   * Add patch to fix spelling.
   * Add patches to fix CVE's.
     (Closes: #878809) (Closes: #878810) (Closes: #870328)
   * Add gbp.conf.
   * Add override_dh_installchangelogs.
   * Remove old configure option.
   * override_dh_makeshlibs is not needed any more.
   * Add 0010-wavpack_check_errors.patch. (Closes: #881145)
   * Add bug-presubj file.
   * Add man page fixing patch.
   * Add xa-validate-channel-count patch. (Closes: #881121)
 .
   [ Sebastian Ramacher ]
   * Remove shlibs file, symbols file already present
Checksums-Sha1:
 20eafc0eda96e8e55d1ce68ade748012192684cf 2729 sox_14.4.2-1.dsc
 dc9668256b9d81ef25d672f14f12ec026b0b4087 935449 sox_14.4.2.orig.tar.bz2
 de1402dffb2aca471744cc44efa4a4f8987e4df6 21092 sox_14.4.2-1.debian.tar.xz
 4b8c1ee14da7b1be1be0bf5a27b12378b88c543d 365284 libsox-dev_14.4.2-1_amd64.deb
 61da03e94171115bdcf0d9249fcc8f93e62964c1 45596 libsox-fmt-all_14.4.2-1_amd64.deb
 6a7a39798d4e805780008555531d288223caef48 14172 libsox-fmt-alsa-dbgsym_14.4.2-1_amd64.deb
 7cb8ca41b46a8d540a79a8f82f181eb90ffa3721 51096 libsox-fmt-alsa_14.4.2-1_amd64.deb
 59de1c2bba7deaf6c3e536c9e87195c652d9d6d0 7428 libsox-fmt-ao-dbgsym_14.4.2-1_amd64.deb
 21cb48b151dd1775900f743b47ff6a952d6d848a 47928 libsox-fmt-ao_14.4.2-1_amd64.deb
 b2a00143e3a32d45729be9e495ab339e64c1004d 158020 libsox-fmt-base-dbgsym_14.4.2-1_amd64.deb
 027bca007471f2ef2a1c9e2ffdc4bd0b3fc03630 72648 libsox-fmt-base_14.4.2-1_amd64.deb
 79339c24bead1c1842a72c02686e2757d02a8d77 23932 libsox-fmt-mp3-dbgsym_14.4.2-1_amd64.deb
 a1c1a8c15e78bcbd343e1b075d6ee559575ec24b 56428 libsox-fmt-mp3_14.4.2-1_amd64.deb
 8edd1a765be9c43fa55e74f0c57ef6aa59293825 9300 libsox-fmt-oss-dbgsym_14.4.2-1_amd64.deb
 00b628bdd2463c60732acbeefd91b38a153fa14a 49532 libsox-fmt-oss_14.4.2-1_amd64.deb
 193a7a0779148d38295363a993d95dec45f20bd4 7572 libsox-fmt-pulse-dbgsym_14.4.2-1_amd64.deb
 e6cf8cbbd5554b3c269256d4acb07a351068f273 47844 libsox-fmt-pulse_14.4.2-1_amd64.deb
 eb0bc7f26e7d1c55c444dec72fd15e9dfb719694 488276 libsox3-dbgsym_14.4.2-1_amd64.deb
 f3fcfe63f0a2562a0c6d04509813fcdeb1e80a65 263412 libsox3_14.4.2-1_amd64.deb
 1b49c99a7d267b0e99791514e3f62be9c8764b5f 47612 sox-dbgsym_14.4.2-1_amd64.deb
 c1a46baf75c7004df1bb309b24b3474705ddc875 12460 sox_14.4.2-1_amd64.buildinfo
 3c2e11cde1d7d58e04503cf2f432b028a8d53935 141820 sox_14.4.2-1_amd64.deb
Checksums-Sha256:
 b1ab63147b5a96980391c829d01a818dc5aea94219467aee3205657afdd418dc 2729 sox_14.4.2-1.dsc
 81a6956d4330e75b5827316e44ae381e6f1e8928003c6aa45896da9041ea149c 935449 sox_14.4.2.orig.tar.bz2
 702ecc9783371173d490ada0d1baed4c3096f98ea270b7f24557fd7b828d49d3 21092 sox_14.4.2-1.debian.tar.xz
 b81dbfc579f22a82aab8244d0f3b22513c605e9c80f2b4a0291ec1015d9d1538 365284 libsox-dev_14.4.2-1_amd64.deb
 1043b63e1bc0dc77980575145b6c2e7c5ef880c6560e097335e94997e70c5962 45596 libsox-fmt-all_14.4.2-1_amd64.deb
 76a7143f47d90b4e42746d870a9b0c052c193bacefa7957aa8d7396a61026151 14172 libsox-fmt-alsa-dbgsym_14.4.2-1_amd64.deb
 cb962d376d746f39eee47ee719db395e38abf50956ac0ab96606a71021a6a229 51096 libsox-fmt-alsa_14.4.2-1_amd64.deb
 6d559c02b7731ed36eec27f00075b9c75822622b16a76ac98e3461c666a8be60 7428 libsox-fmt-ao-dbgsym_14.4.2-1_amd64.deb
 d8d1235fc5df13ccda459d08283a4756772e29c08c512474f05a9921f0e6be21 47928 libsox-fmt-ao_14.4.2-1_amd64.deb
 859a93e1a6d071a06904e83cec6405a4fcf07262bd2a8db79476dea1f90eea01 158020 libsox-fmt-base-dbgsym_14.4.2-1_amd64.deb
 28fd5aec2909443932b11b0fb5102c6de99a570ba3b11cc2f8e0ab59aa6e9ddc 72648 libsox-fmt-base_14.4.2-1_amd64.deb
 a586b9fe6340ccb8300b2817fbc054e7ca9c2c497034f55a2bb0bdb0453a6a3c 23932 libsox-fmt-mp3-dbgsym_14.4.2-1_amd64.deb
 5f5eaf8e82dd0ed3029a46daab7fefdf4656eb01174378a5f5ec7c13aaad1f12 56428 libsox-fmt-mp3_14.4.2-1_amd64.deb
 8b838b7026d3da1b2fd4f018254f31a9d434a492e778883b33e66c2c981518cf 9300 libsox-fmt-oss-dbgsym_14.4.2-1_amd64.deb
 afc0631d2f4f4a03ad9fe582e36b6d9f2e13794700d7fc83ee455d9c29180db9 49532 libsox-fmt-oss_14.4.2-1_amd64.deb
 a65c4995624335db78b82246af44f2f1beca8aab34f1141d29acf8ac4fde3127 7572 libsox-fmt-pulse-dbgsym_14.4.2-1_amd64.deb
 f36d82325f1d897dd95fc7d48db3eecd93411d8250e976a4bddf4c5ef31151b5 47844 libsox-fmt-pulse_14.4.2-1_amd64.deb
 10fd9d349cbd6d0aed656cea0e459881b9f341b1173583e47d22a6477a98c900 488276 libsox3-dbgsym_14.4.2-1_amd64.deb
 0315b3b72b460919df31c562923338da22ce5be27168e65f56827082c09cb20a 263412 libsox3_14.4.2-1_amd64.deb
 c32df52a00d324c98bf17ce4d8f6d3876515f546d70e6ea1e033c9a488e9ee24 47612 sox-dbgsym_14.4.2-1_amd64.deb
 fa08f3cdeaca15aacd6801f639344168d0e306c84b6c330878fb474b721fd1f8 12460 sox_14.4.2-1_amd64.buildinfo
 59031cf3cdcb001085e8699c6bb8c17d6db1c286d934412797072ab24cdfd4b0 141820 sox_14.4.2-1_amd64.deb
Files:
 019d755b5730d9d4c179d76296047b2b 2729 sound optional sox_14.4.2-1.dsc
 ba804bb1ce5c71dd484a102a5b27d0dd 935449 sound optional sox_14.4.2.orig.tar.bz2
 5eb6ed7737682f6a01654786c811900d 21092 sound optional sox_14.4.2-1.debian.tar.xz
 a55f8c489e8dee5ff3b36a5c27a069a6 365284 libdevel optional libsox-dev_14.4.2-1_amd64.deb
 d2a108181a2395a5a0c76f56650fabac 45596 libs optional libsox-fmt-all_14.4.2-1_amd64.deb
 7627067d3b556a9e1e50decf555a3d95 14172 debug optional libsox-fmt-alsa-dbgsym_14.4.2-1_amd64.deb
 369bc9e4a40acdd907f66f625e2a7480 51096 libs optional libsox-fmt-alsa_14.4.2-1_amd64.deb
 df540d41470863e3476630192676dd23 7428 debug optional libsox-fmt-ao-dbgsym_14.4.2-1_amd64.deb
 4bda919f51aa7b2c49d8fa76d392d047 47928 libs optional libsox-fmt-ao_14.4.2-1_amd64.deb
 0f38dd978447cdc7a6757cc310939b22 158020 debug optional libsox-fmt-base-dbgsym_14.4.2-1_amd64.deb
 412160344d10221e26fbc6e11a01719f 72648 libs optional libsox-fmt-base_14.4.2-1_amd64.deb
 53dcb76353c68893133fd20f7f115555 23932 debug optional libsox-fmt-mp3-dbgsym_14.4.2-1_amd64.deb
 49b3c74b8546b29bcb6746bce6315c07 56428 libs optional libsox-fmt-mp3_14.4.2-1_amd64.deb
 886bf75e2ad72eb75f0cb384333b4657 9300 debug optional libsox-fmt-oss-dbgsym_14.4.2-1_amd64.deb
 6508ca60d10e0c0029186945c312efb0 49532 libs optional libsox-fmt-oss_14.4.2-1_amd64.deb
 1d5f9ac9c490697278751c6723c142d6 7572 debug optional libsox-fmt-pulse-dbgsym_14.4.2-1_amd64.deb
 f1a3de751aca32811fab221ddef7debd 47844 libs optional libsox-fmt-pulse_14.4.2-1_amd64.deb
 cacbca0abdc347633da0961e0a4d7348 488276 debug optional libsox3-dbgsym_14.4.2-1_amd64.deb
 d4a42de41fbb3ef101db47a4fb3d7fbf 263412 libs optional libsox3_14.4.2-1_amd64.deb
 3177c00da486da1a690c653902ab0f5f 47612 debug optional sox-dbgsym_14.4.2-1_amd64.deb
 677aee2347cb2b653d41f29d20844384 12460 sound optional sox_14.4.2-1_amd64.buildinfo
 735d45d4bb2a04a281c4c2c149740ce0 141820 sound optional sox_14.4.2-1_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE94y6B4F7sUmhHTOQafL8UW6nGZMFAloRdvgACgkQafL8UW6n
GZO1Ng/+NV18hbK/DoeZLe9390Ct5Xc6Y4ToKBnp4jEYiKYp/+Ye60LXcCqMTVHP
yFPtdA7PCjir5LSRGBj5nX+rn/oUhyF6PB6y3VgnWrMJVGdlgD0kDkz9lUenGEbK
8LVAXlqcuHyGN9qnYmaUCpMiOvHYLa7UuKo2Xmav7shy0k+b9z3ivrD8YX070YWg
xN7hlT3inc5Rs6tRFC35PGbnNSIBHZu0tpUoSyt8aKsTXIBriPAub1wUJqAcV75U
0xQpHsagxQj+D1PBCvH88wzf3aOxH6Iy26GO8OPoBtNcQTGytZOePiMA8e6pgGKM
vXOs5cB5XeDCqaTNNjG7Qoeenkz9g1xwqE/2lTSXsp+XMDCWx+OYSqDyIFv5miYZ
q8CNYaD5KlT/iUECf87wsyaS5hCVbtUQ8NP12XlkSHVQnoQQs3OaZ+qgQUYLQeWc
Q6D3s8VLi4j+vzuN5ihYjsYfv3kegBBid6eLidcXb1xlEMIxw+7dlcwD8JgMAFYl
m+rW6RiF2pu5uuASK41Iu4Woq9corS/TerJ4PCeCCHFz7td4/oxLcMOPIESMIRz0
sHSzAhjZLz1oz5dTbXx8ghSoVe63wOFtgHqs7nt0Fjqvb+yHlCcEYeM404PUUEQL
RKLfJfYbBAtgynNqtcla8rPmha8VDVHxTQPmYv0F/mcfmO87jZU=
=oEJ4
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.