Bug Hunter Diary

(gdb) info registers r0 r1 r2r0 0x684a38 6834744r1 0x115030 1134640r2 0x1fd0 8144I also inspected the data pointed to by r1 to see if the source dataof memcpy() was user controllable:(gdb) x/40x $r10x115030: 0x00000000 0xd7e178c2 0xe5e178c2 0x80bb00000x115040: 0x00b41000 0x00000100 0x00000001 0x000000000x115050: 0x00000000 0x00000100 0x00000000 0x000000000x115060: 0x00000000 0x00000100 0x00000000 0x000000000x115070: 0x00000000 0x00000040 0x00000000 0x000000000x115080: 0x00000000 0x00000000 0x00000000 0x000000000x115090: 0x02000000 0x2d130000 0x6b617274 0x5c0000000x1150a0: 0x64686b74 0x07000000 0xd7e178c2 0xe5e178c20x1150b0: 0x01000000 0x00000000 0x00b41000 0x000000000x1150c0: 0x00000000 0x00000000 0x00000001 0x00000100I then searched test-case file number 40 for those values. I foundthem right at the beginning of the file in little-endian notation:[..]00000030h: 00 00 00 00 C2 78 E1 D7 C2 78 E1 E5 00 00 BB 80 ; ....Âxá×Âxáå..»€00000040h: 00 10 B4 00 00 01 00 00 01 00 00 00 00 00 00 00 ; ..´.............00000050h: 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 ; ................00000060h: 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 ; ................00000070h: 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 ; ....@...........[..](gdb) continueContinuing.So I could control the source data of the memory copy. I continuedthe execution of mediaserverd and got the following output in thedebugger:Program received signal EXC_BAD_ACCESS, Could not access memory.Reason: KERN_PROTECTION_FAILURE at address: 0x006850000x314780ec in memmove ()Mediaserverd crashed again while trying to access unmapped memory.It seemed that the size argument supplied to memcpy() was too big,so the function tried to copy audio-file data beyond the end of thestack. At this point I stopped the debugger and opened the test-casefile that had actually caused the crash (file40.m4a) with a hex editor:00000000h: 00 00 00 20 66 74 79 70 4D 34 41 20 00 00 00 00 ; ... ftypM4A ....00000010h: 4D 34 41 20 6D 70 34 32 69 73 6F 6D 00 00 00 00 ; M4A mp42isom....00000020h: 00 00 1C 65 6D 6F 6F 76 FF 00 00 6C 6D 76 68 64 ; ...emoovÿ..lmvhd[..]The Ringtone Massacre 143