Bug Hunter Diary

1851 stream_Read( p_demux->s, NULL, p_sys->i_stuff_cnt);1852 p_sys->i_stuff_cnt = 0;1853 }18541855 /* read the TY packet header */1856 i_readSize = stream_Peek( p_demux->s, &p_peek, 4 );1857 p_sys->i_cur_chunk++;18581859 if ( (i_readSize < 4) || ( U32_AT(&p_peek[ 0 ] ) == 0 ))1860 {1861 /* EOF */1862 p_sys->eof = 1;1863 return 0;1864 }18651866 /* check if it's a PART Header */1867 if( U32_AT( &p_peek[ 0 ] ) == TIVO_PES_FILEID )1868 {1869 /* parse master chunk */1870 parse_master(p_demux);1871 return get_chunk_header(p_demux);1872 }[..]In line 1856 of get_chunk_header(), the user-controlled datafrom the TiVo file is assigned to the pointer p_peek. Then, in line 1867,the process checks whether the file data pointed to by p_peek equalsTIVO_PES_FILEID (which is defined as 0xf5467abd in line 112). If so, thevulnerable function parse_master() gets called (see line 1870).To reach the vulnerable function using this code path, the TiVosample file had to contain the value of TIVO_PES_FILEID. I searched theTiVo sample file for the TIVO_PES_FILEID pattern and found it at fileoffset 0x00300000 (see Figure 2-3).00300000h: F5 46 7A BD 00 00 00 02 00 02 00 00 00 01 F7 04 ; õFz½..........÷.00300010h: 00 00 00 08 00 00 00 02 3B 9A CA 00 00 00 01 48 ; ........;šÊ....HFigure 2-3: TIVO_PES_FILEID pattern in TiVo sample fileBased on the information from the parse_master() function (seethe following source code snippet) the value of i_map_size should befound at offset 20 (0x14) relative to the TIVO_PES_FILEID pattern foundat file offset 0x00300000.[..]1641 stream_Read(p_demux->s, mst_buf, 32);1642 i_map_size = U32_AT(&mst_buf[20]); /* size of bitmask, in bytes */[..]At this point, I had discovered that the TiVo sample file I downloadedalready triggers the vulnerable parse_master() function, so itwouldn’t be necessary to adjust the sample file. Great!Back to the ’90s 15