Bug Hunter Diary

linux$ gdb -q ./ffmpeg_g(gdb) run -i poc2.4xmStarting program: /home/tk/BHD/ffmpeg/ffmpeg_g -i poc2.4xmFFmpeg version SVN-r16556, Copyright (c) 2000-2009 Fabrice Bellard, et al.configuration:libavutil 49.12. 0 / 49.12. 0libavcodec 52.10. 0 / 52.10. 0libavformat 52.23. 1 / 52.23. 1libavdevice 52. 1. 0 / 52. 1. 0built on Jan 24 2009 02:30:50, gcc: 4.3.3Program received signal SIGSEGV, Segmentation fault.0xbbbbbbbb in ?? ()(gdb) info registerseax 0xbfc1ddd0 -1077813808ecx 0x9f69400 167154688edx 0x9f60330 167117616ebx 0x0 0esp 0xbfc1ddac 0xbfc1ddacebp 0x85601f4 0x85601f4esi 0x164 356edi 0x9f60330 167117616eip 0xbbbbbbbb 0xbbbbbbbbeflags 0x10293 [ CF AF SF IF RF ]cs 0x73 115ss 0x7b 123ds 0x7b 123es 0x7b 123fs 0x0 0gs 0x33 51Bingo! Full control over EIP. After I gained control over the instructionpointer, I developed an exploit for the vulnerability. I used theVLC media player as an injection vector, because it uses the vulnerableversion of FFmpeg.As I’ve said in previous chapters, the laws in Germany do not allowme to provide a full working exploit, but you can watch a short video Irecorded that shows the exploit in action on the book’s website. 5Figure 4-8 summarizes the steps I used to exploit the vulnerability.Here is the anatomy of the bug shown in this figure:1. The destination address for the memory write is calculated whileusing current_track as an index (NULL + current_track + offset). Thevalue of current_track derives from user-controlled data of the4xm media file.2. The source data of the memory write derives from user-controlleddata of the media file.3. The user-controlled data is copied at the memory location of thememalign() GOT entry.NULL Pointer FTW 65