Bug Hunter Diary

process ofFFmpeg(3)fourxm->tracks[current_track].adpcm =AV_RL32(&header[i + 12]);writableareaGOT: memalign()(1)4xm file(2)+ current_track+ offsetNULLFigure 4-8: Diagram of my exploitation of the FFmpeg bug4.3 Vulnerability RemediationTuesday, January 27, 2009After I told the FFmpeg maintainers about the bug, they developed thefollowing patch: 6--- a/libavformat/4xm.c+++ b/libavformat/4xm.c@@ -166,12 +166,13 @@ static int fourxm_read_header(AVFormatContext *s,goto fail;}current_track = AV_RL32(&header[i + 8]);+ if((unsigned)current_track >= UINT_MAX / sizeof(AudioTrack) - 1){+ av_log(s, AV_LOG_ERROR, "current_track too large\n");+ ret= -1;+ goto fail;+ }if (current_track + 1 > fourxm->track_count) {fourxm->track_count = current_track + 1;- if((unsigned)fourxm->track_count >= UINT_MAX / sizeof(AudioTrack)){- ret= -1;- goto fail;- }fourxm->tracks = av_realloc(fourxm->tracks,fourxm->track_count * sizeof(AudioTrack));if (!fourxm->tracks) {The patch applies a new length check that restricts the maximumvalue for current_track to 0x09249247.66 Chapter 4