Desctiption
When I used the function to handle a specific input. Program received signal SIGSEGV, Segmentation fault. in FLVTag_getPayloadInput at flv.c:227
|
input = FLVTag_getPayloadInput(tag); |
|
input = tag->stream->input; |
The primary cause is that the parameter in FLVTag_getPayloadInput is corrupted and not be checked. Specifically, tag->stream points to an inaccessible address, leading to a segmentation fault.
Test Environment
Ubuntu 22.04.1, 64bit
libming(v0.4.8 master 04aee52)
program source file
How to trigger
Download the poc file , program and run the following cmd:
$ export LD_LIBRARY_PATH=/path_to_libming/libming/src/.libs:$LD_LIBRARY_PATH
$ ./setScreenStreamDimension ./poc
Detail
GDB report
(gdb) r
Starting program: /home/ambrose/vsproject/HIMFuzz/harness/output/libming_deepseek24/crashes/videostream.c/setStreamProperties/setScreenStreamDimension/setScreenStreamDimension output/default/crashes/id:000000,sig:11,src:000000,time:499,execs:77,op:havoc,rep:15
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7f8f28b in FLVTag_getPayloadInput (tag=0x7bfff5909020) at flv.c:227
227 input = tag->stream->input;
(gdb) bt
#0 0x00007ffff7f8f28b in FLVTag_getPayloadInput (tag=0x7bfff5909020) at flv.c:227
#1 0x000055555567330b in setScreenStreamDimension (stream=0x7cdff6c20040, tag=0x7bfff5909020)
at /home/ambrose/vsproject/TestLib/libming/src/blocks/videostream.c:275
#2 0x000055555567313d in main (argc=2, argv=0x7fffffffda38)
at output/libming_deepseek24/harness/code/videostream.c/setStreamProperties/setScreenStreamDimension.c:46
(gdb) p tag
$1 = (FLVTag *) 0x7bfff5909020
(gdb) p tag->stream->input
Cannot access memory at address 0x101010101ff0ff0
Desctiption
When I used the function to handle a specific input. Program received signal SIGSEGV, Segmentation fault. in FLVTag_getPayloadInput at flv.c:227
libming/src/blocks/videostream.c
Line 275 in 04aee52
libming/src/blocks/flv.c
Line 227 in 04aee52
The primary cause is that the parameter in FLVTag_getPayloadInput is corrupted and not be checked. Specifically, tag->stream points to an inaccessible address, leading to a segmentation fault.
Test Environment
Ubuntu 22.04.1, 64bit
libming(v0.4.8 master 04aee52)
program source file
How to trigger
Download the poc file , program and run the following cmd:
Detail
GDB report