=======

Product: ffmpeg
Affected Versions: <= 3.1.2
Vulnerability Type: Heap Overflow
Security Risk: High
Credit: Yaoguang Chen of Aliapy unLimit Security Team

Introduction
============



$ ffmpeg_debug_312/bin/ffmpeg -i tiled_with_deeptile_type.exr -y xx.png
ffmpeg version 3.1.2 Copyright (c) 2000-2016 the FFmpeg developers
  built with gcc 4.8 (Ubuntu 4.8.4-2ubuntu1~14.04.3)
  configuration: --prefix=/home/burningcodes/ffmpeg_debug_312/ --disable-yasm --assert-level=2 --enable-debug=3 --disable-optimizations --disable-asm --disable-stripping
  libavutil      55. 28.100 / 55. 28.100
  libavcodec     57. 48.101 / 57. 48.101
  libavformat    57. 41.100 / 57. 41.100
  libavdevice    57.  0.101 / 57.  0.101
  libavfilter     6. 47.100 /  6. 47.100
  libswscale      4.  1.100 /  4.  1.100
  libswresample   2.  1.100 /  2.  1.100
*** Error in `ffmpeg_debug_312/bin/ffmpeg': free(): invalid next size (normal): 0x00000000024a44c0 ***
Aborted (core dumped)


gdb backtrace:


$ gdb ffmpeg_debug_312/bin/ffmpeg /tmp/core.1471448229 -q
Reading symbols from ffmpeg_debug_312/bin/ffmpeg...done.
[New LWP 6771]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `ffmpeg_debug_312/bin/ffmpeg -i tiled_with_deeptile_type.exr -y xx.png'.
Program terminated with signal SIGABRT, Aborted.
#0  0x00007f100f696267 in __GI_raise (sig=sig@entry=0x6)
    at ../sysdeps/unix/sysv/linux/raise.c:55
55	../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
gdb-peda$ bt
#0  0x00007f100f696267 in __GI_raise (sig=sig@entry=0x6)
    at ../sysdeps/unix/sysv/linux/raise.c:55
#1  0x00007f100f697eca in __GI_abort () at abort.c:89
#2  0x00007f100f6d9c53 in __libc_message (do_abort=do_abort@entry=0x1, 
    fmt=fmt@entry=0x7f100f7f21a8 "*** Error in `%s': %s: 0x%s ***\n")
    at ../sysdeps/posix/libc_fatal.c:175
#3  0x00007f100f6e1c69 in malloc_printerr (ptr=<optimized out>, 
    str=0x7f100f7f2300 "free(): invalid next size (normal)", action=0x1)
    at malloc.c:4965
#4  _int_free (av=<optimized out>, p=<optimized out>, have_lock=0x0)
    at malloc.c:3834
#5  0x00007f100f6e589c in __GI___libc_free (mem=<optimized out>)
    at malloc.c:2950
#6  0x00000000013e3039 in av_free (ptr=0x24a44c0) at libavutil/mem.c:239
#7  0x00000000013d149c in av_buffer_default_free (opaque=0x0, 
    data=0x24a44c0 "\377\377\360j \241\377\377\377\377\020^")
    at libavutil/buffer.c:63
#8  0x00000000013d165d in buffer_replace (dst=0x7ffd71aa3180, src=0x0)
    at libavutil/buffer.c:119
#9  0x00000000013d169d in av_buffer_unref (buf=0x7ffd71aa3180)
    at libavutil/buffer.c:129
#10 0x00000000008184e6 in av_packet_unref (pkt=0x7ffd71aa3180)
    at libavcodec/avpacket.c:566
#11 0x000000000069e1bb in ff_img_read_packet (s1=0x248c2c0, pkt=0x7ffd71aa3180)
    at libavformat/img2dec.c:502
#12 0x00000000007a4dc1 in ff_read_packet (s=0x248c2c0, pkt=0x7ffd71aa3180)
    at libavformat/utils.c:759
#13 0x00000000007a7ef3 in read_frame_internal (s=0x248c2c0, pkt=0x7ffd71aa3460)
    at libavformat/utils.c:1457
#14 0x00000000007af3c4 in avformat_find_stream_info (ic=0x248c2c0, 
    options=0x248d110) at libavformat/utils.c:3475
#15 0x00000000004103f2 in open_input_file (o=0x7ffd71aa37b0, 
    filename=0x7ffd71aa41c6 "tiled_with_deeptile_type.exr")
    at ffmpeg_opt.c:1002
#16 0x0000000000419274 in open_files (l=0x248c058, inout=0x1413717 "input", 
    open_file=0x40fa95 <open_input_file>) at ffmpeg_opt.c:3036
#17 0x0000000000419401 in ffmpeg_parse_options (argc=0x5, argv=0x7ffd71aa3d98)
    at ffmpeg_opt.c:3073
#18 0x000000000042e8a6 in main (argc=0x5, argv=0x7ffd71aa3d98) at ffmpeg.c:4335
#19 0x00007f100f681a40 in __libc_start_main (main=0x42e7c6 <main>, argc=0x5, 
    argv=0x7ffd71aa3d98, init=<optimized out>, fini=<optimized out>, 
    rtld_fini=<optimized out>, stack_end=0x7ffd71aa3d88) at libc-start.c:289
#20 0x00000000004061c9 in _start ()