CVE-2015-8789: Other (NVD-CWE-Other)
value: Use-after-free vulnerability in the EbmlMaster::Read function in libEBML before 1.3.3 allows context-dependent attackers to have unspecified impact via a "deeply nested element with infinite size" followed by another element of an upper level in an EBML document.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 9.6
Published: 2016-01-29T19:59Z
Repository: https://github.com/Matroska-Org/libebml
Language: Other
Files changed: ChangeLog, src/EbmlMaster.cpp
Commit date: 2015-10-20 14:54:55 +0200
Commit message: EbmlMaster: propagate upper level element after infinite sized one correctly

When the parser encountered a deeply nested element with an infinite
size then a following element of an upper level was not propagated
correctly. Instead the element with the infinite size was added into the
EBML element tree a second time resulting in memory access after freeing
it and multiple attempts to free the same memory address during
destruction.

Fixes the issue reported as Cisco TALOS-CAN-0037.

Diff: diff --git a/ChangeLog b/ChangeLog
index 3fb53d4..154d3d9 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,7 +1,15 @@
 2015-10-20  Moritz Bunkus  <moritz@bunkus.org>
 
+        * EbmlMaster::Read(): When the parser encountered a deeply nested
+        element with an infinite size then a following element of an upper
+        level was not propagated correctly. Instead the element with the
+        infinite size was added into the EBML element tree a second time
+        resulting in memory access after freeing it and multiple attempts
+        to free the same memory address during destruction. Fixes the
+        issue reported as Cisco TALOS-CAN-0037.
+
         * EbmlElement::ReadCodedSizeValue(): Fixed an invalid memory
         access. When reading a EBML variable length integer value a read
         access beyond the end of the available buffer was possible if
         fewer bytes were available than indicated by the first byte
         resulting in a heap information leak.
diff --git a/src/EbmlMaster.cpp b/src/EbmlMaster.cpp
index 9f2d6b9..8537ac3 100644
--- a/src/EbmlMaster.cpp
+++ b/src/EbmlMaster.cpp
@@ -452,10 +452,18 @@ void EbmlMaster::Read(EbmlStream & inDataStream, const EbmlSemanticContext & sCo
           if (DeleteElement)
             delete ElementLevelA;
         } else {
           if (DeleteElement)
             delete ElementLevelA;
+
+          if (UpperEltFound) {
+            --UpperEltFound;
+            if (UpperEltFound > 0 || MaxSizeToRead <= 0)
+              goto processCrc;
+            ElementLevelA = FoundElt;
+          }
+
           break;
         }
       }
 
       if (UpperEltFound > 0) {

Fixed code:         * EbmlMaster::Read(): When the parser encountered a deeply nested
        element with an infinite size then a following element of an upper
        level was not propagated correctly. Instead the element with the
        infinite size was added into the EBML element tree a second time
        resulting in memory access after freeing it and multiple attempts
        to free the same memory address during destruction. Fixes the
        issue reported as Cisco TALOS-CAN-0037.


          if (UpperEltFound) {
            --UpperEltFound;
            if (UpperEltFound > 0 || MaxSizeToRead <= 0)
              goto processCrc;
            ElementLevelA = FoundElt;
          }