Project: libsndfile (libsndfile/libsndfile), language: c++
Vulnerability instance: libsndfile.cve-2018-13139
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/erikd/libsndfile/issues/397
## Description:
Issue: erikd/libsndfile#397
Title: stack-buffer-overflow in psf_memset in libsndfile-master/src/common.c:1229
State: closed
Created by: 92wyunchao
Created at: 2018-07-03 04:08:59+00:00

Issue Body:
stack-buffer-overflow in psf_memset in libsndfile-master/src/common.c:1229
[poc.zip](https://github.com/erikd/libsndfile/files/2157607/poc.zip)
./sndfile-deinterleave $poc

==118463==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffea52964d0 at pc 0x7f48893a3bec bp 0x7ffea520e2f0 sp 0x7ffea520da98
WRITE of size 3826900 at 0x7ffea52964d0 thread T0
    #0 0x7f48893a3beb in __asan_memset (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x8cbeb)
    #1 0x7f4888fc70bf in psf_memset /home/s2e/asan/libsndfile-master/src/common.c:1229
    #2 0x7f488901ed71 in sf_readf_int /home/s2e/asan/libsndfile-master/src/sndfile.c:1837
    #3 0x401e1c in deinterleave_int /home/s2e/asan/libsndfile-master/programs/sndfile-deinterleave.c:170
    #4 0x401c96 in main /home/s2e/asan/libsndfile-master/programs/sndfile-deinterleave.c:138
    #5 0x7f4888bed82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #6 0x4016c8 in _start (/home/s2e/asan/libsndfile-master/build/sndfile-deinterleave+0x4016c8)

Address 0x7ffea52964d0 is located in stack of thread T0 at offset 557296 in frame
    #0 0x4017a5 in main /home/s2e/asan/libsndfile-master/programs/sndfile-deinterleave.c:68



Comments:
Comment by fCorleone on 2018-07-05 08:28:02+00:00:
What's the exactly input you use to find this problem.

---

Comment by kirotawa on 2018-07-12 16:40:36+00:00:
This CVE was assigned to this issue: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13139 

Attachments:
https://github.com/erikd/libsndfile/files/2157607/poc.zip

Build script:
#!/bin/bash
# Default build script template for C/C++ projects
set -eu

# Define configuration options
CONFIG_OPTS="--disable-shared"
CMAKE_OPTS="-DCMAKE_BUILD_TYPE=Debug"
MAKE_OPTS="-j$(nproc)"
BUILD_DIR="build"

# 1. Run build preparation scripts if they exist
for prep_script in buildconf autogen.sh bootstrap; do
  if [ -x "$prep_script" ]; then
    echo "Running $prep_script..."
    ./$prep_script
    break
  elif [ -f "$prep_script" ]; then
    echo "Found $prep_script but it's not executable, setting permissions..."
    chmod +x $prep_script
    ./$prep_script
    break
  fi
done

# 2. Handle different build systems
if [ -f "configure" ]; then
  echo "Found configure script, running with options: $CONFIG_OPTS"
  ./configure $CONFIG_OPTS

  echo "Building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -f "CMakeLists.txt" ]; then
  echo "Found CMakeLists.txt, using CMake build system"
  mkdir -p $BUILD_DIR
  cd $BUILD_DIR
  cmake $CMAKE_OPTS ..
  make $MAKE_OPTS
elif [ -f "Makefile" ] || [ -f "makefile" ]; then
  echo "Found Makefile, building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -f "meson.build" ]; then
  echo "Found meson.build, using Meson build system"
  mkdir -p $BUILD_DIR
  meson setup $BUILD_DIR .
  cd $BUILD_DIR
  ninja
elif [ -f "GNUmakefile" ]; then
  echo "Found GNUmakefile, building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -d ".git" ] && [ -f "Makefile.am" ]; then
  echo "Found Makefile.am, running autoreconf"
  autoreconf -i
  ./configure $CONFIG_OPTS
  make $MAKE_OPTS
else
  echo "WARNING: No recognized build system found!"
  echo "Trying generic approach:"
  
  # Try to detect common source patterns and compile them
  if ls *.c >/dev/null 2>&1 || ls *.cpp >/dev/null 2>&1 || ls *.cc >/dev/null 2>&1; then
    echo "Found C/C++ source files, attempting direct compilation"
    if ls *.cpp >/dev/null 2>&1 || ls *.cc >/dev/null 2>&1; then
      CXX=${CXX:-g++}
      echo "Compiling C++ sources with $CXX"
      $CXX -g -O1 -fsanitize=address -fno-omit-frame-pointer -o main *.cpp *.cc 2>/dev/null || true
    elif ls *.c >/dev/null 2>&1; then
      CC=${CC:-gcc}
      echo "Compiling C sources with $CC"
      $CC -g -O1 -fsanitize=address -fno-omit-frame-pointer -o main *.c 2>/dev/null || true
    fi
  fi
fi

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN git clone https://github.com/libsndfile/libsndfile libsndfile
RUN git -C libsndfile checkout 1d928bffdb65e827c3e7d17ece0e123b4a70ec6c
WORKDIR $SRC/libsndfile
COPY build.sh $SRC/

Additional files: