Project: libtorrent (arvidn/libtorrent), language: c++
Vulnerability instance: libtorrent.cve-2016-7164
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/arvidn/libtorrent/issues/1021
## Description:
Issue: arvidn/libtorrent#1021
Title: "Segmentation fault" (possible DoS) when parsing compressed data with function "inflate_gzip"
State: closed
Created by: sz3n
Created at: 2016-08-21 12:56:33+00:00

Issue Body:
libtorrent version (or branch): 1.1.0.0

platform/architecture: Ubuntu 14.04LTS x86_64

compiler and compiler version: gcc version 4.8.4 (Ubuntu 4.8.4-2ubuntu1~14.04.3)

The issue was found with "afl fuzzer" while executing a modified version of the "test_gzip" testsuite with the following input data(displayed in base64 format):

```
H4sIAAjjYGJiWXWAAAAAYFlZWVlZWV34+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4AP4I
DAgLy5kMWQP/YmIA/wUAmQxZBf9iYgD/BQD/ALy8IAAAl5eXl5eXl5eXl5eXl5eXAABZWVlZWVlZ
Xfj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+PgA/ggMCAvLmQxZA/9iYgD/BQCZDFkF/2Ji
AP8FAP8AvLwgAACXl5eXl5eXl5eXl5eXl5cAAFlZWVlZWVlZAPoIDAgLy5kMWQX/YmIA/wUAWVlZ
WVlZWVlZAID//1lZWVlZWVkA+ggMCAvLmQxZBf9iYgD/BQBZWVlZWVlZWVkAgP//YmJiEARkQPZZ
WVlZWQwMDIsIAEQ=
```

A segmentation fault signal was captured while running:
`./test_gzip gzip_data`
The output from ASAN:

```
ASAN:SIGSEGV
=================================================================
==28954==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000048cb19 sp 0x7ffe24a458b0 bp 0x000000000000 T0)
    #0 0x48cb18 in construct(huffman*, short*, int) /home/user/libtorrent-rasterbar-1.1.0/src/puff.cpp:365
    #1 0x494c77 in dynamic /home/user/libtorrent-rasterbar-1.1.0/src/puff.cpp:693
    #2 0x494c77 in puff(unsigned char*, unsigned int*, unsigned char const*, unsigned int*) /home/user/libtorrent-rasterbar-1.1.0/src/puff.cpp:781
    #3 0x489f71 in libtorrent::inflate_gzip(char const*, int, std::vector<char, std::allocator<char> >&, int, boost::system::error_code&) /home/user/libtorrent-rasterbar-1.1.0/src/gzip.cpp:230
    #4 0x482aed in main /home/user/libtorrent-rasterbar-1.1.0/examples3/test_gzip.cpp:84
    #5 0x7f8f1ede1f44 (/lib/x86_64-linux-gnu/libc.so.6+0x21f44)
    #6 0x48025c in _start (/tmp/fuzz_gzip/test_gzip+0x48025c)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/user/libtorrent-rasterbar-1.1.0/src/puff.cpp:365 construct(huffman*, short*, int)
==28954==ABORTING
```

The issue seems to be located in the puff.cpp file inside the "construct" function.

To reproduce:
1.compile "test_gzip.cpp" (here attached)
2.copy the base64 encoded data to a file (ex. gzip_data.b64)
3.decode the file to a new file ("base64 -d gzip_data.b64 > gzip_data") 
3.run ./test_gzip gzip_data

[test_gzip.cpp.txt](https://github.com/arvidn/libtorrent/files/428833/test_gzip.cpp.txt)



Comments:
Comment by arvidn on 2016-08-21 14:54:03+00:00:
thanks for the report!


---

Comment by arvidn on 2016-08-21 22:50:21+00:00:
fix has been pushed to RC_1_1 and master


---

Comment by david-geiger on 2016-09-09 06:35:55+00:00:
Hi,

Is also this security issue valid for branch RC_1_0 ? and others ?

If yes is possible to have a patch to fix this issue in others branchs?


---

Comment by arvidn on 2016-09-12 04:24:57+00:00:
back-ported to RC_1_0 here: https://github.com/arvidn/libtorrent/commit/2d7d0128adafb7574d0e5a66390188cdfb8caad6


---

Comment by david-geiger on 2016-09-12 07:42:23+00:00:
Thank you very much! 


---

Comment by pmattern on 2016-09-14 09:54:39+00:00:
Wouldn't this warrant another point release of the 1.0.x series?


---

Comment by arvidn on 2016-09-14 15:29:57+00:00:
yeah, probably


Attachments:
https://github.com/arvidn/libtorrent/files/428833/test_gzip.cpp.txt

Commit References:
2d7d0128adafb7574d0e5a66390188cdfb8caad6

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
mkdir -p build
cd build
cmake -DBUILD_SHARED_LIBS=Off ..
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make wget libssl-dev libgeoip-dev pkg-config
RUN git clone https://github.com/arvidn/libtorrent libtorrent
RUN git -C libtorrent checkout 2921caf95e851a7918026dc159b1717ef5045f30
WORKDIR $SRC/libtorrent
COPY build.sh $SRC/

Additional files: