Exploit-DB #42546
Description: libgig 4.0.0 (LinuxSampler) - Multiple Vulnerabilities
Type: dos
Platform: linux
Date: 2017-08-23
Author: qflb.wu

Exploit:
================
Author : qflb.wu
===============


Introduction:
=============
https://www.linuxsampler.org/libgig/
libgig is a C++ library for loading, modifying existing and creating new Gigasampler (.gig) files and DLS (Downloadable Sounds) Level 1/2 files, KORG sample based instruments (.KSF and .KMP files), SoundFont v2 (.sf2) files and AKAI sampler data. 


Affected version:
=====
4.0.0


Vulnerability Description:
==========================
1.
the gig::Region::Region function in gig.cpp in libgig 4.0.0 can cause a denial of service(Null pointer dereference and application crash) via a crafted gig file.


./gigdump libgig_4.0.0_null_pointer_dereference_1.gig


----debug info:----
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7bc07df in gig::Region::Region (this=0x614ce0, 
    pInstrument=<optimized out>, rgnList=0x610230) at gig.cpp:2970
2970                    if (file->pWavePoolTable) pDimensionRegions[i]->pSample = GetSampleFromWavePool(wavepoolindex);
(gdb) bt
#0  0x00007ffff7bc07df in gig::Region::Region (this=0x614ce0, 
    pInstrument=<optimized out>, rgnList=0x610230) at gig.cpp:2970
#1  0x00007ffff7bc0b36 in gig::Instrument::Instrument (this=0x60ef80, 
    pFile=<optimized out>, insList=0x60eea0, pProgress=0x7fffffffdda0)
    at gig.cpp:4404
#2  0x00007ffff7bc103e in gig::File::LoadInstruments (this=0x609160, 
    pProgress=0x0) at gig.cpp:5576
#3  0x00007ffff7bbade6 in gig::File::GetFirstInstrument (
    this=this@entry=0x609160) at gig.cpp:5378
#4  0x[PII_REDACTED]40533b in PrintInstruments (gig=gig@entry=0x609160)
    at gigdump.cpp:205
#5  0x[PII_REDACTED]401f34 in main (argc=<optimized out>, argv=<optimized out>)
    at gigdump.cpp:79
(gdb) disassemble 0x00007ffff7bc07ca,0x00007ffff7bc07f0
Dump of assembler code from 0x7ffff7bc07ca to 0x7ffff7bc07f0:
   0x00007ffff7bc07ca <gig::Region::Region(gig::Instrument*, RIFF::List*)+666>:je     0x7ffff7bc07e3 <gig::Region::Region(gig::Instrument*, RIFF::List*)+691>
   0x00007ffff7bc07cc <gig::Region::Region(gig::Instrument*, RIFF::List*)+668>:xor    %edx,%edx
   0x00007ffff7bc07ce <gig::Region::Region(gig::Instrument*, RIFF::List*)+670>:mov    %eax,%esi
   0x00007ffff7bc07d0 <gig::Region::Region(gig::Instrument*, RIFF::List*)+672>:mov    %rbx,%rdi
   0x00007ffff7bc07d3 <gig::Region::Region(gig::Instrument*, RIFF::List*)+675>:mov    0x138(%r13),%r14
   0x00007ffff7bc07da <gig::Region::Region(gig::Instrument*, RIFF::List*)+682>:callq  0x7ffff7b9ede0 <_ZN3gig6Region21GetSampleFromWavePoolEjPN4RIFF10progress_tE@plt>
=> 0x00007ffff7bc07df <gig::Region::Region(gig::Instrument*, RIFF::List*)+687>:mov    %rax,0x38(%r14)
   0x00007ffff7bc07e3 <gig::Region::Region(gig::Instrument*, RIFF::List*)+691>:add    $0x1,%ebp
   0x00007ffff7bc07e6 <gig::Region::Region(gig::Instrument*, RIFF::List*)+694>:add    $0x8,%r13
   0x00007ffff7bc07ea <gig::Region::Region(gig::Instrument*, RIFF::List*)+698>:cmp    %ebp,0x130(%rbx)
End of assembler dump.
(gdb) i r
rax            0x60ca906343312
rbx            0x614ce06376672
rcx            0x33
rdx            0x60a[PII_REDACTED]
rsi            0x00
rdi            0x[PII_REDACTED]672
rbp            0x00x0
rsp            0x7fffffffdcc00x7fffffffdcc0
r8             0x00
r9             0x22
r10            0x00
r11            0x246582
r12            0x[PII_REDACTED]856
r13            0x614ce06376672
r14            0x00
r15            0x00
rip            0x7ffff7bc07df0x7ffff7bc07df <gig::Region::Region(gig::Instrument*, RIFF::List*)+687>
eflags         0x10246[ PF ZF IF RF ]
cs             0x3351
ss             0x2b43
ds             0x00
es             0x00
---Type <return> to continue, or q <return> to quit---
fs             0x00
gs             0x00
(gdb) 


ASAN:SIGSEGV
=================================================================
==40516== ERROR: AddressSanitizer: SEGV on unknown address 0x[PII_REDACTED]38 (pc 0x7f4f87126260 sp 0x7ffd0b22ec80 bp 0x600e0000c3b0 T0)
AddressSanitizer can not provide additional info.
    #0 0x7f4f8712625f in gig::Region::Region(gig::Instrument*, RIFF::List*) /home/a/Documents/libgig-4.0.0/src/gig.cpp:2970
    #1 0x7f4f87127f4a in gig::Instrument::Instrument(gig::File*, RIFF::List*, RIFF::progress_t*) /home/a/Documents/libgig-4.0.0/src/gig.cpp:4404
    #2 0x7f4f87129fdc in gig::File::LoadInstruments(RIFF::progress_t*) /home/a/Documents/libgig-4.0.0/src/gig.cpp:5576
    #3 0x7f4f870fb6a0 in gig::File::GetFirstInstrument() /home/a/Documents/libgig-4.0.0/src/gig.cpp:5378
    #4 0x40fca6 in PrintInstruments(gig::File*) /home/a/Documents/libgig-4.0.0/src/tools/gigdump.cpp:205
    #5 0x4027aa in main /home/a/Documents/libgig-4.0.0/src/tools/gigdump.cpp:79
    #6 0x7f4f86749ec4 (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)
    #7 0x402e5c in _start (/home/a/Documents/libgig-4.0.0/src/tools/.libs/gigdump+0x402e5c)
SUMMARY: AddressSanitizer: SEGV /home/a/Documents/libgig-4.0.0/src/gig.cpp:2970 gig::Region::Region(gig::Instrument*, RIFF::List*)
==40516== ABORTING


POC:
libgig_4.0.0_null_pointer_dereference_1.gig
CVE:
CVE-2017-12950


2.
the gig::DimensionRegion::CreateVelocityTable function in gig.cpp in libgig 4.0.0 can cause a denial of service(stack buffer overflow and application crash) via a crafted gig file.


./gigdump libgig_4.0.0_stack_buffer_overflow.gig


----debug info:----
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7bb8b44 in gig::DimensionRegion::CreateVelocityTable (
    this=<optimized out>, curveType=<optimized out>, depth=<optimized out>, 
    scaling=<optimized out>) at gig.cpp:2884
2884        table[0] = 0;
(gdb) bt
#0  0x00007ffff7bb8b44 in gig::DimensionRegion::CreateVelocityTable (
    this=<optimized out>, curveType=<optimized out>, depth=<optimized out>, 
    scaling=<optimized out>) at gig.cpp:2884
#1  0x00007ffff7bbf535 in gig::DimensionRegion::GetVelocityTable (
    this=<optimized out>, curveType=<optimized out>, depth=<op