CVE-2021-26567 (published 2021-02-26T22:15Z)

Stack-based buffer overflow vulnerability in frontend/main.c in faad2 before 2.2.7.1 allow local attackers to execute arbitrary code via filename and pathname options.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/knik0/faad2
commit_details: repo_url: https://github.com/knik0/faad2
author: knik
author_date: 2012-03-04 09:59:02+00:00
msg: Dynamically allocate file name buffers.
repository: repo_url: https://github.com/knik0/faad2
repo_name: knik0/faad2
description: Freeware Advanced Audio (AAC) Decoder faad2 mirror
repo_language: C
owner: knik0
file_changes: filename: main.c
change_type: ModificationType.MODIFY
diff: @@ -25,7 +25,7 @@
 ** Commercial non-GPL licensing of this software is possible.
 ** For more info contact Nero AG through Mpeg4AAClicense@nero.com.
 **
-** $Id: main.c,v 1.87 2012/03/02 15:28:44 knik Exp $
+** $Id: main.c,v 1.88 2012/03/04 09:59:02 knik Exp $
 **/
 
 #ifdef _WIN32
@@ -1109,9 +1109,9 @@ int main(int argc, char *argv[])
     int mp4file = 0;
     int noGapless = 0;
     char *fnp;
-    char aacFileName[255];
-    char audioFileName[255];
-    char adtsFileName[255];
+    char *aacFileName = NULL;
+    char *audioFileName = NULL;
+    char *adtsFileName = NULL;
     unsigned char header[8];
     float length = 0;
     FILE *hMP4File;
@@ -1159,6 +1159,12 @@ int main(int argc, char *argv[])
             if (optarg)
             {
                 outfile_set = 1;
+                audioFileName = (char *) malloc(sizeof(char) * (strlen(optarg) + 1));
+                if (audioFileName == NULL)
+                {
+                    faad_fprintf(stderr, "Error allocating memory for audioFileName.\n");
+                    return 1;
+                }
                 strcpy(audioFileName, optarg);
             }
             break;
@@ -1166,6 +1172,12 @@ int main(int argc, char *argv[])
             if (optarg)
             {
                 adts_out = 1;
+                adtsFileName = (char *) malloc(sizeof(char) * (strlen(optarg) + 1));
+                if (adtsFileName == NULL)
+                {
+                    faad_fprintf(stderr, "Error allocating memory for adtsFileName.\n");
+                    return 1;
+                }
                 strcpy(adtsFileName, optarg);
             }
             break;
@@ -1286,6 +1298,12 @@ int main(int argc, char *argv[])
 #endif
 
     /* point to the specified file name */
+    aacFileName = (char *) malloc(sizeof(char) * (strlen(argv[optind]) + 1));
+    if (aacFileName == NULL)
+    {
+        faad_fprintf(stderr, "Error allocating memory for aacFileName.\n");
+        return 1;
+    }
     strcpy(aacFileName, argv[optind]);
 
 #ifdef _WIN32
@@ -1299,6 +1317,12 @@ int main(int argc, char *argv[])
      */
     if(!writeToStdio && !outfile_set)
     {
+        audioFileName = (char *) malloc(sizeof(char) * (strlen(aacFileName) + strlen(file_ext[format]) + 1));
+        if (audioFileName == NULL)
+        {
+            faad_fprintf(stderr, "Error allocating memory for audioFileName.\n");
+            return 1;
+        }
         strcpy(audioFileName, aacFileName);
 
         fnp = (char *)strrchr(audioFileName,'.');
@@ -1359,6 +1383,11 @@ int main(int argc, char *argv[])
             old_format, &length);
     }
 
+    if (audioFileName != NULL)
+      free (audioFileName);
+    if (adtsFileName != NULL)
+      free (adtsFileName);
+
     if (!result && !infoOnly)
     {
 #ifdef _WIN32
@@ -1374,5 +1403,8 @@ int main(int argc, char *argv[])
             dec_length, length/dec_length);
     }
 
+    if (aacFileName != NULL)
+      free (aacFileName);
+
     return 0;
 }

programming_language: C