From: Anthony Hurtado <[redacted since hn has no scrape protection]>
vpk_read_packet() divides vpk->last_block_size and (par->block_align - vpk->last_block_size) by par->ch_layout.nb_channels without checking for zero.
While vpk_read_header() validates nb_channels > 0, the codec parameters may become zero through format probing misidentification (VPK probe score is 2/3 of AVPROBE_SCORE_MAX) or codec parameter reset, causing SIGFPE.
Fix by:
- Checking nb_channels != 0 before division in vpk_read_packet
- Returning EOF for empty last blocks (last_block_size == 0)
- Validating block_count > 0 in vpk_read_header
- Validating last_block_size <= block_align in vpk_read_header
Found by fuzzing with libFuzzer + AddressSanitizer. Reproduces with
10 distinct inputs.
Thank you! I gave up after more than 2 whole minutes of waiting on a high-end smartphone. I'm not sure this keeps bots out, but it definitely keeps users out…
Damn, I've never seen Anubis set up that aggressively, I wonder what kind of attack their web servers must be under to set their bot filters up this strictly.
- - -
From: Anthony Hurtado <[redacted since hn has no scrape protection]>
vpk_read_packet() divides vpk->last_block_size and (par->block_align - vpk->last_block_size) by par->ch_layout.nb_channels without checking for zero.
While vpk_read_header() validates nb_channels > 0, the codec parameters may become zero through format probing misidentification (VPK probe score is 2/3 of AVPROBE_SCORE_MAX) or codec parameter reset, causing SIGFPE.
Fix by:
- Checking nb_channels != 0 before division in vpk_read_packet
- Returning EOF for empty last blocks (last_block_size == 0)
- Validating block_count > 0 in vpk_read_header
- Validating last_block_size <= block_align in vpk_read_header
Found by fuzzing with libFuzzer + AddressSanitizer. Reproduces with 10 distinct inputs.
[patch redacted for brevity]