Changes between Version 2 and Version 3 of zzuf/bugs


Ignore:
Timestamp:
07/09/2008 12:28:28 PM (18 years ago)
Author:
Sam Hocevar
Comment:

switched tables to wiki formatting

Legend:

Unmodified
Added
Removed
Modified

  • zzuf/bugs

    v2 v3  
    77'''Disclaimer 2''': segmentation faults reported below are not necessarily bugs in the program itself; for instance, the MPEG-2 crashes are more likely due to a bug in the libmpeg2 library.
    88
    9 {{{
    10 #!html
    11 <table style="border: solid black 1px; background: white;">
    12   <tr style="background-color: #99f;">
    13     <td></td>
    14     <td>VLC</td>
    15     <td>MPlayer</td>
    16     <td>xine</td>
    17     <td>FFmpeg (ffplay)</td>
    18     <td>GStreamer (gst-launch)</td>
    19     <td>mpg321</td>
    20     <td>ogg123</td>
    21   </tr>
    22   <tr style="background-color: #ddf;">
    23     <td style="background-color: #99f;">MP3</td>
    24     <td style="background: #cfa;">robust</td>
    25     <td style="background: #fca;"><b><tt><a href="/files/zzuf/bugs/lol-mplayer.mp3">SIGSEGV</a></tt></b></td>
    26     <td style="background: #cfa;">robust</td>
    27     <td style="background: #cfa;">robust</td>
    28     <td style="background: #cfa;">robust</td>
    29     <td style="background: #cfa;">robust</td>
    30     <td>N/A</td>
    31   </tr>
    32   <tr style="background-color: #ddf;">
    33     <td style="background-color: #99f;">Ogg Vorbis</td>
    34     <td style="background: #cfa;">robust</td>
    35     <td style="background: #fca;"><b><tt><a href="/files/zzuf/bugs/lol-mplayer.ogg">SIGSEGV</a></tt></b></td>
    36     <td style="background: #cfa;">robust</td>
    37     <td style="background: #fca;"><b><tt><a href="/files/zzuf/bugs/lol-ffplay.ogg">SIGSEGV</a></tt></b></td>
    38     <td style="background: #fca;"><b><tt><a href="/files/zzuf/bugs/lol-gstreamer.ogg">SIGSEGV</a></tt></b></td>
    39     <td>N/A</td>
    40     <td style="background: #cfa;">robust</td>
    41   </tr>
    42   <tr style="background-color: #ddf;">
    43     <td style="background-color: #99f;">MPEG-1</td>
    44     <td style="background: #fca;"><b><tt><a href="/files/zzuf/bugs/lol-vlc.mpg">SIGSEGV</a></tt></b></td>
    45     <td style="background: #fca;"><b><tt><a href="/files/zzuf/bugs/lol-mplayer.mpg">SIGSEGV</a></tt></b></td>
    46     <td style="background: #fca;"><b><tt><a href="/files/zzuf/bugs/lol-xine.mpg">SIGSEGV</a></tt></b></td>
    47     <td style="background: #fca;"><b><tt><a href="/files/zzuf/bugs/lol-ffplay.mpg">SIGSEGV</a></tt></b></td>
    48     <td style="background: #cfa;">robust</td>
    49     <td>N/A</td>
    50     <td>N/A</td>
    51   </tr>
    52   <tr style="background-color: #ddf;">
    53     <td style="background-color: #99f;">MPEG-2</td>
    54     <td style="background: #fca;"><b><tt><a href="/files/zzuf/bugs/lol-vlc.m2v">SIGSEGV</a></tt></b></td>
    55     <td style="background: #fca;"><b><tt><a href="/files/zzuf/bugs/lol-mplayer.m2v">SIGSEGV</a></tt></b></td>
    56     <td style="background: #cfa;">robust</td>
    57     <td style="background: #fca;"><b><tt><a href="/files/zzuf/bugs/lol-ffplay.m2v">SIGSEGV</a></tt></b></td>
    58     <td style="background: #fca;"><b><tt><a href="/files/zzuf/bugs/lol-gstreamer.m2v">SIGSEGV</a></tt></b></td>
    59     <td>N/A</td>
    60     <td>N/A</td>
    61   </tr>
    62   <tr style="background-color: #ddf;">
    63     <td style="background-color: #99f;">MPEG-4 AVI</td>
    64     <td style="background: #fca;"><b><tt><a href="/files/zzuf/bugs/lol-vlc.avi">SIGSEGV</a></tt></b></td>
    65     <td style="background: #fca;"><b><tt><a href="/files/zzuf/bugs/lol-mplayer.avi">SIGSEGV</a></tt></b></td>
    66     <td style="background: #fca;"><b><tt><a href="/files/zzuf/bugs/lol-xine.avi">SIGSEGV</a></tt></b></td>
    67     <td style="background: #fca;"><b><tt><a href="/files/zzuf/bugs/lol-ffplay.avi">SIGSEGV</a></tt></b></td>
    68     <td style="background: #fca;"><a href="/files/zzuf/bugs/lol-gstreamer.avi">deadlock?</a></td>
    69     <td>N/A</td>
    70     <td>N/A</td>
    71   </tr>
    72   <tr style="background-color: #ddf;">
    73     <td style="background-color: #99f;">FLAC</td>
    74     <td style="background: #cfa;">robust</td>
    75     <td style="background: #fca;"><b><tt><a href="/files/zzuf/bugs/lol-mplayer.flac">SIGSEGV</a></tt></b></td>
    76     <td style="background: #cfa;">robust</td>
    77     <td style="background: #fca;"><a href="/files/zzuf/bugs/lol-ffplay.flac">heap corruption</a></td>
    78     <td style="background: #cfa;">robust</td>
    79     <td>N/A</td>
    80     <td style="background: #fca;"><b><tt><a href="/files/zzuf/bugs/lol-ogg123.flac">SIGFPE</a></tt></b></td>
    81   </tr>
    82   <tr style="background-color: #ddf;">
    83     <td style="background-color: #99f;">Ogg Theora</td>
    84     <td style="background: #cfa;">robust</td>
    85     <td style="background: #fca;"><b><tt><a href="/files/zzuf/bugs/lol-mplayer.ogm">SIGSEGV</a></tt></b></td>
    86     <td style="background: #cfa;">robust</td>
    87     <td style="background: #fca;"><b><tt><a href="/files/zzuf/bugs/lol-ffplay.ogm">SIGSEGV</a></tt></b></td>
    88     <td style="background: #cfa;">robust</td>
    89     <td>N/A</td>
    90     <td>N/A</td>
    91   </tr>
    92   <tr style="background-color: #ddf;">
    93     <td style="background-color: #99f;">WMV</td>
    94     <td style="background: #fca;"><b><tt><a href="/files/zzuf/bugs/lol-vlc.wmv">SIGSEGV</a></tt></b></td>
    95     <td style="background: #fca;"><b><tt><a href="/files/zzuf/bugs/lol-mplayer.wmv">SIGSEGV</a></tt></b></td>
    96     <td>N/A</td>
    97     <td style="background: #fca;"><b><tt><a href="/files/zzuf/bugs/lol-ffplay.wmv">SIGSEGV</a></tt></b></td>
    98     <td style="background: #cfa;">robust</td>
    99     <td>N/A</td>
    100     <td>N/A</td>
    101   </tr>
    102   <tr style="background-color: #ddf;">
    103     <td style="background-color: #99f;">AAC</td>
    104     <td style="background: #fca;"><a href="/files/zzuf/bugs/lol-vlc.aac">heap corruption</a></td>
    105     <td style="background: #fca;"><b><tt><a href="/files/zzuf/bugs/lol-mplayer.aac">SIGSEGV</a></tt></b></td>
    106     <td style="background: #fca;"><b><tt><a href="/files/zzuf/bugs/lol-xine.aac">SIGSEGV</a></tt></b></td>
    107     <td>N/A</td>
    108     <td>N/A</td>
    109     <td>N/A</td>
    110     <td>N/A</td>
    111   </tr>
    112   <tr style="background-color: #ddf;">
    113     <td style="background-color: #99f;">AC-3/A52</td>
    114     <td style="background: #fca;"><b><tt><a href="/files/zzuf/bugs/lol-vlc.ac3">SIGSEGV</a></tt></b></td>
    115     <td style="background: #cfa;">robust</td>
    116     <td style="background: #cfa;">robust</td>
    117     <td style="background: #fca;"><b><tt><a href="/files/zzuf/bugs/lol-ffplay.ac3">SIGSEGV</a></tt></b></td>
    118     <td>N/A</td>
    119     <td>N/A</td>
    120     <td>N/A</td>
    121   </tr>
    122   <tr style="background-color: #ddf;">
    123     <td style="background-color: #99f;">Speex</td>
    124     <td style="background: #cfa;">robust</td>
    125     <td style="background: #cfa;">robust</td>
    126     <td style="background: #cfa;">robust</td>
    127     <td>N/A</td>
    128     <td style="background: #cfa;">robust</td>
    129     <td>N/A</td>
    130     <td style="background: #cfa;">robust</td>
    131   </tr>
    132 </table>
    133 }}}
     9|| || '''VLC''' || '''MPlayer''' || '''xine''' || '''FFmpeg (ffplay)''' || '''GStreamer (gst-launch)''' || '''mpg321''' || '''ogg123''' ||
     10|| '''MP3''' || robust || '''[/files/zzuf/bugs/lol-mplayer.mp3 SIGSEGV]''' || robust || robust || robust || robust || N/A ||
     11|| '''Ogg Vorbis''' || robust || '''[/files/zzuf/bugs/lol-mplayer.ogg SIGSEGV]''' || robust || '''[/files/zzuf/bugs/lol-ffplay.ogg SIGSEGV]''' || '''[/files/zzuf/bugs/lol-gstreamer.ogg SIGSEGV]''' || N/A || robust ||
     12|| '''MPEG-1''' || '''[/files/zzuf/bugs/lol-vlc.mpg SIGSEGV]''' || '''[/files/zzuf/bugs/lol-mplayer.mpg SIGSEGV]''' || '''[/files/zzuf/bugs/lol-xine.mpg SIGSEGV]''' || '''[/files/zzuf/bugs/lol-ffplay.mpg SIGSEGV]''' || robust || N/A || N/A ||
     13|| '''MPEG-2''' || '''[/files/zzuf/bugs/lol-vlc.m2v SIGSEGV]''' || '''[/files/zzuf/bugs/lol-mplayer.m2v SIGSEGV]''' || robust || '''[/files/zzuf/bugs/lol-ffplay.m2v SIGSEGV]''' || '''[/files/zzuf/bugs/lol-gstreamer.m2v SIGSEGV]''' || N/A || N/A ||
     14|| '''MPEG-4 AVI''' || '''[/files/zzuf/bugs/lol-vlc.avi SIGSEGV]''' || '''[/files/zzuf/bugs/lol-mplayer.avi SIGSEGV]''' || '''[/files/zzuf/bugs/lol-xine.avi SIGSEGV]''' || '''[/files/zzuf/bugs/lol-ffplay.avi SIGSEGV]''' || '''[/files/zzuf/bugs/lol-gstreamer.avi deadlock?]''' || N/A || N/A ||
     15|| '''FLAC''' || robust || '''[/files/zzuf/bugs/lol-mplayer.flac SIGSEGV]''' || robust || '''[/files/zzuf/bugs/lol-ffplay.flac heap corruption]''' || robust || N/A || '''[/files/zzuf/bugs/lol-ogg123.flac SIGFPE]''' ||
     16|| '''Ogg Theora''' || robust || '''[/files/zzuf/bugs/lol-mplayer.ogm SIGSEGV]''' || robust || '''[/files/zzuf/bugs/lol-ffplay.ogm SIGSEGV]''' || robust || N/A || N/A ||
     17|| '''WMV''' || '''[/files/zzuf/bugs/lol-vlc.wmv SIGSEGV]''' || '''[/files/zzuf/bugs/lol-mplayer.wmv SIGSEGV]''' || N/A || '''[/files/zzuf/bugs/lol-ffplay.wmv SIGSEGV]''' || robust || N/A || N/A ||
     18|| '''AAC''' || '''[/files/zzuf/bugs/lol-vlc.aac heap corruption]''' || '''[/files/zzuf/bugs/lol-mplayer.aac SIGSEGV]''' || '''[/files/zzuf/bugs/lol-xine.aac SIGSEGV]''' || N/A || N/A || N/A || N/A ||
     19|| '''AC-3/A52''' || '''[/files/zzuf/bugs/lol-vlc.ac3 SIGSEGV]''' || robust (I KID YOU NOT) || robust || '''[/files/zzuf/bugs/lol-ffplay.ac3 SIGSEGV]''' || N/A || N/A || N/A ||
     20|| '''Speex''' || robust || robust || robust || N/A || robust || N/A || robust ||
    13421
    13522== Other bugs ==
    … …  
    13724Here is a list of other bugs that were easily found using zzuf, each time in a matter of seconds.
    13825
    139 {{{
    140 #!html
    141 <table style="border: solid black 1px; background: white;">
    142   <tr style="background-color: #99f;"><td colspan="3"><b>OpenBSD</b> (OpenBSD xxxxxxx.xxx 4.0 GENERIC#1107 i386)</td></tr>
    143   <tr style="background-color: #ddf;">
    144       <td><tt><b>nm <a href="/files/zzuf/bugs/lol-openbsd-nm">lol-openbsd-nm</a></b></tt></td>
    145       <td>SIGSEGV</td>
    146       <td>crash in <tt>strcmp()</tt>, not exploitable</td>
    147   </tr>
    148   <tr style="background-color: #ddf;">
    149       <td><tt><b>objdump -T <a href="/files/zzuf/bugs/lol-openbsd-objdump">lol-openbsd-objdump</a></b></tt></td>
    150       <td>SIGSEGV</td>
    151       <td>?</td>
    152   </tr>
    153   <tr style="background-color: #99f;"><td colspan="3"><b>Linux</b> (Debian 4.0 i386 unstable)</td></tr>
    154   <tr style="background-color: #ddf;">
    155       <td><tt><b>nm <a href="/files/zzuf/bugs/lol-debian-nm">lol-debian-nm</a></b></tt></td>
    156       <td>SIGKILL</td>
    157       <td>memory usage exceeded</td>
    158   </tr>
    159   <tr style="background-color: #ddf;">
    160       <td><tt><b>identify <a href="/files/zzuf/bugs/fuzz1.xpm">fuzz1.xpm</a>
    161           <a href="/files/zzuf/bugs/fuzz2.xpm">fuzz2.xpm</a>
    162           <a href="/files/zzuf/bugs/fuzz3.xpm">fuzz3.xpm</a></b></tt></td>
    163       <td>SIGSEGV</td>
    164       <td>Memory corruption in ImageMagick. Security implications look promising.</td>
    165   </tr>
    166   <tr style="background-color: #ddf;">
    167       <td><tt><b>antiword <a href="/files/zzuf/bugs/lol-antiword.doc">lol-antiword.doc</a></b></tt></td>
    168       <td>SIGSEGV</td>
    169       <td>?</td>
    170   </tr>
    171   <tr style="background-color: #ddf;">
    172       <td><tt><b>firefox <a href="/files/zzuf/bugs/lol-firefox.gif">lol-firefox.gif</a></b></tt></td>
    173       <td>BadAlloc</td>
    174       <td>X11 error</td>
    175   </tr>
    176   <tr style="background-color: #ddf;">
    177       <td><tt><b>dvipng <a href="/files/zzuf/bugs/lol-dvipng.dvi">lol-dvipng.dvi</a></b></tt></td>
    178       <td>SIGSEGV</td>
    179       <td>Also occurs with <tt>dvi2ps</tt></td>
    180   </tr>
    181   <tr style="background-color: #ddf;">
    182       <td><tt><b>giftopnm <a href="/files/zzuf/bugs/lol-giftopnm.gif">lol-giftopnm.gif</a></b></tt></td>
    183       <td>SIGSEGV</td>
    184       <td>?</td>
    185   </tr>
    186   <tr style="background-color: #99f;"><td colspan="3"><b>FreeBSD</b> (FreeBSD xxxxxxx.xxx 6.1-RELEASE FreeBSD 6.1-RELEASE #0: Sun May  7 04:32:43 UTC 2006     root@opus.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC  i386)</td></tr>
    187   <tr style="background-color: #ddf;">
    188       <td><tt><b>nm <a href="/files/zzuf/bugs/lol-freebsd-nm">lol-freebsd-nm</a></b></tt></td>
    189       <td>SIGSEGV</td>
    190       <td>?</td>
    191   </tr>
    192   <tr style="background-color: #99f;"><td colspan="3"><b>Mac OS X</b> (Darwin xxxxxxx.xxx 8.3.1 Darwin Kernel Version 8.3.1: Wed Nov  2 21:12:54 PST 2005; root:xnu-792.7.56.obj~6/RELEASE_I386 i386 i386)</td></tr>
    193   <tr style="background-color: #ddf;">
    194       <td><tt><b>nm <a href="/files/zzuf/bugs/lol-macosx-nm">lol-macosx-nm</a></b></tt></td>
    195       <td>SIGSEGV</td>
    196       <td>?</td>
    197   </tr>
    198   <tr style="background-color: #ddf;">
    199       <td><tt><b>otool -I <a href="/files/zzuf/bugs/lol-macosx-otool">lol-macosx-otool</a></b></tt></td>
    200       <td>SIGSEGV</td>
    201       <td>?</td>
    202   </tr>
    203 </table>
    204 }}}
     26 * OpenBSD (4.0 GENERIC!#1107 i386)
     27|| nm [/files/zzuf/bugs/lol-openbsd-nm lol-openbsd-nm] || SIGSEGV || crash in `strcmp()`, not exploitable ||
     28|| objdump -T [/files/zzuf/bugs/lol-openbsd-objdump lol-openbsd-objdump] || SIGSEGV || ? ||
     29
     30 * Linux (Debian 4.0 i386 unstable)
     31|| nm [/files/zzuf/bugs/lol-debian-nm lol-debian-nm] || SIGKILL || memory usage exceeded ||
     32|| identify [/files/zzuf/bugs/fuzz1.xpm fuzz1.xpm] [/files/zzuf/bugs/fuzz2.xpm fuzz2.xpm] [/files/zzuf/bugs/fuzz3.xpm fuzz3.xpm] || SIGSEGV || Memory corruption in !ImageMagick. Security implications look promising. ||
     33|| antiword [/files/zzuf/bugs/lol-antiword.doc lol-antiword.doc] || SIGSEGV || ? ||
     34|| firefox [/files/zzuf/bugs/lol-firefox.gif lol-firefox.gif] || !BadAlloc || X11 error ||
     35|| dvipng [/files/zzuf/bugs/lol-dvipng.dvi lol-dvipng.dvi] || SIGSEGV || Also occurs with `dvi2ps` ||
     36|| giftopnm [/files/zzuf/bugs/lol-giftopnm.gif lol-giftopnm.gif] || SIGSEGV || ? ||
     37
     38 * FreeBSD (6.1-RELEASE FreeBSD 6.1-RELEASE !#0: Sun May  7 04:32:43 UTC 2006     root@opus.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC  i386)
     39|| nm [/files/zzuf/bugs/lol-freebsd-nm lol-freebsd-nm] || SIGSEGV || ? ||
     40
     41 * Mac OS X (8.3.1 Darwin Kernel Version 8.3.1: Wed Nov  2 21:12:54 PST 2005; root:xnu-792.7.56.obj~6/RELEASE_I386 i386 i386)
     42|| nm [/files/zzuf/bugs/lol-macosx-nm lol-macosx-nm] || SIGSEGV || ? ||
     43|| otool -I [/files/zzuf/bugs/lol-macosx-otool lol-macosx-otool] || SIGSEGV || ? ||