Version 14 (modified by Sam Hocevar, 15 years ago) (diff)

--

The January 2010 media player debacle

Yes, it’s a debacle again. While some players such as MPlayer had their stability improved, zzuf could again find bugs with most files, especially video codecs.

Audio codecs:

VLC MPlayer xine FFmpeg GStreamer mpg321 ogg123
MP3 robust SIGSEGV SIGFPE ? ? robust N/A
Ogg Vorbis ? robust SIGSEGV ? robust N/A robust
FLAC robust SIGABRT SIGFPE ? robust N/A SIGSEGV
AAC robust robust robust ? robust N/A N/A
AC-3/A52 robust robust ? ? robust N/A N/A
Speex ? SIGSEGV robust ? robust N/A ?
EAC3 SIGABRT robust robust ? robust N/A N/A

Video codecs:

VLC MPlayer xine FFmpeg GStreamer mpg321 ogg123
MPEG-1 SIGSEGV robust SIGSEGV ? robust N/A N/A
MPEG-2 SIGSEGV ? SIGSEGV ? ? N/A N/A
MPEG-4 AVI SIGSEGV SIGSEGV SIGSEGV ? ? N/A N/A
MPEG-4 ? SIGSEGV SIGSEGV ? SIGSEGV N/A N/A
Ogg Theora robust robust SIGSEGV ? ? N/A N/A
WMV SIGSEGV SIGSEGV SIGSEGV ? SIGSEGV N/A N/A
FLV SIGSEGV SIGSEGV SIGSEGV ? SIGSEGV N/A N/A
  • “?” means zzuf could not properly fuzz the application
  • “robust” means zzuf could not find a crash in reasonable time

The January 2007 media player debacle

Media players are especially sensitive to stream corruption. In fact, zzuf started its life as a tool to find bugs in the VLC media player software. The following table gives a few examples of crashes (all programs were the latest version in Debian i386 sid as of 2007/01/14). Click on each link to download the file that caused the crash:

Disclaimer 1: “robust” does not mean that there is no bug, it just means that zzuf could not find one in reasonable time.

Disclaimer 2: segmentation faults reported below are not necessarily bugs in the program itself; for instance, the MPEG-2 crashes are more likely due to a bug in the libmpeg2 library.

VLC MPlayer xine FFmpeg (ffplay) GStreamer (gst-launch) mpg321 ogg123
MP3 robust SIGSEGV robust robust robust robust N/A
Ogg Vorbis robust SIGSEGV robust SIGSEGV SIGSEGV N/A robust
MPEG-1 SIGSEGV SIGSEGV SIGSEGV SIGSEGV robust N/A N/A
MPEG-2 SIGSEGV SIGSEGV robust SIGSEGV SIGSEGV N/A N/A
MPEG-4 AVI SIGSEGV SIGSEGV SIGSEGV SIGSEGV deadlock? N/A N/A
FLAC robust SIGSEGV robust heap corruption robust N/A SIGFPE
Ogg Theora robust SIGSEGV robust SIGSEGV robust N/A N/A
WMV SIGSEGV SIGSEGV N/A SIGSEGV robust N/A N/A
AAC heap corruption SIGSEGV SIGSEGV N/A N/A N/A N/A
AC-3/A52 SIGSEGV robust (I KID YOU NOT) robust SIGSEGV N/A N/A N/A
Speex robust robust robust N/A robust N/A robust

Other bugs

Here is a list of other bugs that were easily found using zzuf, each time in a matter of seconds.

  • OpenBSD (4.0 GENERIC#1107 i386)
nm lol-openbsd-nm SIGSEGV crash in strcmp(), not exploitable
objdump -T lol-openbsd-objdump SIGSEGV ?
  • Linux (Debian 4.0 i386 unstable)
nm lol-debian-nm SIGKILL memory usage exceeded
identify fuzz1.xpm fuzz2.xpm fuzz3.xpm SIGSEGV Memory corruption in ImageMagick. Security implications look promising.
antiword lol-antiword.doc SIGSEGV ?
firefox lol-firefox.gif BadAlloc X11 error
dvipng lol-dvipng.dvi SIGSEGV Also occurs with dvi2ps
giftopnm lol-giftopnm.gif SIGSEGV ?
nm lol-freebsd-nm SIGSEGV ?
  • Mac OS X (8.3.1 Darwin Kernel Version 8.3.1: Wed Nov 2 21:12:54 PST 2005; root:xnu-792.7.56.obj~6/RELEASE_I386 i386 i386)
nm lol-macosx-nm SIGSEGV ?
otool -I lol-macosx-otool SIGSEGV ?
  • HP-UX B.11.31 U ia64 3426292962 unlimited-user license
nm files/zzuf/bugs/lol-hpux-ia64-nm SIGSEGV in nm_elf ?

Attachments (75)