Heap buffer overflow in Codebook_DecodeSetup

[khang06]

i wrote this quick and (very) dirty fuzzer for the vorbis stuff

// this is just a modified version of Music_PlayOgg
// any bugs in that logic *should* appear here
int LLVMFuzzerTestOneInput(uint8_t *Data, size_t Size) {
    struct Stream source_notptr;
    Stream_ReadonlyMemory(&source_notptr, Data, Size);
    struct Stream* source = &source_notptr;

    uint8_t buffer[OGG_BUFFER_SIZE];
    struct Stream stream;
    struct VorbisState vorbis = { 0 };
    struct AudioFormat fmt;

    int chunkSize, samplesPerSecond;
    int16_t* data = NULL;
    bool completed;
    int i, next;
    ReturnCode res;

    Ogg_MakeStream(&stream, buffer, source);
    vorbis.Source = &stream;
    if ((res = Vorbis_DecodeHeaders(&vorbis))) goto cleanup;

    fmt.Channels = vorbis.Channels;
    fmt.SampleRate = vorbis.SampleRate;
    fmt.BitsPerSample = 16;

    /* largest possible vorbis frame decodes to blocksize1 * channels samples */
    /* so we may end up decoding slightly over a second of audio */
    chunkSize = fmt.Channels * (fmt.SampleRate + vorbis.BlockSizes[1]);
    samplesPerSecond = fmt.Channels * fmt.SampleRate;
    data = (int16_t*)Mem_Alloc(chunkSize * AUDIO_MAX_BUFFERS, 2, "Ogg final output");

    /* fill up with some samples before playing */
    for (i = 0; i < AUDIO_MAX_BUFFERS && !res; i++) {
        res = Music_Buffer(i, &data[chunkSize * i], samplesPerSecond, &vorbis);
    }

    for (;;) {
        res = Music_Buffer(next, &data[chunkSize * next], samplesPerSecond, &vorbis);
        /* need to specially handle last bit of audio */
        if (res) break;
    }

cleanup:
    Mem_Free(data);
    Vorbis_Free(&vorbis);
    return 0;
}

also requires a modified function in Audio.c

ReturnCode Music_Buffer(int i, int16_t* data, int maxSamples, struct VorbisState* ctx) {
	int samples = 0;
	int16_t* cur;
	ReturnCode res = 0, res2;

	while (samples < maxSamples) {
		if ((res = Vorbis_DecodeFrame(ctx))) break;

		cur = &data[samples];
		samples += Vorbis_OutputFrame(ctx, cur);
	}

	return res;
}

since i changed a lot in this function, there could be a flaw in my fuzzing logic. but the crash itself doesn't look related

pi@raspberrypi:~/ClassiCube/src $ ./ClassiCube SIGABRT.PC.76afa45c.STACK.badbad0c3cb96303.CODE.-6.ADDR.\(nil\).INSTR.mov_r0\,_r4.2019-06-01.23\:08\:33.25453.fuzz
Accepting input from 'SIGABRT.PC.76afa45c.STACK.badbad0c3cb96303.CODE.-6.ADDR.(nil).INSTR.mov_r0,_r4.2019-06-01.23:08:33.25453.fuzz'
Usage for fuzzing: honggfuzz -P [flags] -- ./ClassiCube
=================================================================
==25612==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6aa01680 at pc 0x002e6ea0 bp 0x7ee200d8 sp 0x7ee200d4
WRITE of size 1 at 0x6aa01680 thread T0
    #0 0x2e6e9c in Codebook_DecodeSetup /home/pi/ClassiCube/src/Vorbis.c:321:21
    #1 0x2e009c in Vorbis_DecodeSetup /home/pi/ClassiCube/src/Vorbis.c:1197:9
    #2 0x2deea4 in Vorbis_DecodeHeaders /home/pi/ClassiCube/src/Vorbis.c:1258:13
    #3 0x1dec10 in LLVMFuzzerTestOneInput /home/pi/ClassiCube/src/Program.c:191:16

0x6aa01680 is located 0 bytes to the right of 64-byte region [0x6aa01640,0x6aa01680)
allocated by thread T0 here:
    #0 0x10d618 in __interceptor_malloc /home/tcwg-buildslave/workspace/tcwg-llvm-release/tcwg-tk1_32-build/final/llvm.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:146:3
    #1 0x330f78 in Mem_Alloc /home/pi/ClassiCube/src/Platform.c:137
    #2 0x2e6080 in Codebook_DecodeSetup /home/pi/ClassiCube/src/Vorbis.c:293:27
    #3 0x2e009c in Vorbis_DecodeSetup /home/pi/ClassiCube/src/Vorbis.c:1197:9
    #4 0x2deea4 in Vorbis_DecodeHeaders /home/pi/ClassiCube/src/Vorbis.c:1258:13
    #5 0x1dec10 in LLVMFuzzerTestOneInput /home/pi/ClassiCube/src/Program.c:191:16
    #6 0x43c8f8 in HonggfuzzMain (/home/pi/ClassiCube/src/ClassiCube+0x43c8f8)

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/pi/ClassiCube/src/Vorbis.c:321:21 in Codebook_DecodeSetup
Shadow bytes around the buggy address:
  0x2d540280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x2d540290: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x2d5402a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x2d5402b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x2d5402c0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
=>0x2d5402d0:[fa]fa fa fa 00 00 00 00 00 00 00 04 fa fa fa fa
  0x2d5402e0: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa
  0x2d5402f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x2d540300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x2d540310: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x2d540320: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==25612==ABORTING

heapoobw1ogg.zip