Bisect results.
ONE CORRECTION: I can*not* reproduce CVE-2020-21601, this was an error
yesterday.
TL;DR: (Debian centric, see below if you want the commits)
CVE-2020-21594 -- likely fixed in v1.0.3, or some regression made it reappear
later.
CVE-2020-21595 -- fixed in v1.0.9
CVE-2020-21596 -- STILL VULNERABLE
CVE-2020-21597 -- fixed in v1.0.9
CVE-2020-21599 -- fixed in v1.0.9
CVE-2020-21601 -- fixed in v1.0.9
CVE-2020-21603 -- fixed in v1.0.9
CVE-2020-21604 -- fixed in v1.0.9
CVE-2020-21605 -- fixed in v1.0.9
CVE-2020-21606 -- fixed in v1.0.9
Later today, I will split the bug accordingly and set Debian fixed versions.
I'll also amend d/changelog when preparing the NMU later.
----------------
The poc is no longer triggering with the state in the master branch, as of
today at
commit c96962cf6a0259f1678e9a0e1566eb9b5516093a, I was bisecting to find when
the poc
started to no longer trigger.
The test were commited on Debian unstable, gcc (Debian 12.2.0-14) 12.2.
#### Methology:
Starting point for all bisects were commit
c43f2f8cd674bc7c78951b279ca0b1f883e1f276 (selected, as this is around the time
where the CVEs were reported)
```
commit c43f2f8cd674bc7c78951b279ca0b1f883e1f276 (HEAD)
Author: Dirk Farin <dirk.fa...@gmail.com>
Date: Thu Dec 19 11:04:40 2019 +0100
increase version number to v1.0.4
```
Bisecting is done using, so that git will report the first "good" commit.
```# git bisect start --term-new=fixed --term-old=unfixed```
Bisecting is done using the CMake build system, using
```# cmake ../libde265 -DCMAKE_CXX_FLAGS="-fsanitize=address"
-DCMAKE_BUILD_TYPE=Debug```
The pocs -- taken from the upstream issues (renamed for convience, so that the
link to the CVE/issue is in the filename)
The test was done with:
```./dec265/dec265 -q $POC```
#### CVE-2020-21594-issue233-libde265-put_epel_hv_fallback-heap_overflow.crash
CVE-2020-21594-issue233-libde265-put_epel_hv_fallback-heap_overflow.crash2
Unfortunatly the code did not compile at the final bisect step, so the
candidates for the first fixed commits are:
```git bisect fixed
There are only 'skip'ped commits left to test.
The first fixed commit could be any of:
39879b749bbad5b2abc2d56ddcb6488891e3a9a0
1df1dfe3180074724e8c7dedc789910a605934ad
We cannot bisect more!
```
```
git describe --contains 1df1dfe3180074724e8c7dedc789910a605934ad
v1.0.3~15
git describe --contains 39879b749bbad5b2abc2d56ddcb6488891e3a9a0
v1.0.3~16
```
So this seems to be fixed in v1.0.3.
This result is strange, the commit 39879b7 is dated Mon Dec 4 16:22:57 2017
+0100 and the other is just ~30 minutes younger.
Of course, there could be versions that have reintroduced a similar regression…
#### CVE-2020-21595-issue239-libde265-mc_luma-heap_overflow.crash
a3f1c6a0dea2b0d4a531255ad06ed40cdb184d25 is the first fixed commit
```
commit a3f1c6a0dea2b0d4a531255ad06ed40cdb184d25
Author: Dirk Farin <dirk.fa...@gmail.com>
Date: Tue Feb 23 15:11:09 2021 +0100
return error when PCM bits parameter exceeds pixel depth (#225)
libde265/de265.cc | 2 ++
libde265/de265.h | 3 ++-
libde265/sps.cc | 10 ++++++++++
3 files changed, 14 insertions(+), 1 deletion(-)
```
```
git describe --contains a3f1c6a0dea2b0d4a531255ad06ed40cdb184d25
v1.0.9~9
```
#### CVE-2020-21597-issue238-mc_chroma-heap_overflow.crash
f538254e4658ef5ea4e233c2185dcbfd165e8911 is the first fixed commit
```
commit f538254e4658ef5ea4e233c2185dcbfd165e8911
Author: Dirk Farin <dirk.fa...@gmail.com>
Date: Tue Apr 5 18:41:28 2022 +0200
fix streams where SPS image size changes without refreshing PPS (#299)
libde265/decctx.cc | 9 +++++++++
1 file changed, 9 insertions(+)
```
```
git describe --contains f538254e4658ef5ea4e233c2185dcbfd165e8911
v1.0.9~3^2~6
```
####
CVE-2020-21599-issue235-libde265-de265_image__available_zscan-heap_overflow.crash
a3f1c6a0dea2b0d4a531255ad06ed40cdb184d25 is the first fixed commit
```
commit a3f1c6a0dea2b0d4a531255ad06ed40cdb184d25
Author: Dirk Farin <dirk.fa...@gmail.com>
Date: Tue Feb 23 15:11:09 2021 +0100
return error when PCM bits parameter exceeds pixel depth (#225)
libde265/de265.cc | 2 ++
libde265/de265.h | 3 ++-
libde265/sps.cc | 10 ++++++++++
3 files changed, 14 insertions(+), 1 deletion(-)
```
git describe --contains a3f1c6a0dea2b0d4a531255ad06ed40cdb184d25
v1.0.9~9
```
#### CVE-2020-21603-put_qpel_0_0_fallback_16-heap_overflow.crash
```
a3f1c6a0dea2b0d4a531255ad06ed40cdb184d25 is the first fixed commit
commit a3f1c6a0dea2b0d4a531255ad06ed40cdb184d25
Author: Dirk Farin <dirk.fa...@gmail.com>
Date: Tue Feb 23 15:11:09 2021 +0100
return error when PCM bits parameter exceeds pixel depth (#225)
libde265/de265.cc | 2 ++
libde265/de265.h | 3 ++-
libde265/sps.cc | 10 ++++++++++
3 files changed, 14 insertions(+), 1 deletion(-)
```
```
git describe --contains a3f1c6a0dea2b0d4a531255ad06ed40cdb184d25
v1.0.9~9
```
#### CVE-2020-21604-issue231-mm_loadl_epi64-heap_overflow.crash
a3f1c6a0dea2b0d4a531255ad06ed40cdb184d25 is the first fixed commit
```
commit a3f1c6a0dea2b0d4a531255ad06ed40cdb184d25
Author: Dirk Farin <dirk.fa...@gmail.com>
Date: Tue Feb 23 15:11:09 2021 +0100
return error when PCM bits parameter exceeds pixel depth (#225)
libde265/de265.cc | 2 ++
libde265/de265.h | 3 ++-
libde265/sps.cc | 10 ++++++++++
3 files changed, 14 insertions(+), 1 deletion(-)
```
```
git describe --contains a3f1c6a0dea2b0d4a531255ad06ed40cdb184d25
v1.0.9~9
```
#### CVE-2020-21605-issue234-apply_sao_internal-segment.crash
a3f1c6a0dea2b0d4a531255ad06ed40cdb184d25 is the first fixed commit
```
commit a3f1c6a0dea2b0d4a531255ad06ed40cdb184d25
Author: Dirk Farin <dirk.fa...@gmail.com>
Date: Tue Feb 23 15:11:09 2021 +0100
return error when PCM bits parameter exceeds pixel depth (#225)
libde265/de265.cc | 2 ++
libde265/de265.h | 3 ++-
libde265/sps.cc | 10 ++++++++++
3 files changed, 14 insertions(+), 1 deletion(-)
```
```
git describe --contains a3f1c6a0dea2b0d4a531255ad06ed40cdb184d25
v1.0.9~9
```
#### CVE-2020-21606-issue232-put_epel_16_fallback-heap_overflow.crash
f538254e4658ef5ea4e233c2185dcbfd165e8911 is the first fixed commit
```
commit f538254e4658ef5ea4e233c2185dcbfd165e8911
Author: Dirk Farin <dirk.fa...@gmail.com>
Date: Tue Apr 5 18:41:28 2022 +0200
fix streams where SPS image size changes without refreshing PPS (#299)
libde265/decctx.cc | 9 +++++++++
1 file changed, 9 insertions(+)
```
```
git describe --contains f538254e4658ef5ea4e233c2185dcbfd165e8911
v1.0.9~3^2~6
```
#### CVE-2020-21601-issue241-libde265-put_qpel_fallback-stack_overflow.crash
#### CVE-2020-21601-issue241-libde265-put_qpel_fallback-stack_overflow.crash2
3f1c6a0dea2b0d4a531255ad06ed40cdb184d25 is the first fixed commit
```
commit a3f1c6a0dea2b0d4a531255ad06ed40cdb184d25
Author: Dirk Farin <dirk.fa...@gmail.com>
Date: Tue Feb 23 15:11:09 2021 +0100
return error when PCM bits parameter exceeds pixel depth (#225)
libde265/de265.cc | 2 ++
libde265/de265.h | 3 ++-
libde265/sps.cc | 10 ++++++++++
3 files changed, 14 insertions(+), 1 deletion(-)
```
```
git describe --contains f538254e4658ef5ea4e233c2185dcbfd165e8911
v1.0.9~3^2~6
```
