Samsung Galaxy S6 – libQjpeg DoIntegralUpsample Crash

• Exploit Database
• 112 阅读

• 作者： Google Security Research
  日期： 2015-11-03
• 类别：

  • dos
  平台：

  • android
• 来源：https://www.exploit-db.com/exploits/38612/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41

  Source: https://code.google.com/p/google-security-research/issues/detail?id=498   The attached jpg, upsample.jpg can cause memory corruption when media scanning occurs   F/libc( 8600): Fatal signal 11 (SIGSEGV), code 1, fault addr 0x206e6f69747562 in tid 8685 (HEAVY#0) I/DEBUG ( 2956): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** I/DEBUG ( 2956): Build fingerprint: &apos;Verizon/zeroltevzw/zeroltevzw:5.0.2/LRX22G/G925VVRU2AOF1:user/release-keys&apos; I/DEBUG ( 2956): Revision: &apos;10&apos; I/DEBUG ( 2956): ABI: &apos;arm64&apos; I/DEBUG ( 2956): pid: 8600, tid: 8685, name: HEAVY#0>>> com.samsung.dcm:DCMService <<< I/DEBUG ( 2956): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x206e6f69747562 I/DEBUG ( 2956): x0 0000007f8cef2ab0x1 0000000000000002x2 0000007f8cef2ab0x3 0000007f8ce5a390 I/DEBUG ( 2956): x4 0000007f8cef28d0x5 3d206e6f69747562x6 0000007f8cef29f0x7 42e34ca342e32177 I/DEBUG ( 2956): x8 42e390a242e37199x9 42dfe02f42debc0fx1042e06c3442e03665x1142e0afd542e08c24 I/DEBUG ( 2956): x1242e1070042e0e62dx1342e1830842e146dax1442e1f53342e1add4x1500000000000014a4 I/DEBUG ( 2956): x160000007f9f0d6ae0x170000007fa3e7e880x180000007f8ce75c60x190000007f8cebe000 I/DEBUG ( 2956): x200000000000000001x210000007f8cebe000x220000000000000001x230000000000000000 I/DEBUG ( 2956): x240000000000000000x250000000000000000x260000000010000000x270000007f8c5ff050 I/DEBUG ( 2956): x280000007f8ce77800x29000000000000001cx300000007f9f09fff8 I/DEBUG ( 2956): sp 0000007f8d0fea20pc 0000007f9f09e83cpstate 0000000080000000 I/DEBUG ( 2956): I/DEBUG ( 2956): backtrace: I/DEBUG ( 2956): #00 pc 000000000009b83c/system/lib64/libQjpeg.so (WINKJ_DoIntegralUpsample+164) I/DEBUG ( 2956): #01 pc 000000000009cff4/system/lib64/libQjpeg.so (WINKJ_SetupUpsample+228) I/DEBUG ( 2956): #02 pc 0000000000035700/system/lib64/libQjpeg.so (WINKJ_ProgProcessData+236) I/DEBUG ( 2956): #03 pc 0000000000041f08/system/lib64/libQjpeg.so (WINKJ_DecodeImage+688) I/DEBUG ( 2956): #04 pc 00000000000428d4/system/lib64/libQjpeg.so (WINKJ_DecodeFrame+88) I/DEBUG ( 2956): #05 pc 0000000000042a08/system/lib64/libQjpeg.so (QURAMWINK_DecodeJPEG+276) I/DEBUG ( 2956): #06 pc 000000000004420c/system/lib64/libQjpeg.so (QURAMWINK_PDecodeJPEG+200) I/DEBUG ( 2956): #07 pc 00000000000a4234/system/lib64/libQjpeg.so (QjpgDecodeFileOpt+432) I/DEBUG ( 2956): #08 pc 0000000000001b98/system/lib64/libsaiv_codec.so (saiv_codec_JpegCodec_decode_f2bRotate+40) I/DEBUG ( 2956): #09 pc 0000000000001418/system/lib64/libsaiv_codec.so (Java_com_samsung_android_saiv_codec_JpegCodec_decodeF2BRotate+268) I/DEBUG ( 2956): #10 pc 00000000000018ec/system/framework/arm64/saiv.odex   To reproduce, download the image file and wait, or trigger media scanning by calling:   adb shell am broadcast -a android.intent.action.MEDIA_MOUNTED -d file:///mnt/shell/emulated/0/   Proof of Concept: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38612.zip