mkvtoolnix/tests/test-0662cisco_talos_2018_0694.rb

#!/usr/bin/ruby -w

# T_662cisco_talos_2018_0694
describe "mkvinfo / Cisco TALOS 2018-0694 use after free"

file = "data/segfaults-assertions/cisco-talos-2018-0694.mkv"

test_merge file
kax_file_c, ElementReader: only delete returned upper-level element if found The `EbmlElement::Read` function returns two values via reference parameters. They're called `UpperEltFound` (an integer) and `FoundElt` (a pointer to an EBML element). They're used for passing back the first element found (if any) that is not a child of the element currently being read so that the calling code can continue parsing the file using the upper-level element. If the calling code doesn't need that element, it has to delete it itself. However, the code must not simply rely on the `FoundElt` pointer being not null as the `Read` function assigns temporary results to that variable. Depending on the file content, that temporary element may have already been deleted by the `Read` function. When the calling code then simply deletes `FoundElt` itself, this leads to a typical case of use-after-free. Instead the calling code must only work with the returned `FoundElt` pointer if the other returned value, `UpperEltFound`, trueish in the C++ sense (if it isn't 0). Then and only then may the calling code attempt to delete the object `FoundElt` points to. This vulnerability allows arbitrary code execution via specially crafted Matroska files. It was reported by Cisco TALOS on 2018-10-25 and is known as TALOS 2018-0694. 2018-10-25 19:59:24 +00:00			`#!/usr/bin/ruby -w`

			`# T_662cisco_talos_2018_0694`
			`describe "mkvinfo / Cisco TALOS 2018-0694 use after free"`

			`file = "data/segfaults-assertions/cisco-talos-2018-0694.mkv"`

			`test_merge file`