CVE-2023-46927: Out-of-bounds Write (CWE-787)
value: GPAC 2.3-DEV-rev605-gfc9e29089-master contains a heap-buffer-overflow in gf_isom_use_compact_size gpac/src/isomedia/isom_write.c:3403:3 in gpac/MP4Box.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2023-11-01T15:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/isom_write.c
Commit date: 2023-10-23 14:17:29 +0200
Commit message: gf_isom_use_compact_size() check sampleCount!=0 (fixes #2657)

Diff: diff --git a/src/isomedia/isom_write.c b/src/isomedia/isom_write.c
index 11e3f1c37d..8ed3043a9b 100644
--- a/src/isomedia/isom_write.c
+++ b/src/isomedia/isom_write.c
@@ -357,11 +357,11 @@ GF_Err gf_isom_set_media_language(GF_ISOFile *movie, u32 trackNumber, char *code
 static GF_Err gf_isom_set_root_iod(GF_ISOFile *movie)
 {
 	GF_IsomInitialObjectDescriptor *iod;
 	GF_IsomObjectDescriptor *od;
 	GF_Err e;
-	
+
 	e = gf_isom_insert_moov(movie);
 	if (e) return e;
 	if (!movie->moov->iods) {
 		AddMovieIOD(movie->moov, 1);
 		return GF_OK;
@@ -788,11 +788,11 @@ u32 gf_isom_new_track_from_template(GF_ISOFile *movie, GF_ISOTrackID trakID, u32
 			tkhd->volume = 0x0100;
 			break;
 		}
 	}
 	movie->last_created_track_id = tkhd->trackID;
-	
+
 	if (!movie->keep_utc && !gf_sys_is_test_mode() ) {
 		tkhd->modificationTime = now;
 	 	mdia->mediaHeader->modificationTime = now;
 	}
 
@@ -3393,11 +3393,11 @@ GF_Err gf_isom_use_compact_size(GF_ISOFile *movie, u32 trackNumber, Bool Compact
 	//switch to compact table
 	if (stsz->type == GF_ISOM_BOX_TYPE_STZ2) return GF_OK;
 	//fill the table. Although it seems weird , this is needed in case of edition
 	//after the function is called. NOte however than we force regular table
 	//at write time if all samples are of same size
-	if (stsz->sampleSize) {
+	if (stsz->sampleSize && stsz->sampleCount) {
 		//this is a weird table indeed ;)
 		if (stsz->sizes) gf_free(stsz->sizes);
 		stsz->sizes = (u32*) gf_malloc(sizeof(u32)*stsz->sampleCount);
 		if (!stsz->sizes) return GF_OUT_OF_MEM;
 		memset(stsz->sizes, stsz->sampleSize, sizeof(u32));
@@ -6311,11 +6311,11 @@ GF_Err gf_isom_apple_set_tag(GF_ISOFile *mov, GF_ISOiTunesTag tag, const u8 *dat
 	if (!info && !gf_list_count(ilst->child_boxes) ) {
 		gf_isom_box_del_parent(&meta->child_boxes, (GF_Box *) ilst);
 		return GF_OK;
 	}
 	if (!ilst->child_boxes) ilst->child_boxes = gf_list_new();
-	
+
 	return gf_list_add(ilst->child_boxes, info);
 }
 
 #include <gpac/utf.h>
 
@@ -6973,11 +6973,11 @@ static GF_SampleGroupDescriptionBox *get_sgdp(GF_SampleTableBox *stbl, void *tra
 			sgdesc = (GF_SampleGroupDescriptionBox*)gf_list_get(groupList, i);
 			if (sgdesc->grouping_type==grouping_type) break;
 			sgdesc = NULL;
 		}
 	}
-	
+
 #ifndef GPAC_DISABLE_ISOM_FRAGMENTS
 	/*look in stbl or traf for sample sampleGroupsDescription*/
 	if (!sgdesc && traf) {
 		if (!traf->sampleGroupsDescription)
 			traf->sampleGroupsDescription = gf_list_new();
@@ -8330,11 +8330,11 @@ GF_Err gf_isom_update_sample_description_from_template(GF_ISOFile *file, u32 tra
 
 		if (found) {
 			gf_isom_box_del(abox);
 			continue;
 		}
-		
+
 		if (!ent->child_boxes) ent->child_boxes = gf_list_new();
 		for (j=0; j<gf_list_count(ent->child_boxes); j++) {
 			GF_Box *b = gf_list_get(ent->child_boxes, j);
 			if (b->type == abox->type) {
 				found = GF_TRUE;
@@ -9165,6 +9165,5 @@ GF_Err gf_isom_set_sample_description_restricted(GF_ISOFile *movie, u32 trackNum
 	return GF_OK;
 }
 
 
 #endif	/*!defined(GPAC_DISABLE_ISOM) && !defined(GPAC_DISABLE_ISOM_WRITE)*/
-

Vulnerable code: 	
	
	if (stsz->sampleSize) {
	
	
		

Fixed code: 

	if (stsz->sampleSize && stsz->sampleCount) {