CVE-2018-13006: Out-of-bounds Read (CWE-125)
value: An issue was discovered in MP4Box in GPAC 0.7.1. There is a heap-based buffer over-read in the isomedia/box_dump.c function hdlr_dump.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2018-06-29T14:29Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: include/gpac/internal/isomedia_dev.h, src/isomedia/box_code_base.c, src/isomedia/box_dump.c
Commit date: 2018-06-28 13:34:08 +0200
Commit message: fixed 2 possible heap overflows (inc. #1088)

Diff: diff --git a/include/gpac/internal/isomedia_dev.h b/include/gpac/internal/isomedia_dev.h
index c8a5b9f2e..029662607 100644
--- a/include/gpac/internal/isomedia_dev.h
+++ b/include/gpac/internal/isomedia_dev.h
@@ -3708,11 +3708,11 @@ GF_GenericSubtitleSample *gf_isom_parse_generic_subtitle_sample_from_data(char *
 /*do not throw fatal errors if boxes are duplicated, just warn and remove extra ones*/
 #define ERROR_ON_DUPLICATED_BOX(__abox, __parent) {	\
 		char __ptype[5];\
 		strcpy(__ptype, gf_4cc_to_str(__parent->type) );\
 		GF_LOG(GF_LOG_WARNING, GF_LOG_CONTAINER, ("[iso file] extra box %s found in %s, deleting\n", gf_4cc_to_str(__abox->type), __ptype)); \
-		gf_isom_box_del(a);\
+		gf_isom_box_del(__abox);\
 		return GF_OK;\
 	}
 
 
 #ifndef GPAC_DISABLE_VTT
diff --git a/src/isomedia/box_code_base.c b/src/isomedia/box_code_base.c
index 2cb81ef3f..0f5b40f7f 100644
--- a/src/isomedia/box_code_base.c
+++ b/src/isomedia/box_code_base.c
@@ -630,11 +630,11 @@ GF_Err urn_Read(GF_Box *s, GF_BitStream *bs)
 	//get the data
 	gf_bs_read_data(bs, tmpName, to_read);
 
 	//then get the break
 	i = 0;
-	while ( (tmpName[i] != 0) && (i < to_read) ) {
+	while ( (i < to_read) && (tmpName[i] != 0) ) {
 		i++;
 	}
 	//check the data is consistent
 	if (i == to_read) {
 		gf_free(tmpName);
diff --git a/src/isomedia/box_dump.c b/src/isomedia/box_dump.c
index a7371be03..c77847928 100644
--- a/src/isomedia/box_dump.c
+++ b/src/isomedia/box_dump.c
@@ -482,11 +482,11 @@ GF_Err pdin_dump(GF_Box *a, FILE * trace)
 
 GF_Err hdlr_dump(GF_Box *a, FILE * trace)
 {
 	GF_HandlerBox *p = (GF_HandlerBox *)a;
 	gf_isom_box_dump_start(a, "HandlerBox", trace);
-	if (p->nameUTF8 && (u32) p->nameUTF8[0] == strlen(p->nameUTF8+1)) {
+	if (p->nameUTF8 && (u32) p->nameUTF8[0] == strlen(p->nameUTF8)-1) {
 		fprintf(trace, "hdlrType=\"%s\" Name=\"%s\" ", gf_4cc_to_str(p->handlerType), p->nameUTF8+1);
 	} else {
 		fprintf(trace, "hdlrType=\"%s\" Name=\"%s\" ", gf_4cc_to_str(p->handlerType), p->nameUTF8);
 	}
 	fprintf(trace, "reserved1=\"%d\" reserved2=\"", p->reserved1);
@@ -4155,13 +4155,13 @@ static void oinf_entry_dump(GF_OperatingPointsInformation *ptr, FILE * trace)
 		fprintf(trace, " max_temporal_id=\"%u\" layer_count=\"%u\"", op->max_temporal_id, op->layer_count);
 		fprintf(trace, " minPicWidth=\"%u\" minPicHeight=\"%u\"", op->minPicWidth, op->minPicHeight);
 		fprintf(trace, " maxPicWidth=\"%u\" maxPicHeight=\"%u\"", op->maxPicWidth, op->maxPicHeight);
 		fprintf(trace, " maxChromaFormat=\"%u\" maxBitDepth=\"%u\"", op->maxChromaFormat, op->maxBitDepth);
 		fprintf(trace, " frame_rate_info_flag=\"%u\" bit_rate_info_flag=\"%u\"", op->frame_rate_info_flag, op->bit_rate_info_flag);
-		if (op->frame_rate_info_flag) 
+		if (op->frame_rate_info_flag)
 			fprintf(trace, " avgFrameRate=\"%u\" constantFrameRate=\"%u\"", op->avgFrameRate, op->constantFrameRate);
-		if (op->bit_rate_info_flag) 
+		if (op->bit_rate_info_flag)
 			fprintf(trace, " maxBitRate=\"%u\" avgBitRate=\"%u\"", op->maxBitRate, op->avgBitRate);
 		fprintf(trace, "/>\n");
 	}
 	count=gf_list_count(ptr->dependency_layers);
 	for (i = 0; i < count; i++) {
@@ -4259,18 +4259,18 @@ static void nalm_dump(FILE * trace, char *data, u32 data_size)
 		fprintf(trace, "<NALUMap rle=\"\" large_size=\"\">\n");
 		fprintf(trace, "<NALUMapEntry NALU_startNumber=\"\" groupID=\"\"/>\n");
 		fprintf(trace, "</NALUMap>\n");
 		return;
 	}
-	
+
 	bs = gf_bs_new(data, data_size, GF_BITSTREAM_READ);
 	gf_bs_read_int(bs, 6);
 	large_size = gf_bs_read_int(bs, 1);
 	rle = gf_bs_read_int(bs, 1);
 	entry_count = gf_bs_read_int(bs, large_size ? 16 : 8);
 	fprintf(trace, "<NALUMap rle=\"%d\" large_size=\"%d\">\n", rle, large_size);
-	
+
 	while (entry_count) {
 		u32 ID;
 		fprintf(trace, "<NALUMapEntry ");
 		if (rle) {
 			u32 start_num = gf_bs_read_int(bs, large_size ? 16 : 8);
@@ -4336,11 +4336,11 @@ GF_Err sgpd_dump(GF_Box *a, FILE * trace)
 			linf_dump(entry, trace);
 			break;
 		case GF_ISOM_SAMPLE_GROUP_TRIF:
 			trif_dump(trace, (char *) ((GF_DefaultSampleGroupDescriptionEntry*)entry)->data,  ((GF_DefaultSampleGroupDescriptionEntry*)entry)->length);
 			break;
-			
+
 		case GF_ISOM_SAMPLE_GROUP_NALM:
 			nalm_dump(trace, (char *) ((GF_DefaultSampleGroupDescriptionEntry*)entry)->data,  ((GF_DefaultSampleGroupDescriptionEntry*)entry)->length);
 			break;
 		case GF_ISOM_SAMPLE_GROUP_SAP:
 			fprintf(trace, "<SAPEntry dependent_flag=\"%d\" SAP_type=\"%d\" />\n", ((GF_SAPEntry*)entry)->dependent_flag, ((GF_SAPEntry*)entry)->SAP_type);
@@ -4505,11 +4505,11 @@ GF_Err tenc_dump(GF_Box *a, FILE * trace)
 		fprintf(trace, " constant_IV_size=\"%d\" constant_IV=\"", ptr->constant_IV_size);
 		dump_data_hex(trace, (char *) ptr->constant_IV, ptr->constant_IV_size);
 		fprintf(trace, "\"  KID=\"");
 	}
 	dump_data_hex(trace, (char *) ptr->KID, 16);
-	if (ptr->version) 
+	if (ptr->version)
 		fprintf(trace, "\" crypt_byte_block=\"%d\" skip_byte_block=\"%d", ptr->crypt_byte_block, ptr->skip_byte_block);
 	fprintf(trace, "\">\n");
 	gf_isom_box_dump_done("TrackEncryptionBox", a, trace);
 	return GF_OK;
 }

Vulnerable code: 		gf_isom_box_del(a);\
	while ( (tmpName[i] != 0) && (i < to_read) ) {
	if (p->nameUTF8 && (u32) p->nameUTF8[0] == strlen(p->nameUTF8+1)) {
		if (op->frame_rate_info_flag) 
		if (op->bit_rate_info_flag) 
	
	
			
	if (ptr->version) 
Fixed code: 		gf_isom_box_del(__abox);\
	while ( (i < to_read) && (tmpName[i] != 0) ) {
	if (p->nameUTF8 && (u32) p->nameUTF8[0] == strlen(p->nameUTF8)-1) {
		if (op->frame_rate_info_flag)
		if (op->bit_rate_info_flag)



	if (ptr->version)