CVE-2021-31255: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: Buffer overflow in the abst_box_read function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 7.8
Published: 2021-04-19T19:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/box_code_adobe.c
Commit date: 2021-04-08 10:07:35 +0200
Commit message: fixed #1733

Diff: diff --git a/src/isomedia/box_code_adobe.c b/src/isomedia/box_code_adobe.c
index ab5115f25a4..711d84bf0d9 100644
--- a/src/isomedia/box_code_adobe.c
+++ b/src/isomedia/box_code_adobe.c
@@ -77,10 +77,11 @@ GF_Err abst_box_read(GF_Box *s, GF_BitStream *bs)
 {
 	GF_AdobeBootstrapInfoBox *ptr = (GF_AdobeBootstrapInfoBox *)s;
 	int i;
 	u32 tmp_strsize;
 	char *tmp_str;
+	Bool zfound=GF_FALSE;
 	GF_Err e;
 
 	ISOM_DECREASE_SIZE(ptr, 25)
 	ptr->bootstrapinfo_version = gf_bs_read_u32(bs);
 	ptr->profile = gf_bs_read_int(bs, 2);
@@ -100,79 +101,103 @@ GF_Err abst_box_read(GF_Box *s, GF_BitStream *bs)
 
 	while (tmp_strsize) {
 		ISOM_DECREASE_SIZE(ptr, 1)
 		tmp_str[i] = gf_bs_read_u8(bs);
 		tmp_strsize--;
-		if (!tmp_str[i])
+		if (!tmp_str[i]) {
+			zfound = GF_TRUE;
 			break;
+		}
 		i++;
 	}
+	if (!zfound)
+		return GF_ISOM_INVALID_FILE;
 	if (i) {
 		ptr->movie_identifier = gf_strdup(tmp_str);
 	}
 
 	ISOM_DECREASE_SIZE(ptr, 1)
 	ptr->server_entry_count = gf_bs_read_u8(bs);
 	for (i=0; i<ptr->server_entry_count; i++) {
 		int j=0;
+		zfound = GF_FALSE;
 		tmp_strsize=(u32)ptr->size;
 		while (tmp_strsize) {
 			ISOM_DECREASE_SIZE(ptr, 1)
 			tmp_str[j] = gf_bs_read_u8(bs);
 			tmp_strsize--;
-			if (!tmp_str[j])
+			if (!tmp_str[j]) {
+				zfound = GF_TRUE;
 				break;
+			}
 			j++;
 		}
+		if (!zfound)
+			return GF_ISOM_INVALID_FILE;
 		if (j) {
 			gf_list_insert(ptr->server_entry_table, gf_strdup(tmp_str), i);
 		}
 	}
 
 	ISOM_DECREASE_SIZE(ptr, 1)
 	ptr->quality_entry_count = gf_bs_read_u8(bs);
 	for (i=0; i<ptr->quality_entry_count; i++) {
 		int j=0;
+		zfound = GF_FALSE;
 		tmp_strsize=(u32)ptr->size;
 		while (tmp_strsize) {
 			ISOM_DECREASE_SIZE(ptr, 1)
 			tmp_str[j] = gf_bs_read_u8(bs);
 			tmp_strsize--;
-			if (!tmp_str[j])
+			if (!tmp_str[j]) {
+				zfound = GF_TRUE;
 				break;
+			}
 			j++;
 		}
 
+		if (!zfound)
+			return GF_ISOM_INVALID_FILE;
 		if (j) {
 			gf_list_insert(ptr->quality_entry_table, gf_strdup(tmp_str), i);
 		}
 	}
 
 	i=0;
 	tmp_strsize=(u32)ptr->size;
+	zfound = GF_FALSE;
 	while (tmp_strsize) {
 		ISOM_DECREASE_SIZE(ptr, 1)
 		tmp_str[i] = gf_bs_read_u8(bs);
 		tmp_strsize--;
-		if (!tmp_str[i])
+		if (!tmp_str[i]) {
+			zfound = GF_TRUE;
 			break;
+		}
 		i++;
 	}
+	if (!zfound)
+		return GF_ISOM_INVALID_FILE;
 	if (i) {
 		ptr->drm_data = gf_strdup(tmp_str);
 	}
 
 	i=0;
 	tmp_strsize=(u32)ptr->size;
+	zfound = GF_FALSE;
 	while (tmp_strsize) {
 		ISOM_DECREASE_SIZE(ptr, 1)
 		tmp_str[i] = gf_bs_read_u8(bs);
 		tmp_strsize--;
-		if (!tmp_str[i])
+		if (!tmp_str[i]) {
+			zfound = GF_TRUE;
 			break;
+		}
 		i++;
 	}
+	if (!zfound)
+		return GF_ISOM_INVALID_FILE;
 	if (i) {
 		ptr->meta_data = gf_strdup(tmp_str);
 	}
 
 	ISOM_DECREASE_SIZE(ptr, 1)

Vulnerable code: 		if (!tmp_str[i])
			if (!tmp_str[j])
			if (!tmp_str[j])
		if (!tmp_str[i])
		if (!tmp_str[i])
Fixed code: 	Bool zfound=GF_FALSE;
		if (!tmp_str[i]) {
			zfound = GF_TRUE;
		}
	if (!zfound)
		return GF_ISOM_INVALID_FILE;
		zfound = GF_FALSE;
			if (!tmp_str[j]) {
				zfound = GF_TRUE;
			}
		if (!zfound)
			return GF_ISOM_INVALID_FILE;
		zfound = GF_FALSE;
			if (!tmp_str[j]) {
				zfound = GF_TRUE;
			}
		if (!zfound)
			return GF_ISOM_INVALID_FILE;
	zfound = GF_FALSE;
		if (!tmp_str[i]) {
			zfound = GF_TRUE;
		}
	if (!zfound)
		return GF_ISOM_INVALID_FILE;
	zfound = GF_FALSE;
		if (!tmp_str[i]) {
			zfound = GF_TRUE;
		}
	if (!zfound)
		return GF_ISOM_INVALID_FILE;