CVE-2020-23931: Out-of-bounds Read (CWE-125)
value: An issue was discovered in gpac before 1.0.1. The abst_box_read function in box_code_adobe.c has a heap-based buffer over-read.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.1
Published: 2021-04-21T18:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/box_code_adobe.c
Commit date: 2020-09-01 16:42:40 +0200
Commit message: fixed #1564

Diff: diff --git a/src/isomedia/box_code_adobe.c b/src/isomedia/box_code_adobe.c
index 80be6f33ef..eafdabff13 100644
--- a/src/isomedia/box_code_adobe.c
+++ b/src/isomedia/box_code_adobe.c
@@ -97,25 +97,28 @@ GF_Err abst_box_read(GF_Box *s, GF_BitStream *bs)
 	tmp_str = gf_malloc(sizeof(char)*tmp_strsize);
 	if (!tmp_str) return GF_OUT_OF_MEM;
 	memset(tmp_str, 0, sizeof(char)*tmp_strsize);
 
 	while (tmp_strsize) {
+		ISOM_DECREASE_SIZE(ptr, 1)
 		tmp_str[i] = gf_bs_read_u8(bs);
 		tmp_strsize--;
 		if (!tmp_str[i])
 			break;
 		i++;
 	}
 	if (i) {
 		ptr->movie_identifier = gf_strdup(tmp_str);
 	}
 
+	ISOM_DECREASE_SIZE(ptr, 1)
 	ptr->server_entry_count = gf_bs_read_u8(bs);
 	for (i=0; i<ptr->server_entry_count; i++) {
 		int j=0;
-		tmp_strsize=(u32)ptr->size-8;
+		tmp_strsize=(u32)ptr->size;
 		while (tmp_strsize) {
+			ISOM_DECREASE_SIZE(ptr, 1)
 			tmp_str[j] = gf_bs_read_u8(bs);
 			tmp_strsize--;
 			if (!tmp_str[j])
 				break;
 			j++;
@@ -123,15 +126,17 @@ GF_Err abst_box_read(GF_Box *s, GF_BitStream *bs)
 		if (j) {
 			gf_list_insert(ptr->server_entry_table, gf_strdup(tmp_str), i);
 		}
 	}
 
+	ISOM_DECREASE_SIZE(ptr, 1)
 	ptr->quality_entry_count = gf_bs_read_u8(bs);
 	for (i=0; i<ptr->quality_entry_count; i++) {
 		int j=0;
-		tmp_strsize=(u32)ptr->size-8;
+		tmp_strsize=(u32)ptr->size;
 		while (tmp_strsize) {
+			ISOM_DECREASE_SIZE(ptr, 1)
 			tmp_str[j] = gf_bs_read_u8(bs);
 			tmp_strsize--;
 			if (!tmp_str[j])
 				break;
 			j++;
@@ -141,12 +146,13 @@ GF_Err abst_box_read(GF_Box *s, GF_BitStream *bs)
 			gf_list_insert(ptr->quality_entry_table, gf_strdup(tmp_str), i);
 		}
 	}
 
 	i=0;
-	tmp_strsize=(u32)ptr->size-8;
+	tmp_strsize=(u32)ptr->size;
 	while (tmp_strsize) {
+		ISOM_DECREASE_SIZE(ptr, 1)
 		tmp_str[i] = gf_bs_read_u8(bs);
 		tmp_strsize--;
 		if (!tmp_str[i])
 			break;
 		i++;
@@ -154,22 +160,24 @@ GF_Err abst_box_read(GF_Box *s, GF_BitStream *bs)
 	if (i) {
 		ptr->drm_data = gf_strdup(tmp_str);
 	}
 
 	i=0;
-	tmp_strsize=(u32)ptr->size-8;
+	tmp_strsize=(u32)ptr->size;
 	while (tmp_strsize) {
+		ISOM_DECREASE_SIZE(ptr, 1)
 		tmp_str[i] = gf_bs_read_u8(bs);
 		tmp_strsize--;
 		if (!tmp_str[i])
 			break;
 		i++;
 	}
 	if (i) {
 		ptr->meta_data = gf_strdup(tmp_str);
 	}
 
+	ISOM_DECREASE_SIZE(ptr, 1)
 	ptr->segment_run_table_count = gf_bs_read_u8(bs);
 	for (i=0; i<ptr->segment_run_table_count; i++) {
 		GF_AdobeSegmentRunTableBox *asrt = NULL;
 		e = gf_isom_box_parse((GF_Box **)&asrt, bs);
 		if (e) {
@@ -178,10 +186,11 @@ GF_Err abst_box_read(GF_Box *s, GF_BitStream *bs)
 			return e;
 		}
 		gf_list_add(ptr->segment_run_table_entries, asrt);
 	}
 
+	ISOM_DECREASE_SIZE(ptr, 1)
 	ptr->fragment_run_table_count = gf_bs_read_u8(bs);
 	for (i=0; i<ptr->fragment_run_table_count; i++) {
 		GF_AdobeFragmentRunTableBox *afrt = NULL;
 		e = gf_isom_box_parse((GF_Box **)&afrt, bs);
 		if (e) {

Vulnerable code: 		tmp_strsize=(u32)ptr->size-8;
		tmp_strsize=(u32)ptr->size-8;
	tmp_strsize=(u32)ptr->size-8;
	tmp_strsize=(u32)ptr->size-8;
Fixed code: 		ISOM_DECREASE_SIZE(ptr, 1)
	ISOM_DECREASE_SIZE(ptr, 1)
		tmp_strsize=(u32)ptr->size;
			ISOM_DECREASE_SIZE(ptr, 1)
	ISOM_DECREASE_SIZE(ptr, 1)
		tmp_strsize=(u32)ptr->size;
			ISOM_DECREASE_SIZE(ptr, 1)
	tmp_strsize=(u32)ptr->size;
		ISOM_DECREASE_SIZE(ptr, 1)
	tmp_strsize=(u32)ptr->size;
		ISOM_DECREASE_SIZE(ptr, 1)
	ISOM_DECREASE_SIZE(ptr, 1)
	ISOM_DECREASE_SIZE(ptr, 1)