Project: gpac (gpac/gpac), language: c++
Vulnerability instance: gpac.cve-2023-4754
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: Huntr
## URL: https://huntr.dev/bounties/b7ed24ad-7d0b-40b7-8f4d-3c18a906620c
## Description:
Description
Heap-buffer-overflow in MP4Box.
Version
$ ./bin/gcc/MP4Box -version
MP4Box - GPAC version 2.3-DEV-revrelease
(c) 2000-2023 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
    GPAC Filters: https://doi.org/10.1145/3339825.3394929
    GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --enable-sanitizer
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SSL GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D
Reproduce
complie and run
./configure --enable-sanitizer
make
Proof of Concept
./bin/gcc/MP4Box -dash 1000 -out /dev/null ./crash1
POC_crash000394 is here
ASAN
information reported by sanitizer
$ ./bin/gcc/MP4Box -dash 1000 ./crash000394
SWF Import - Scene Size 37.7x-30.65 - 512 frames @ 0 FPS
[TXTIn] swf -> svg not fully migrated, using SWF flags 0 and no flatten angle. Patch welcome
[Dasher] No template assigned, using $File$_dash$FS$$Number$
[Dasher] No bitrate property assigned to PID crash000394, computing from bitstream
[SWF Parsing] Tag UnknownTag (0x1a4) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x1bd) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x12f) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x15b) not implemented - skipping (frame 1)
[SWF Parsing] tag DefineShape3 over-read of 20608 bytes (size 23) (frame 1)
[SWF Parsing] Tag UnknownTag (0x1d0) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x1d5) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x144) not implemented - skipping (frame 1)
=================================================================
==491931==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000002750 at pc 0x7f555206c5d3 bp 0x7fff4f3717c0 sp 0x7fff4f3717b0
WRITE of size 4 at 0x602000002750 thread T0
    #0 0x7f555206c5d2 in swf_def_font scene_manager/swf_parse.c:1449
    #1 0x7f555206c5d2 in swf_process_tag scene_manager/swf_parse.c:2350
    #2 0x7f555206c5d2 in swf_parse_tag scene_manager/swf_parse.c:2422
    #3 0x7f555275c089 in gf_text_process_swf filters/load_text.c:2542
    #4 0x7f555275c089 in gf_text_process_swf filters/load_text.c:2519
    #5 0x7f55527714a2 in txtin_process filters/load_text.c:3992
    #6 0x7f5552469dbe in gf_filter_process_task filter_core/filter.c:2971
    #7 0x7f55524290ea in gf_fs_thread_proc filter_core/filter_session.c:1962
    #8 0x7f5552436a56 in gf_fs_run filter_core/filter_session.c:2261
    #9 0x7f5551dcc03d in gf_dasher_process media_tools/dash_segmenter.c:1236
    #10 0x560d3aaebc26 in do_dash /home/functionmain/Desktop/gpac-master-asan/applications/mp4box/mp4box.c:4825
    #11 0x560d3aaebc26 in mp4box_main /home/functionmain/Desktop/gpac-master-asan/applications/mp4box/mp4box.c:6239
    #12 0x7f554f078082 in __libc_start_main ../csu/libc-start.c:308
    #13 0x560d3aac3fcd in _start (/home/functionmain/Desktop/gpac-master-asan/bin/gcc/MP4Box+0xa5fcd)

0x602000002751 is located 0 bytes to the right of 1-byte region [0x602000002750,0x602000002751)
allocated by thread T0 here:
    #0 0x7f5555079808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
    #1 0x7f5552068180 in swf_def_font scene_manager/swf_parse.c:1448
    #2 0x7f5552068180 in swf_process_tag scene_manager/swf_parse.c:2350
    #3 0x7f5552068180 in swf_parse_tag scene_manager/swf_parse.c:2422
    #4 0x7f555275c089 in gf_text_process_swf filters/load_text.c:2542
    #5 0x7f555275c089 in gf_text_process_swf filters/load_text.c:2519
    #6 0x7f55527714a2 in txtin_process filters/load_text.c:3992
    #7 0x7f5552469dbe in gf_filter_process_task filter_core/filter.c:2971
    #8 0x7f55524290ea in gf_fs_thread_proc filter_core/filter_session.c:1962
    #9 0x7f5552436a56 in gf_fs_run filter_core/filter_session.c:2261
    #10 0x7f5551dcc03d in gf_dasher_process media_tools/dash_segmenter.c:1236
    #11 0x560d3aaebc26 in do_dash /home/functionmain/Desktop/gpac-master-asan/applications/mp4box/mp4box.c:4825
    #12 0x560d3aaebc26 in mp4box_main /home/functionmain/Desktop/gpac-master-asan/applications/mp4box/mp4box.c:6239
    #13 0x7f554f078082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-buffer-overflow scene_manager/swf_parse.c:1449 in swf_def_font
Shadow bytes around the buggy address:
  0x0c047fff8490: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fa
  0x0c047fff84a0: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa
  0x0c047fff84b0: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fd
  0x0c047fff84c0: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fa
  0x0c047fff84d0: fa fa fd fa fa fa 00 00 fa fa 00 00 fa fa 00 00
=>0x0c047fff84e0: fa fa 00 00 fa fa 00 00 fa fa[01]fa fa fa fa fa
  0x0c047fff84f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8510: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8520: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8530: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==491931==ABORTING
Impact
This is capable of causing crashes.
References
POC_crash000394 is here
Impact
This is capable of causing crashes.

Relevant Links:
https://github.com/gpac/gpac
https://gitee.com/FUNctionMain/mypoc/raw/master/poc_heap_buffer_overflow/crash000394
https://gitee.com/FUNctionMain/mypoc/raw/master/poc_heap_buffer_overflow/crash000394
https://gitee.com/FUNctionMain/mypoc/raw/master/poc_heap_buffer_overflow/crash000394

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./configure --static-build --extra-cflags="${CFLAGS}" --extra-ldflags="${CFLAGS}"
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y build-essential pkg-config libz-dev
RUN git clone https://github.com/gpac/gpac gpac
RUN git -C gpac checkout a8bc2c8c2ca2af95fb2e659caf8a45cd9c2d543b
WORKDIR $SRC/gpac
COPY build.sh $SRC/

Additional files: