Project: gpac (gpac/gpac), language: c++
Vulnerability instance: gpac.cve-2019-20630
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/gpac/gpac/issues/1268
## Description:
Issue: gpac/gpac#1268
Title: heap-buffer-overflow on BS_ReadByte
State: closed
Created by: strongcourage
Created at: 2019-07-06 00:10:13+00:00

Issue Body:
Hi,
Our fuzzer found a buffer overflow on MP4Box (the latest commit 987169b on master).
PoC: https://github.com/strongcourage/PoCs/blob/master/gpac_987169b/PoC_hbo_BS_ReadByte
Command: MP4Box -info $PoC
ASAN says:
~~~
==27934==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b00000a236 at pc 0x00000047c2aa bp 0x7ffded5429d0 sp 0x7ffded5429c0
READ of size 1 at 0x60b00000a236 thread T0
    #0 0x47c2a9 in BS_ReadByte /home/dungnguyen/gueb-testing/gpac-head/src/utils/bitstream.c:253
    #1 0x47c2a9 in gf_bs_read_bit /home/dungnguyen/gueb-testing/gpac-head/src/utils/bitstream.c:287
    #2 0x47ecc7 in gf_bs_read_double /home/dungnguyen/gueb-testing/gpac-head/src/utils/bitstream.c:444
    #3 0x85122d in gf_odf_read_mediatime /home/dungnguyen/gueb-testing/gpac-head/src/odf/odf_code.c:1471
    #4 0x8412bb in gf_odf_parse_descriptor /home/dungnguyen/gueb-testing/gpac-head/src/odf/descriptors.c:159
    #5 0x84b027 in gf_odf_read_iod /home/dungnguyen/gueb-testing/gpac-head/src/odf/odf_code.c:505
    #6 0x8412bb in gf_odf_parse_descriptor /home/dungnguyen/gueb-testing/gpac-head/src/odf/descriptors.c:159
    #7 0x9808b0 in gf_m2ts_process_pmt /home/dungnguyen/gueb-testing/gpac-head/src/media_tools/mpegts.c:2179
    #8 0x970944 in gf_m2ts_section_complete /home/dungnguyen/gueb-testing/gpac-head/src/media_tools/mpegts.c:1610
    #9 0x971fa2 in gf_m2ts_gather_section /home/dungnguyen/gueb-testing/gpac-head/src/media_tools/mpegts.c:1740
    #10 0x97991c in gf_m2ts_process_packet /home/dungnguyen/gueb-testing/gpac-head/src/media_tools/mpegts.c:3446
    #11 0x97991c in gf_m2ts_process_data /home/dungnguyen/gueb-testing/gpac-head/src/media_tools/mpegts.c:3507
    #12 0x986f65 in gf_m2ts_probe_file /home/dungnguyen/gueb-testing/gpac-head/src/media_tools/mpegts.c:4641
    #13 0x963fa9 in gf_media_import /home/dungnguyen/gueb-testing/gpac-head/src/media_tools/media_import.c:10998
    #14 0x45b475 in convert_file_info /home/dungnguyen/gueb-testing/gpac-head/applications/mp4box/fileimport.c:124
    #15 0x43ac0c in mp4boxMain /home/dungnguyen/gueb-testing/gpac-head/applications/mp4box/main.c:4804
    #16 0x7fe2e64fa82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #17 0x421eb8 in _start (/home/dungnguyen/PoCs/gpac_987169b/MP4Box-asan+0x421eb8)
~~~
Thanks,
Manh Dung


Comments:
Comment by jeanlf on 2019-07-07 15:59:28+00:00:
thanks for the report, now fixed

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./configure --static-build --extra-cflags="${CFLAGS}" --extra-ldflags="${CFLAGS}"
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y build-essential pkg-config libz-dev
RUN git clone https://github.com/gpac/gpac gpac
RUN git -C gpac checkout f0af02425883b2e1c651c6d0c602e1259b67a6b6
WORKDIR $SRC/gpac
COPY build.sh $SRC/

Additional files:
filename: fuzz_parse.c
content: /* Copyright 2021 Google LLC
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
      http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#include <stdio.h>
#include <unistd.h>

#include <gpac/internal/isomedia_dev.h>
#include <gpac/constants.h>

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
    char filename[256];
    sprintf(filename, "/tmp/libfuzzer.%d", getpid());

    FILE *fp = fopen(filename, "wb");
    if (!fp) {
        return 0;
    }
    fwrite(data, size, 1, fp);
    fclose(fp);

    GF_ISOFile *movie = NULL;
    movie = gf_isom_open_file(filename, GF_ISOM_OPEN_READ_DUMP, NULL);
    if (movie != NULL) {
        gf_isom_close(movie);
    }
    unlink(filename);
    return 0;
}