CVE-2023-5377 (C, published 2023-10-04T10:15Z)
Description: value: Out-of-bounds Read in GitHub repository gpac/gpac prior to v2.2.2-DEV.
Severity: nan (CVSS v3 base score: 7.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gpac/gpac
Files changed:
include/gpac/isomedia.h
src/isomedia/box_code_base.c
src/isomedia/isom_write.c
Commit message: fixed #2606


Vulnerable code:
	ptr->layout.stream_structure = gf_bs_read_u8(bs);
			ISOM_DECREASE_SIZE(s, 8)
			ptr->layout.omittedChannelsMap = gf_bs_read_u64(bs);
	if (ptr->layout.stream_structure & 2) {
			gf_bs_write_u64(bs, ptr->layout.omittedChannelsMap);
	if (ptr->layout.stream_structure & 2) {
			s->size += 8;
	if (ptr->layout.stream_structure & 2) {

Fixed code:
	/*!  order of formats in the stream : 0 unknown, 1: Channels, possibly followed by Objects, 2 Objects, possibly followed by Channels*/
	u8 format_ordering;
	/*! combined channel count of the channel layout and the object count*/
	u8 base_channel_count;
	/*! indicates where the ordering of the audio channels for the definedLayout are specified
	0: as listed for the ChannelConfigurations in ISO/IEC 23091-3
	1: Default order of audio codec specification
	2: Channel ordering #2 of audio codec specification
	3: Channel ordering #3 of audio codec specification
	4: Channel ordering #4 of audio codec specification
	*/
	u8 channel_order_definition;
	/*! indicates if omittedChannelsMap is present*/
	u8 omitted_channels_present;
	if (ptr->version==0) {
		ptr->layout.stream_structure = gf_bs_read_u8(bs);
	} else {
		ptr->layout.stream_structure = gf_bs_read_int(bs, 4);
		ptr->layout.format_ordering = gf_bs_read_int(bs, 4);
		ISOM_DECREASE_SIZE(s, 1)
		ptr->layout.base_channel_count = gf_bs_read_u8(bs);
	}
			u32 nb_channels = 0;
			if (ptr->version) {
				ISOM_DECREASE_SIZE(s, 1)
				nb_channels = gf_bs_read_u8(bs);
			}
				if (ptr->layout.channels_count==64) return GF_ISOM_INVALID_FILE;

				ptr->layout.channels_count++;
				if (ptr->version) {
					nb_channels--;
					if (!nb_channels) break;
				}
			if (ptr->version==0) {
				ISOM_DECREASE_SIZE(s, 8)
				ptr->layout.omittedChannelsMap = gf_bs_read_u64(bs);
				ptr->layout.omitted_channels_present = 1;
				ptr->layout.channel_order_definition = 0;
			} else {
				ISOM_DECREASE_SIZE(s, 1)
				gf_bs_read_int(bs, 4);
				ptr->layout.channel_order_definition = gf_bs_read_int(bs, 3);
				ptr->layout.omitted_channels_present = gf_bs_read_int(bs, 1);
				if (ptr->layout.omitted_channels_present) {
					ISOM_DECREASE_SIZE(s, 8)
					ptr->layout.omittedChannelsMap = gf_bs_read_u64(bs);
				}
			}
	if ((ptr->version==0) && (ptr->layout.stream_structure & 2)) {
	if (ptr->version==0) {
		gf_bs_write_u8(bs, ptr->layout.stream_structure);
	} else {
		gf_bs_write_int(bs, ptr->layout.stream_structure, 4);
		gf_bs_write_int(bs, ptr->layout.format_ordering, 4);
		gf_bs_write_u8(bs, ptr->layout.base_channel_count);
	}
			if (ptr->version==1) {
				gf_bs_write_u8(bs, ptr->layout.channels_count);
			}
			if (ptr->version==1) {
				gf_bs_write_int(bs, 0, 4);
				gf_bs_write_int(bs, ptr->layout.channel_order_definition, 3);
				gf_bs_write_int(bs, ptr->layout.omitted_channels_present, 1);
				if (ptr->layout.omitted_channels_present)
					gf_bs_write_u64(bs, ptr->layout.omittedChannelsMap);
			} else {
				gf_bs_write_u64(bs, ptr->layout.omittedChannelsMap);
			}
	if ((ptr->version==0) && (ptr->layout.stream_structure & 2)) {
	if (ptr->version==1) s->size++;
			if (ptr->version==1) s->size++;
			if (ptr->version==1) {
				s->size += 1;
				if (ptr->layout.omitted_channels_present)
					s->size += 8;
			} else {
				s->size += 8;
			}
	if ((ptr->version==0) && (ptr->layout.stream_structure & 2)) {
	if (!layout) return GF_BAD_PARAM;
	if ((layout->stream_structure & 1) && (layout->definedLayout==0) && (layout->channels_count>=64))
		return GF_BAD_PARAM;