CVE-2023-4758 (published 2023-09-04T16:15Z)

Buffer Over-read in GitHub repository gpac/gpac prior to 2.3-DEV.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2023-08-31 11:37:34+02:00
msg: fixed #2573
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: avilib.c
change_type: ModificationType.MODIFY
diff: @@ -2077,11 +2077,13 @@ int avi_parse_input_file(avi_t *AVI, int getIndex)
 						alBITMAPINFOHEADER bih;
 
 						memcpy(&bih, hdrl_data + i, sizeof(alBITMAPINFOHEADER));
-						AVI->bitmap_info_header = (alBITMAPINFOHEADER *)
-						                          gf_malloc(str2ulong((unsigned char *)&bih.bi_size));
+						bih.bi_size = str2ulong((unsigned char *)&bih.bi_size);
+
+						if (i + bih.bi_size > hdrl_len) ERR_EXIT(AVI_ERR_READ)
+
+						AVI->bitmap_info_header = (alBITMAPINFOHEADER *) gf_malloc(bih.bi_size);
 						if (AVI->bitmap_info_header != NULL)
-							memcpy(AVI->bitmap_info_header, hdrl_data + i,
-							       str2ulong((unsigned char *)&bih.bi_size));
+							memcpy(AVI->bitmap_info_header, hdrl_data + i, bih.bi_size);
 
 						AVI->width  = str2ulong(hdrl_data+i+4);
 						AVI->height = str2ulong(hdrl_data+i+8);
@@ -2154,6 +2156,8 @@ int avi_parse_input_file(avi_t *AVI, int getIndex)
 					{
 
 						a = (char*)hdrl_data+i;
+						int avail = hdrl_len-i;
+						if (avail<32) ERR_EXIT(AVI_ERR_READ)
 
 						AVI->video_superindex = (avisuperindex_chunk *) gf_malloc (sizeof (avisuperindex_chunk));
 						memset(AVI->video_superindex, 0, sizeof (avisuperindex_chunk));
@@ -2180,6 +2184,8 @@ int avi_parse_input_file(avi_t *AVI, int getIndex)
 						if (AVI->video_superindex->bIndexSubType != 0) {
 							GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[avilib] Invalid Header, bIndexSubType != 0\n"));
 						}
+						avail -= 32;
+						if (avail < AVI->video_superindex->nEntriesInUse*16) ERR_EXIT(AVI_ERR_READ)
 
 						AVI->video_superindex->aIndex = (avisuperindex_entry*)
 						                                gf_malloc (AVI->video_superindex->wLongsPerEntry * AVI->video_superindex->nEntriesInUse * sizeof (u32));
@@ -2221,6 +2227,8 @@ int avi_parse_input_file(avi_t *AVI, int getIndex)
 					{
 
 						a = (char*) hdrl_data+i;
+						int avail = hdrl_len-i;
+						if (avail<32) ERR_EXIT(AVI_ERR_READ)
 
 						AVI->track[AVI->aptr].audio_superindex = (avisuperindex_chunk *) gf_malloc (sizeof (avisuperindex_chunk));
 						memcpy (AVI->track[AVI->aptr].audio_superindex->fcc, a, 4);
@@ -2247,6 +2255,9 @@ int avi_parse_input_file(avi_t *AVI, int getIndex)
 							GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[avilib] Invalid Header, bIndexSubType != 0\n"));
 						}
 
+						avail -= 32;
+						if (avail < AVI->track[AVI->aptr].audio_superindex->nEntriesInUse*16) ERR_EXIT(AVI_ERR_READ)
+
 						AVI->track[AVI->aptr].audio_superindex->aIndex = (avisuperindex_entry*)
 						        gf_malloc (AVI->track[AVI->aptr].audio_superindex->wLongsPerEntry *
 						                   AVI->track[AVI->aptr].audio_superindex->nEntriesInUse * sizeof (u32));

programming_language: C