CVE-2020-23931 (published 2021-04-21T18:15Z)

An issue was discovered in gpac before 1.0.1. The abst_box_read function in box_code_adobe.c has a heap-based buffer over-read.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 7.1, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2020-09-01 16:42:40+02:00
msg: fixed #1564
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: box_code_adobe.c
change_type: ModificationType.MODIFY
diff: @@ -99,6 +99,7 @@ GF_Err abst_box_read(GF_Box *s, GF_BitStream *bs)
 	memset(tmp_str, 0, sizeof(char)*tmp_strsize);
 
 	while (tmp_strsize) {
+		ISOM_DECREASE_SIZE(ptr, 1)
 		tmp_str[i] = gf_bs_read_u8(bs);
 		tmp_strsize--;
 		if (!tmp_str[i])
@@ -109,11 +110,13 @@ GF_Err abst_box_read(GF_Box *s, GF_BitStream *bs)
 		ptr->movie_identifier = gf_strdup(tmp_str);
 	}
 
+	ISOM_DECREASE_SIZE(ptr, 1)
 	ptr->server_entry_count = gf_bs_read_u8(bs);
 	for (i=0; i<ptr->server_entry_count; i++) {
 		int j=0;
-		tmp_strsize=(u32)ptr->size-8;
+		tmp_strsize=(u32)ptr->size;
 		while (tmp_strsize) {
+			ISOM_DECREASE_SIZE(ptr, 1)
 			tmp_str[j] = gf_bs_read_u8(bs);
 			tmp_strsize--;
 			if (!tmp_str[j])
@@ -125,11 +128,13 @@ GF_Err abst_box_read(GF_Box *s, GF_BitStream *bs)
 		}
 	}
 
+	ISOM_DECREASE_SIZE(ptr, 1)
 	ptr->quality_entry_count = gf_bs_read_u8(bs);
 	for (i=0; i<ptr->quality_entry_count; i++) {
 		int j=0;
-		tmp_strsize=(u32)ptr->size-8;
+		tmp_strsize=(u32)ptr->size;
 		while (tmp_strsize) {
+			ISOM_DECREASE_SIZE(ptr, 1)
 			tmp_str[j] = gf_bs_read_u8(bs);
 			tmp_strsize--;
 			if (!tmp_str[j])
@@ -143,8 +148,9 @@ GF_Err abst_box_read(GF_Box *s, GF_BitStream *bs)
 	}
 
 	i=0;
-	tmp_strsize=(u32)ptr->size-8;
+	tmp_strsize=(u32)ptr->size;
 	while (tmp_strsize) {
+		ISOM_DECREASE_SIZE(ptr, 1)
 		tmp_str[i] = gf_bs_read_u8(bs);
 		tmp_strsize--;
 		if (!tmp_str[i])
@@ -156,8 +162,9 @@ GF_Err abst_box_read(GF_Box *s, GF_BitStream *bs)
 	}
 
 	i=0;
-	tmp_strsize=(u32)ptr->size-8;
+	tmp_strsize=(u32)ptr->size;
 	while (tmp_strsize) {
+		ISOM_DECREASE_SIZE(ptr, 1)
 		tmp_str[i] = gf_bs_read_u8(bs);
 		tmp_strsize--;
 		if (!tmp_str[i])
@@ -168,6 +175,7 @@ GF_Err abst_box_read(GF_Box *s, GF_BitStream *bs)
 		ptr->meta_data = gf_strdup(tmp_str);
 	}
 
+	ISOM_DECREASE_SIZE(ptr, 1)
 	ptr->segment_run_table_count = gf_bs_read_u8(bs);
 	for (i=0; i<ptr->segment_run_table_count; i++) {
 		GF_AdobeSegmentRunTableBox *asrt = NULL;
@@ -180,6 +188,7 @@ GF_Err abst_box_read(GF_Box *s, GF_BitStream *bs)
 		gf_list_add(ptr->segment_run_table_entries, asrt);
 	}
 
+	ISOM_DECREASE_SIZE(ptr, 1)
 	ptr->fragment_run_table_count = gf_bs_read_u8(bs);
 	for (i=0; i<ptr->fragment_run_table_count; i++) {
 		GF_AdobeFragmentRunTableBox *afrt = NULL;

programming_language: C