CVE-2023-0760 (published 2023-02-09T14:15Z)

Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to V2.1.0-DEV.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-122
cwe_name: Heap-based Buffer Overflow
description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: Aurelien David
author_date: 2023-02-08 16:52:00+01:00
msg: sgpd box entry: disallow null grouping_type (#2389)
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: box_code_base.c
change_type: ModificationType.MODIFY
diff: @@ -4429,7 +4429,7 @@ GF_Err video_sample_entry_box_size(GF_Box *s)
 
 	/*VVC*/
 	gf_isom_check_position(s, (GF_Box *)ptr->vvc_config, &pos);
-	
+
 	/*AV1*/
 	gf_isom_check_position(s, (GF_Box *)ptr->av1_config, &pos);
 
@@ -8857,7 +8857,7 @@ GF_Err dac3_box_write(GF_Box *s, GF_BitStream *bs)
 	e = gf_isom_box_write_header(s, bs);
 	if (ptr->cfg.is_ec3) s->type = GF_ISOM_BOX_TYPE_DAC3;
 	if (e) return e;
-	
+
 	e = gf_odf_ac3_cfg_write_bs(&ptr->cfg, bs);
 	if (e) return e;
 
@@ -9983,6 +9983,9 @@ static void *sgpd_parse_entry(u32 grouping_type, GF_BitStream *bs, s32 bytes_in_
 		}
 		return ptr;
 	}
+	case 0:
+		GF_LOG(GF_LOG_WARNING, GF_LOG_CONTAINER, ("[iso file] sgpd entry null grouping_type is invalid\n") );
+		return NULL;
 	default:
 		break;
 	}

programming_language: C
filename: box_funcs.c
change_type: ModificationType.MODIFY
diff: @@ -104,7 +104,7 @@ GF_Err gf_isom_box_parse_ex(GF_Box **outBox, GF_BitStream *bs, u32 parent_type,
 	GF_Box *newBox;
 	Bool skip_logs = (gf_bs_get_cookie(bs) & GF_ISOM_BS_COOKIE_NO_LOGS ) ? GF_TRUE : GF_FALSE;
 	Bool is_special = GF_TRUE;
-	
+
 	if ((bs == NULL) || (outBox == NULL) ) return GF_BAD_PARAM;
 	*outBox = NULL;
 	if (gf_bs_available(bs) < 8) {
@@ -1528,7 +1528,7 @@ static struct box_registry_entry {
 	BOX_DEFINE_S_CHILD( GF_QT_SUBTYPE_YVYU, video_sample_entry, "stsd", "apple"),
 	BOX_DEFINE_S_CHILD( GF_QT_SUBTYPE_RGBA, video_sample_entry, "stsd", "apple"),
 	BOX_DEFINE_S_CHILD( GF_QT_SUBTYPE_ABGR, video_sample_entry, "stsd", "apple"),
-	
+
 	FBOX_DEFINE_S(GF_QT_BOX_TYPE_STPS, stss, "stbl", 0, "apple"),
 
 	//dolby boxes
@@ -1918,7 +1918,7 @@ void gf_isom_check_position(GF_Box *s, GF_Box *child, u32 *pos)
 
 	s32 cur_pos = gf_list_find(s->child_boxes, child);
 
-	//happens when partially cloning boxes 
+	//happens when partially cloning boxes
 	if (cur_pos < 0) return;
 
 	if (cur_pos != (s32) *pos) {
@@ -1949,7 +1949,7 @@ GF_Err gf_isom_box_write(GF_Box *a, GF_BitStream *bs)
 	if (!a) return GF_BAD_PARAM;
 	//box has been disabled, do not write
 	if (!a->size) return GF_OK;
-	
+
 	if (a->registry->disabled) {
 		GF_LOG(GF_LOG_DEBUG, GF_LOG_CONTAINER, ("[iso file] Box %s disabled registry, skip write\n", gf_4cc_to_str(a->type)));
 		return GF_OK;

programming_language: C
filename: isom_read.c
change_type: ModificationType.MODIFY
diff: @@ -2304,7 +2304,7 @@ GF_Err gf_isom_get_sample_for_media_time(GF_ISOFile *the_file, u32 trackNumber,
 	}
 	if (static_sample && ! (*sample)->alloc_size )
 		 (*sample)->alloc_size =  (*sample)->dataLength;
-		 
+
 	return GF_OK;
 }
 
@@ -4674,7 +4674,7 @@ const u32 *gf_isom_get_track_switch_parameter(GF_ISOFile *movie, u32 trackNumber
 	if (!map) return NULL;
 	tsel = (GF_TrackSelectionBox*)gf_list_get(map->boxes, group_index-1);
 	if (!tsel) return NULL;
-	
+
 	*switchGroupID = tsel->switchGroup;
 	*criteriaListSize = tsel->attributeListCount;
 	return (const u32 *) tsel->attributeList;
@@ -5409,7 +5409,7 @@ GF_Err gf_isom_get_sample_cenc_info_internal(GF_TrackBox *trak, void *traf, GF_S
 	if (skip_byte_block) *skip_byte_block = 0;
 	if (key_info) *key_info = NULL;
 	if (key_info_size) *key_info_size = 0;
-	
+
 	if (!trak) return GF_BAD_PARAM;
 
 #ifdef	GPAC_DISABLE_ISOM_FRAGMENTS

programming_language: C