CVE-2017-14646 (published 2017-09-21T17:29Z)

The AP4_AvccAtom and AP4_HvccAtom classes in Bento4 version 1.5.0-617 do not properly validate data sizes, leading to a heap-based buffer over-read and application crash in AP4_DataBuffer::SetData in Core/Ap4DataBuffer.cpp.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/axiomatic-systems/Bento4
commit_details: repo_url: https://github.com/axiomatic-systems/Bento4
author: Gilles Boccon-Gibod
author_date: 2017-09-09 15:56:56-07:00
msg: fix for #188
repository: repo_url: https://github.com/axiomatic-systems/Bento4
repo_name: axiomatic-systems/Bento4
description: Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
repo_language: C++
owner: axiomatic-systems
file_changes: filename: Ap4AvccAtom.cpp
change_type: ModificationType.MODIFY
diff: @@ -152,18 +152,28 @@ AP4_AvccAtom::AP4_AvccAtom(AP4_UI32 size, const AP4_UI08* payload) :
     m_SequenceParameters.EnsureCapacity(num_seq_params);
     unsigned int cursor = 6;
     for (unsigned int i=0; i<num_seq_params; i++) {
-        m_SequenceParameters.Append(AP4_DataBuffer());
-        AP4_UI16 param_length = AP4_BytesToInt16BE(&payload[cursor]);
-        m_SequenceParameters[i].SetData(&payload[cursor]+2, param_length);
-        cursor += 2+param_length;
+        if (cursor+2 <= payload_size) {
+            AP4_UI16 param_length = AP4_BytesToInt16BE(&payload[cursor]);
+            cursor += 2;
+            if (cursor + param_length < payload_size) {
+                m_SequenceParameters.Append(AP4_DataBuffer());
+                m_SequenceParameters[i].SetData(&payload[cursor], param_length);
+                cursor += param_length;
+            }
+        }
     }
     AP4_UI08 num_pic_params = payload[cursor++];
     m_PictureParameters.EnsureCapacity(num_pic_params);
     for (unsigned int i=0; i<num_pic_params; i++) {
-        m_PictureParameters.Append(AP4_DataBuffer());
-        AP4_UI16 param_length = AP4_BytesToInt16BE(&payload[cursor]);
-        m_PictureParameters[i].SetData(&payload[cursor]+2, param_length);
-        cursor += 2+param_length;
+        if (cursor+2 <= payload_size) {
+            AP4_UI16 param_length = AP4_BytesToInt16BE(&payload[cursor]);
+            cursor += 2;
+            if (cursor + param_length < payload_size) {
+                m_PictureParameters.Append(AP4_DataBuffer());
+                m_PictureParameters[i].SetData(&payload[cursor], param_length);
+                cursor += param_length;
+            }
+        }
     }
 }
 

programming_language: C++
filename: Ap4HvccAtom.cpp
change_type: ModificationType.MODIFY
diff: @@ -247,6 +247,9 @@ AP4_HvccAtom::AP4_HvccAtom(AP4_UI32 size, const AP4_UI08* payload) :
 {
     // make a copy of our configuration bytes
     unsigned int payload_size = size-AP4_ATOM_HEADER_SIZE;
+
+    // keep a raw copy
+    if (payload_size < 22) return;
     m_RawBytes.SetData(payload, payload_size);
 
     // parse the payload

programming_language: C++