An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer over-read in gf_m2ts_process_pmt in media_tools/mpegts.c that can cause a denial of service via a crafted MP4 file.
Hi,
Our fuzzer found a crash on MP4Box (the latest commit 987169b on master) due to a heap buffer overflow on function gf_m2ts_process_pmt.
PoC: https://github.com/strongcourage/PoCs/blob/master/gpac_987169b/PoC_hbo_gf_m2ts_process_pmt
Command: MP4Box -info $PoC
ASAN says:
~~~
==19178==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b000009add at pc 0x0000009816a6 bp 0x7ffd918f74c0 sp 0x7ffd918f74b0
READ of size 1 at 0x60b000009add thread T0
    #0 0x9816a5 in gf_m2ts_process_pmt /home/dungnguyen/gueb-testing/gpac-head/src/media_tools/mpegts.c:2372
    #1 0x970944 in gf_m2ts_section_complete /home/dungnguyen/gueb-testing/gpac-head/src/media_tools/mpegts.c:1610
    #2 0x971fa2 in gf_m2ts_gather_section /home/dungnguyen/gueb-testing/gpac-head/src/media_tools/mpegts.c:1740
    #3 0x97991c in gf_m2ts_process_packet /home/dungnguyen/gueb-testing/gpac-head/src/media_tools/mpegts.c:3446
    #4 0x97991c in gf_m2ts_process_data /home/dungnguyen/gueb-testing/gpac-head/src/media_tools/mpegts.c:3507
    #5 0x986f65 in gf_m2ts_probe_file /home/dungnguyen/gueb-testing/gpac-head/src/media_tools/mpegts.c:4641
    #6 0x963fa9 in gf_media_import /home/dungnguyen/gueb-testing/gpac-head/src/media_tools/media_import.c:10998
    #7 0x45b475 in convert_file_info /home/dungnguyen/gueb-testing/gpac-head/applications/mp4box/fileimport.c:124
    #8 0x43ac0c in mp4boxMain /home/dungnguyen/gueb-testing/gpac-head/applications/mp4box/main.c:4804
    #9 0x7f2f14c6782f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #10 0x421eb8 in _start (/home/dungnguyen/PoCs/gpac_987169b/MP4Box-asan+0x421eb8)
~~~
Thanks,
Manh Dung
SEGV (heap-buffer-overflow) on gf_m2ts_process_pmt
This is a GitHub Issue
repo:gpac
owner:gpac
Title : SEGV (heap-buffer-overflow) on gf_m2ts_process_pmt
Issue date:

--- start body ---
Hi,
Our fuzzer found a crash on MP4Box (the latest commit 987169b on master) due to a heap buffer overflow on function gf_m2ts_process_pmt.
PoC: https://github.com/strongcourage/PoCs/blob/master/gpac_987169b/PoC_hbo_gf_m2ts_process_pmt
Command: MP4Box -info $PoC
ASAN says:
~~~
==19178==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b000009add at pc 0x0000009816a6 bp 0x7ffd918f74c0 sp 0x7ffd918f74b0
READ of size 1 at 0x60b000009add thread T0
    #0 0x9816a5 in gf_m2ts_process_pmt /home/dungnguyen/gueb-testing/gpac-head/src/media_tools/mpegts.c:2372
    #1 0x970944 in gf_m2ts_section_complete /home/dungnguyen/gueb-testing/gpac-head/src/media_tools/mpegts.c:1610
    #2 0x971fa2 in gf_m2ts_gather_section /home/dungnguyen/gueb-testing/gpac-head/src/media_tools/mpegts.c:1740
    #3 0x97991c in gf_m2ts_process_packet /home/dungnguyen/gueb-testing/gpac-head/src/media_tools/mpegts.c:3446
    #4 0x97991c in gf_m2ts_process_data /home/dungnguyen/gueb-testing/gpac-head/src/media_tools/mpegts.c:3507
    #5 0x986f65 in gf_m2ts_probe_file /home/dungnguyen/gueb-testing/gpac-head/src/media_tools/mpegts.c:4641
    #6 0x963fa9 in gf_media_import /home/dungnguyen/gueb-testing/gpac-head/src/media_tools/media_import.c:10998
    #7 0x45b475 in convert_file_info /home/dungnguyen/gueb-testing/gpac-head/applications/mp4box/fileimport.c:124
    #8 0x43ac0c in mp4boxMain /home/dungnguyen/gueb-testing/gpac-head/applications/mp4box/main.c:4804
    #9 0x7f2f14c6782f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #10 0x421eb8 in _start (/home/dungnguyen/PoCs/gpac_987169b/MP4Box-asan+0x421eb8)
~~~
Thanks,
Manh Dung
--- end body ---
