An issue was discovered in GPAC before 0.8.0, as demonstrated by MP4Box. It contains an invalid memory read in gf_m2ts_process_pmt in media_tools/mpegts.c that can cause a denial of service via a crafted MP4 file.
Hi,
Our fuzzer found a crash on MP4Box (the latest commit 987169b on master) due to an invalid read on function gf_m2ts_process_pmt (mpegts.c:2373).
PoC: https://github.com/strongcourage/PoCs/blob/master/gpac_987169b/PoC_re_mpegts.c:2373
Command: MP4Box -info $PoC
ASAN says:
~~~
/home/dungnguyen/gueb-testing/gpac-head/src/media_tools/mpegts.c:1655:25: runtime error: left shift of negative value -77
~~~
Valgrind says:
~~~
==22089== Invalid read of size 1
==22089==    at 0xBC1918: gf_m2ts_process_pmt (mpegts.c:2373)
==22089==    by 0xBAD409: gf_m2ts_section_complete (mpegts.c:1610)
==22089==    by 0xBAE791: gf_m2ts_gather_section.isra.14 (mpegts.c:1740)
==22089==    by 0xBB8FFF: gf_m2ts_process_packet (mpegts.c:3446)
==22089==    by 0xBB8FFF: gf_m2ts_process_data (mpegts.c:3507)
==22089==    by 0xBD3B58: gf_m2ts_probe_file (mpegts.c:4641)
==22089==    by 0xB9B594: gf_media_import (media_import.c:10998)
==22089==    by 0x49B08B: convert_file_info (fileimport.c:124)
==22089==    by 0x4621D5: mp4boxMain (main.c:4804)
==22089==    by 0x57BC82F: (below main) (libc-start.c:291)
==22089==  Address 0x5d8e773 is 29 bytes before a block of size 80 in arena "client"
~~~
Thanks,
Manh Dung
Runtime error: left shift of negative value (mpegts.c:2373)
This is a GitHub Issue
repo:gpac
owner:gpac
Title : Runtime error: left shift of negative value (mpegts.c:2373)
Issue date:

--- start body ---
Hi,
Our fuzzer found a crash on MP4Box (the latest commit 987169b on master) due to an invalid read on function gf_m2ts_process_pmt (mpegts.c:2373).
PoC: https://github.com/strongcourage/PoCs/blob/master/gpac_987169b/PoC_re_mpegts.c:2373
Command: MP4Box -info $PoC
ASAN says:
~~~
/home/dungnguyen/gueb-testing/gpac-head/src/media_tools/mpegts.c:1655:25: runtime error: left shift of negative value -77
~~~
Valgrind says:
~~~
==22089== Invalid read of size 1
==22089==    at 0xBC1918: gf_m2ts_process_pmt (mpegts.c:2373)
==22089==    by 0xBAD409: gf_m2ts_section_complete (mpegts.c:1610)
==22089==    by 0xBAE791: gf_m2ts_gather_section.isra.14 (mpegts.c:1740)
==22089==    by 0xBB8FFF: gf_m2ts_process_packet (mpegts.c:3446)
==22089==    by 0xBB8FFF: gf_m2ts_process_data (mpegts.c:3507)
==22089==    by 0xBD3B58: gf_m2ts_probe_file (mpegts.c:4641)
==22089==    by 0xB9B594: gf_media_import (media_import.c:10998)
==22089==    by 0x49B08B: convert_file_info (fileimport.c:124)
==22089==    by 0x4621D5: mp4boxMain (main.c:4804)
==22089==    by 0x57BC82F: (below main) (libc-start.c:291)
==22089==  Address 0x5d8e773 is 29 bytes before a block of size 80 in arena "client"
~~~
Thanks,
Manh Dung
--- end body ---
