{"action":"created","issue":{"url":"https://api.github.com/repos/gpac/gpac/issues/1099","repository_url":"https://api.github.com/repos/gpac/gpac","labels_url":"https://api.github.com/repos/gpac/gpac/issues/1099/labels{/name}","comments_url":"https://api.github.com/repos/gpac/gpac/issues/1099/comments","events_url":"https://api.github.com/repos/gpac/gpac/issues/1099/events","html_url":"https://github.com/gpac/gpac/issues/1099","id":337306040,"node_id":"MDU6SXNzdWUzMzczMDYwNDA=","number":1099,"title":"AddressSanitizer: invalid write at avc_ext.c:2456","user":{"login":"HongxuChen","id":843267,"node_id":"MDQ6VXNlcjg0MzI2Nw==","avatar_url":"https://avatars0.githubusercontent.com/u/843267?v=4","gravatar_id":"","url":"https://api.github.com/users/HongxuChen","html_url":"https://github.com/HongxuChen","followers_url":"https://api.github.com/users/HongxuChen/followers","following_url":"https://api.github.com/users/HongxuChen/following{/other_user}","gists_url":"https://api.github.com/users/HongxuChen/gists{/gist_id}","starred_url":"https://api.github.com/users/HongxuChen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/HongxuChen/subscriptions","organizations_url":"https://api.github.com/users/HongxuChen/orgs","repos_url":"https://api.github.com/users/HongxuChen/repos","events_url":"https://api.github.com/users/HongxuChen/events{/privacy}","received_events_url":"https://api.github.com/users/HongxuChen/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-07-01T17:09:24Z","updated_at":"2018-07-03T08:55:09Z","closed_at":"2018-07-02T15:33:42Z","author_association":"NONE","body":"POCs:\r\nhttps://github.com/ntu-sec/pocs/blob/master/gpac-bceb03f/crashes/write_avc_ext.c%3A2456_1.mp4\r\nhttps://github.com/ntu-sec/pocs/blob/master/gpac-bceb03f/crashes/write_avc_ext.c%3A2456_2.mp4\r\n\r\nasan output:\r\n```\r\n\u001B[33m[iso file] Unknown box type \r\n\u001B[0m\u001B[33m[iso file] Unknown box type \r\n\u001B[0m\u001B[33m[iso file] Unknown box type sAsd\r\n\u001B[0m\u001B[31m[iso file] Read Box type  (0x00000000) has size 0 but is not at root/file level, skipping\r\n\u001B[0m\u001B[33m[iso file] Box \"stbl\" is invalid in container dref\r\n\u001B[0m\u001B[33m[iso file] Unknown box type ...>\r\n\u001B[0m\u001B[33m[iso file] Box \"oinf\" size 522 invalid (read 4580)\r\n\u001B[0m\u001B[33m[iso file] Box \"oinf\" is invalid in container dref\r\n\u001B[0m\u001B[33m[iso file] Unknown box type ....\r\n\u001B[0m\u001B[33m[iso file] Box \"dinf\" size 36 invalid (read 4644)\r\n\u001B[0m\u001B[31m[iso file] Missing DataInformationBox\r\n\u001B[0m\u001B[33m[iso file] Unknown box type ...>\r\n\u001B[0m\u001B[33m[iso file] Box \"oinf\" size 522 invalid (read 4580)\r\n\u001B[0m\u001B[33m[iso file] Unknown box type ....\r\n\u001B[0m\u001B[33m[iso file] Box \"UNKN\" is larger than container box\r\n\u001B[0m\u001B[33m[iso file] Box \"hinf\" size 52 invalid (read 5412)\r\n\u001B[0m\u001B[33m[iso file] Unknown box type sAsd\r\n\u001B[0m\u001B[31m[iso file] Read Box type  (0x00000000) has size 0 but is not at root/file level, skipping\r\n\u001B[0m\u001B[33m[iso file] Box \"stbl\" is invalid in container dref\r\n\u001B[0m\u001B[33m[iso file] Unknown box type ...>\r\n\u001B[0m\u001B[31m[BS] Attempt to overread bitstream\r\n\u001B[0m\u001B[31m[BS] Attempt to overread bitstream\r\n\u001B[0m\u001B[31m[BS] Attempt to overread bitstream\r\n...\r\n\u001B[0m\u001B[31m[BS] Attempt to overread bitstream\r\n\u001B[0m\u001B[31m[BS] Attempt to overread bitstream\r\n\u001B[0m\u001B[31m[BS] Attempt to overread bitstream\r\n\u001B[0m\u001B[31m[BS] Attempt to overread bitstream\r\n\u001B[0m\u001B[31m[BS] Attempt to overread bitstream\r\n\u001B[0m\u001B[31m[BS] Attempt to overread bitstream\r\n\u001B[0m\u001B[33m[iso file] Box \"oinf\" size 522 invalid (read 8343)\r\n\u001B[0m\u001B[33m[iso file] Box \"oinf\" is invalid in container dref\r\n\u001B[0m\u001B[33m[iso file] Unknown box type ....\r\n\u001B[0m\u001B[33m[iso file] Box \"dinf\" size 36 invalid (read 4644)\r\n\u001B[0m\u001B[31m[iso file] Incomplete box dinf\r\n\u001B[0m\u001B[31m[iso file] Incomplete file while reading for dump - aborting parsing\r\n\u001B[0m\u001B[33m[iso file] Unknown box type \r\n\u001B[0m\u001B[33m[iso file] Unknown box type \r\n\u001B[0m\u001B[33m[iso file] Unknown box type sAsd\r\n\u001B[0m\u001B[31m[iso file] Read Box type  (0x00000000) has size 0 but is not at root/file level, skipping\r\n\u001B[0m\u001B[33m[iso file] Box \"stbl\" is invalid in container dref\r\n\u001B[0m\u001B[33m[iso file] Unknown box type ...>\r\n\u001B[0m\u001B[33m[iso file] Box \"oinf\" size 522 invalid (read 4580)\r\n\u001B[0m\u001B[33m[iso file] Box \"oinf\" is invalid in container dref\r\n\u001B[0m\u001B[33m[iso file] Unknown box type ....\r\n\u001B[0m\u001B[33m[iso file] Box \"dinf\" size 36 invalid (read 4644)\r\n\u001B[0m\u001B[31m[iso file] Missing DataInformationBox\r\n\u001B[0m\u001B[33m[iso file] Unknown box type ...>\r\n\u001B[0mAddressSanitizer:DEADLYSIGNAL\r\n=================================================================\r\n==2229==ERROR: AddressSanitizer: SEGV on unknown address 0x608000010000 (pc 0x7f76164afe62 bp 0x60800000ffa0 sp 0x7ffeebfd9c40 T0)\r\n==2229==The signal is caused by a WRITE memory access.\r\n    #0 0x7f76164afe61 in gf_isom_oinf_read_entry /home/hongxu/FOT/gpac-fuzz/src/isomedia/avc_ext.c:2456:4\r\n    #1 0x7f7616563b8c in gf_isom_box_read /home/hongxu/FOT/gpac-fuzz/src/isomedia/box_funcs.c:1349:9\r\n    #2 0x7f7616563b8c in gf_isom_box_parse_ex /home/hongxu/FOT/gpac-fuzz/src/isomedia/box_funcs.c:199\r\n    #3 0x7f7616566d8a in gf_isom_box_array_read_ex /home/hongxu/FOT/gpac-fuzz/src/isomedia/box_funcs.c:1241:7\r\n    #4 0x7f76164c2ad2 in unkn_Read /home/hongxu/FOT/gpac-fuzz/src/isomedia/box_code_base.c:755:7\r\n    #5 0x7f7616563b8c in gf_isom_box_read /home/hongxu/FOT/gpac-fuzz/src/isomedia/box_funcs.c:1349:9\r\n    #6 0x7f7616563b8c in gf_isom_box_parse_ex /home/hongxu/FOT/gpac-fuzz/src/isomedia/box_funcs.c:199\r\n    #7 0x7f7616566d8a in gf_isom_box_array_read_ex /home/hongxu/FOT/gpac-fuzz/src/isomedia/box_funcs.c:1241:7\r\n    #8 0x7f7616563b8c in gf_isom_box_read /home/hongxu/FOT/gpac-fuzz/src/isomedia/box_funcs.c:1349:9\r\n    #9 0x7f7616563b8c in gf_isom_box_parse_ex /home/hongxu/FOT/gpac-fuzz/src/isomedia/box_funcs.c:199\r\n    #10 0x7f76165628ab in gf_isom_parse_root_box /home/hongxu/FOT/gpac-fuzz/src/isomedia/box_funcs.c:42:8\r\n    #11 0x7f76165853a4 in gf_isom_parse_movie_boxes /home/hongxu/FOT/gpac-fuzz/src/isomedia/isom_intern.c:206:7\r\n    #12 0x7f761658c049 in gf_isom_open_progressive /home/hongxu/FOT/gpac-fuzz/src/isomedia/isom_read.c:378:7\r\n    #13 0x52cb2c in mp4boxMain /home/hongxu/FOT/gpac/applications/mp4box/main.c:4342:9\r\n    #14 0x5326a1 in main /home/hongxu/FOT/gpac/applications/mp4box/main.c:5489:9\r\n    #15 0x7f7615135b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310\r\n    #16 0x424989 in _start (/home/hongxu/FOT/gpac/install/bin/MP4Box+0x424989)\r\n\r\nAddressSanitizer can not provide additional info.\r\nSUMMARY: AddressSanitizer: SEGV /home/hongxu/FOT/gpac-fuzz/src/isomedia/avc_ext.c:2456:4 in gf_isom_oinf_read_entry\r\n==2229==ABORTING\r\n```"},"comment":{"url":"https://api.github.com/repos/gpac/gpac/issues/comments/402063777","html_url":"https://github.com/gpac/gpac/issues/1099#issuecomment-402063777","issue_url":"https://api.github.com/repos/gpac/gpac/issues/1099","id":402063777,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMjA2Mzc3Nw==","user":{"login":"aureliendavid","id":7168263,"node_id":"MDQ6VXNlcjcxNjgyNjM=","avatar_url":"https://avatars1.githubusercontent.com/u/7168263?v=4","gravatar_id":"","url":"https://api.github.com/users/aureliendavid","html_url":"https://github.com/aureliendavid","followers_url":"https://api.github.com/users/aureliendavid/followers","following_url":"https://api.github.com/users/aureliendavid/following{/other_user}","gists_url":"https://api.github.com/users/aureliendavid/gists{/gist_id}","starred_url":"https://api.github.com/users/aureliendavid/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aureliendavid/subscriptions","organizations_url":"https://api.github.com/users/aureliendavid/orgs","repos_url":"https://api.github.com/users/aureliendavid/repos","events_url":"https://api.github.com/users/aureliendavid/events{/privacy}","received_events_url":"https://api.github.com/users/aureliendavid/received_events","type":"User","site_admin":false},"created_at":"2018-07-03T08:55:09Z","updated_at":"2018-07-03T08:55:09Z","author_association":"CONTRIBUTOR","body":"Is that with the same files as before? I could reproduce all of them before but none of them now. \r\n\r\nWhat's your OS / compiler version / ASAN version? Can you maybe try with gcc instead of clang? (I tried both with same result on my end). \r\n\r\nAre you using any ASAN_OPTIONS when running the tests? \r\n\r\nthanks"}}
{"actor":{"display_login":"aureliendavid"}}