Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OOB issue of gf_text_get_utf8_line #1177

Closed
niugx opened this issue Dec 13, 2018 · 4 comments
Closed

OOB issue of gf_text_get_utf8_line #1177

niugx opened this issue Dec 13, 2018 · 4 comments

Comments

@niugx
Copy link

niugx commented Dec 13, 2018

In gf_text_get_utf8_line function, gf_utf8_wcstombs return -1 with crafted srt file, it will cause szLineConv[i] = 0 out of bound write

root@ubuntu:/opt/niugx/cov_product/gpac/gpac-master/bin/gcc# gdb ./MP4Box
GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.3) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
http://www.gnu.org/software/gdb/bugs/.
Find the GDB manual and other documentation resources online at:
http://www.gnu.org/software/gdb/documentation/.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./MP4Box...done.
(gdb) set args -add crafted.srt overview.mp4
(gdb) r
Starting program: /opt/niugx/cov_product/gpac/gpac-master/bin/gcc/MP4Box -add crafted.srt overview.mp4
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Timed Text (SRT) import - text track 580 x 436, font Serif (size 18)

Program received signal SIGBUS, Bus error.
0x00007ffff79b2eeb in gf_text_get_utf8_line (szLine=0x7fffffff4d80 "0", lineSize=2048, txt_in=0x66c4e0, unicode_type=2) at media_tools/text_import.c:272
272 szLineConv[i] = 0;
(gdb) bt
#0 0x00007ffff79b2eeb in gf_text_get_utf8_line (szLine=0x7fffffff4d80 "0", lineSize=2048, txt_in=0x66c4e0, unicode_type=2) at media_tools/text_import.c:272
#1 0x00007ffff79b39c6 in gf_text_import_srt (import=0x7fffffff6030) at media_tools/text_import.c:429
#2 0x00007ffff79bd165 in gf_import_timed_text (import=0x7fffffff6030) at media_tools/text_import.c:2644
#3 0x00007ffff7933f09 in gf_media_import (importer=0x7fffffff6030) at media_tools/media_import.c:10619
#4 0x000000000043727a in import_file (dest=0x65d010, inName=0x7fffffffe7f6 "crafted.srt", import_flags=0, force_fps=0, frames_per_sample=0) at fileimport.c:685
#5 0x000000000041bdac in mp4boxMain (argc=4, argv=0x7fffffffe578) at main.c:4177
#6 0x000000000042215e in main (argc=4, argv=0x7fffffffe578) at main.c:5695
(gdb)

@niugx
Copy link
Author

niugx commented Dec 13, 2018

add crafted srt file.

@niugx niugx changed the title OOB issues of gf_text_get_utf8_line OOB issue of gf_text_get_utf8_line Dec 13, 2018
@aureliendavid
Copy link
Contributor

hi

thanks for the thorough report

should be fixed now

@niugx
Copy link
Author

niugx commented Feb 7, 2019

this is CVE-2018-20760

@niugx
Copy link
Author

niugx commented Apr 19, 2019

Fixed.

Patch:
4c13608

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants