Skip to content

OOB issue of gf_text_get_utf8_line #1177

Closed
@niugx

Description

@niugx

In gf_text_get_utf8_line function, gf_utf8_wcstombs return -1 with crafted srt file, it will cause szLineConv[i] = 0 out of bound write

root@ubuntu:/opt/niugx/cov_product/gpac/gpac-master/bin/gcc# gdb ./MP4Box
GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.3) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
http://www.gnu.org/software/gdb/bugs/.
Find the GDB manual and other documentation resources online at:
http://www.gnu.org/software/gdb/documentation/.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./MP4Box...done.
(gdb) set args -add crafted.srt overview.mp4
(gdb) r
Starting program: /opt/niugx/cov_product/gpac/gpac-master/bin/gcc/MP4Box -add crafted.srt overview.mp4
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Timed Text (SRT) import - text track 580 x 436, font Serif (size 18)

Program received signal SIGBUS, Bus error.
0x00007ffff79b2eeb in gf_text_get_utf8_line (szLine=0x7fffffff4d80 "0", lineSize=2048, txt_in=0x66c4e0, unicode_type=2) at media_tools/text_import.c:272
272 szLineConv[i] = 0;
(gdb) bt
#0 0x00007ffff79b2eeb in gf_text_get_utf8_line (szLine=0x7fffffff4d80 "0", lineSize=2048, txt_in=0x66c4e0, unicode_type=2) at media_tools/text_import.c:272
#1 0x00007ffff79b39c6 in gf_text_import_srt (import=0x7fffffff6030) at media_tools/text_import.c:429
#2 0x00007ffff79bd165 in gf_import_timed_text (import=0x7fffffff6030) at media_tools/text_import.c:2644
#3 0x00007ffff7933f09 in gf_media_import (importer=0x7fffffff6030) at media_tools/media_import.c:10619
#4 0x000000000043727a in import_file (dest=0x65d010, inName=0x7fffffffe7f6 "crafted.srt", import_flags=0, force_fps=0, frames_per_sample=0) at fileimport.c:685
#5 0x000000000041bdac in mp4boxMain (argc=4, argv=0x7fffffffe578) at main.c:4177
#6 0x000000000042215e in main (argc=4, argv=0x7fffffffe578) at main.c:5695
(gdb)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions