Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Runtime error: left shift of negative value (mpegts.c:2373) #1265

Closed
strongcourage opened this issue Jul 5, 2019 · 1 comment
Closed

Runtime error: left shift of negative value (mpegts.c:2373) #1265

strongcourage opened this issue Jul 5, 2019 · 1 comment

Comments

@strongcourage
Copy link

Hi,
Our fuzzer found a crash on MP4Box (the latest commit 987169b on master) due to an invalid read on function gf_m2ts_process_pmt (mpegts.c:2373).
PoC: https://github.com/strongcourage/PoCs/blob/master/gpac_987169b/PoC_re_mpegts.c:2373
Command: MP4Box -info $PoC
ASAN says:

/home/dungnguyen/gueb-testing/gpac-head/src/media_tools/mpegts.c:1655:25: runtime error: left shift of negative value -77

Valgrind says:

==22089== Invalid read of size 1
==22089==    at 0xBC1918: gf_m2ts_process_pmt (mpegts.c:2373)
==22089==    by 0xBAD409: gf_m2ts_section_complete (mpegts.c:1610)
==22089==    by 0xBAE791: gf_m2ts_gather_section.isra.14 (mpegts.c:1740)
==22089==    by 0xBB8FFF: gf_m2ts_process_packet (mpegts.c:3446)
==22089==    by 0xBB8FFF: gf_m2ts_process_data (mpegts.c:3507)
==22089==    by 0xBD3B58: gf_m2ts_probe_file (mpegts.c:4641)
==22089==    by 0xB9B594: gf_media_import (media_import.c:10998)
==22089==    by 0x49B08B: convert_file_info (fileimport.c:124)
==22089==    by 0x4621D5: mp4boxMain (main.c:4804)
==22089==    by 0x57BC82F: (below main) (libc-start.c:291)
==22089==  Address 0x5d8e773 is 29 bytes before a block of size 80 in arena "client"

Thanks,
Manh Dung

@jeanlf
Copy link
Contributor

jeanlf commented Jul 7, 2019

thanks for the report, now fixed

@jeanlf jeanlf closed this as completed Jul 7, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants