Skip to content

Invalid memory address dereference in lsr_read_id() #1982

Closed
@AiDaiP

Description

@AiDaiP

Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/

An invalid memory address dereference was discovered in lsr_read_id(). The vulnerability causes a segmentation fault and application crash.

Version:

MP4Box - GPAC version 1.1.0-DEV-rev1555-g339e7a736-master
(c) 2000-2021 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
        GPAC Filters: https://doi.org/10.1145/3339825.3394929
        GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --prefix=/root/fuck_bin/gpac/test
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_JPEG GPAC_HAS_PNG GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D

System information
Ubuntu 20.04 focal, AMD EPYC 7742 64-Core @ 16x 2.25GHz

command:

./MP4Box -bt poc

POCs
lsr_read_id.zip

tree
.
├── lsr_read_id-lsr_read_a
│   └── id_000661,sig_11,src_005751,op_havoc,rep_4
├── lsr_read_id-lsr_read_animate
│   ├── id_000623,sig_11,src_005500+003857,op_splice,rep_2
│   ├── id_000669,sig_11,src_005818,op_havoc,rep_8
│   └── id_000707,sig_11,src_006355,op_havoc,rep_8
├── lsr_read_id-lsr_read_audio.isra
│   └── id_000539,sig_11,src_004864,op_havoc,rep_8
├── lsr_read_id-lsr_read_ellipse
│   ├── id_000540,sig_11,src_004864,op_havoc,rep_8
│   └── id_000681,sig_06,src_005943,op_havoc,rep_2
├── lsr_read_id-lsr_read_linearGradient
│   └── id_000407,sig_11,src_004547,op_havoc,rep_2
├── lsr_read_id-lsr_read_polygon
│   ├── id_000424,sig_11,src_004557,op_havoc,rep_4
│   └── id_000533,sig_06,src_004856+005154,op_splice,rep_4
├── lsr_read_id-lsr_read_rect
│   └── id_000653,sig_06,src_005718+005529,op_splice,rep_2
└── lsr_read_id-lsr_read_scene_content_model
    ├── id_000457,sig_11,src_004611,op_havoc,rep_2
    └── id_000687,sig_11,src_006098,op_havoc,rep_4

8 directories, 13 files

Result

The result is omitted here.

gdb

The gdb result is omitted here.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions