heap-buffer-overflow in function MergeTrack

[CythZ]

POC
Description:
heap-buffer-overflow in function MergeTrack;

for (i = 0; i < saiz->sample_count; i++) {
	GF_CENCSampleAuxInfo *sai;
	const u8 *key_info=NULL;
	u32 key_info_size, samp_num;
	u64 cur_position;
	if (nb_saio != 1)
		offset = saio->offsets[i] + moof_offset; //seems like i does not match to the saio->offset's size

when I use gdb:

pwndbg> telescope saio->offsets-2
00:0000│  0x5555557e4050 ◂— 0x0
01:0008│  0x5555557e4058 ◂— 0x21 /* '!' */
02:0010│  0x5555557e4060 ◂— 0x0
03:0018│  0x5555557e4068 ◂— 0x0
04:0020│  0x5555557e4070 ◂— 0x377
05:0028│  0x5555557e4078 ◂— 0x21 /* '!' */
06:0030│  0x5555557e4080 —▸ 0x5555557e40a0 —▸ 0x5555557e3ff0 ◂— 0x7361696f /* 'oias' */
07:0038│  0x5555557e4088 ◂— 0xa00000001
pwndbg> print saiz->sample_count
$12 = 24

Version

MP4Box - GPAC version 2.1-DEV-rev257-g7360c7ed9-master

Reproduce:

$ ./configure --enable-sanitizer
$ make
$ ./MP4Box -xmt poc

ASAN report:

==23129==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6030000015e8 at pc 0x7f209ff6b4b2 bp 0x7ffc3965a7e0 sp 0x7ffc3965a7d0
READ of size 8 at 0x6030000015e8 thread T0
    #0 0x7f209ff6b4b1 in MergeTrack isomedia/track.c:1090
    #1 0x7f209fe562d2 in MergeFragment isomedia/isom_intern.c:92
    #2 0x7f209fe59527 in gf_isom_parse_movie_boxes_internal isomedia/isom_intern.c:714
    #3 0x7f209fe5dd9b in gf_isom_parse_movie_boxes isomedia/isom_intern.c:860
    #4 0x7f209fe5dd9b in gf_isom_open_file isomedia/isom_intern.c:980
    #5 0x55b116848c74 in mp4box_main /home//out/gpac/applications/mp4box/mp4box.c:6181
    #6 0x7f209d8a6c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
    #7 0x55b116829669 in _start (/home//out/gpac/bin/gcc/MP4Box+0x84669)

0x6030000015e8 is located 0 bytes to the right of 24-byte region [0x6030000015d0,0x6030000015e8)
allocated by thread T0 here:
    #0 0x7f20a27feb40 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb40)
    #1 0x7f209fdd52f3 in saio_box_read isomedia/box_code_base.c:10378
    #2 0x7f209fe30149 in gf_isom_box_read isomedia/box_funcs.c:1860
    #3 0x7f209fe30149 in gf_isom_box_parse_ex isomedia/box_funcs.c:271
    #4 0x7f209fe35d0a in gf_isom_box_array_read isomedia/box_funcs.c:1753
    #5 0x7f209fdbca0e in traf_box_read isomedia/box_code_base.c:6342
    #6 0x7f209fe30149 in gf_isom_box_read isomedia/box_funcs.c:1860
    #7 0x7f209fe30149 in gf_isom_box_parse_ex isomedia/box_funcs.c:271
    #8 0x7f209fe35d0a in gf_isom_box_array_read isomedia/box_funcs.c:1753
    #9 0x7f209fe31ac7 in gf_isom_box_read isomedia/box_funcs.c:1860
    #10 0x7f209fe31ac7 in gf_isom_box_parse_ex isomedia/box_funcs.c:271
    #11 0x7f209fe3272c in gf_isom_parse_root_box isomedia/box_funcs.c:38
    #12 0x7f209fe57f34 in gf_isom_parse_movie_boxes_internal isomedia/isom_intern.c:373
    #13 0x7f209fe5dd9b in gf_isom_parse_movie_boxes isomedia/isom_intern.c:860
    #14 0x7f209fe5dd9b in gf_isom_open_file isomedia/isom_intern.c:980
    #15 0x55b116848c74 in mp4box_main /home//out/gpac/applications/mp4box/mp4box.c:6181
    #16 0x7f209d8a6c86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)

SUMMARY: AddressSanitizer: heap-buffer-overflow isomedia/track.c:1090 in MergeTrack
Shadow bytes around the buggy address:
  0x0c067fff8260: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 02
  0x0c067fff8270: fa fa 00 00 00 fa fa fa fd fd fd fa fa fa fd fd
  0x0c067fff8280: fd fd fa fa fd fd fd fa fa fa 00 00 00 fa fa fa
  0x0c067fff8290: 00 00 04 fa fa fa fd fd fd fd fa fa 00 00 00 00
  0x0c067fff82a0: fa fa 00 00 00 03 fa fa 00 00 00 00 fa fa 00 00
=>0x0c067fff82b0: 00 00 fa fa 00 00 04 fa fa fa 00 00 00[fa]fa fa
  0x0c067fff82c0: 00 00 00 00 fa fa 00 00 00 fa fa fa 00 00 00 00
  0x0c067fff82d0: fa fa 00 00 00 fa fa fa 00 00 00 00 fa fa 00 00
  0x0c067fff82e0: 00 fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff82f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==23129==ABORTING