Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

buffer overflow in gf_hevc_read_sps_bs_internal function of media_tools/av_parsers.c:8261 #2350

Closed
3 tasks done
xidoo123 opened this issue Dec 12, 2022 · 0 comments
Closed
3 tasks done

Comments

@xidoo123
Copy link

Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/

Description

buffer overflow in gf_hevc_read_sps_bs_internal function of media_tools/av_parsers.c:8261

	//sps_rep_format_idx = 0;
	if (multiLayerExtSpsFlag) {
		sps->update_rep_format_flag = gf_bs_read_int_log(bs, 1, "update_rep_format_flag");
		if (sps->update_rep_format_flag) {
			sps->rep_format_idx = gf_bs_read_int_log(bs, 8, "rep_format_idx");
			if (sps->rep_format_idx>15) {
				return -1;
			}
		} else {
			sps->rep_format_idx = vps->rep_format_idx[layer_id]; // overflow
		}

Version info

latest version

MP4Box - GPAC version 2.1-DEV-rev593-g007bf61a0-master
(c) 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
	GPAC Filters: https://doi.org/10.1145/3339825.3394929
	GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --enable-sanitizer
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SSL GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D

Reproduce

compile and run

./configure --enable-sanitizer
make
./MP4Box import -add poc_bof8.mov

Crash reported by sanitizer

[iso file] Unknown box type dvbs in parent stsd
[HEVC] Error parsing NAL unit type 16
[Core] exp-golomb read failed, not enough bits in bitstream !
[HEVC] Error parsing NAL unit type 32
[Core] exp-golomb read failed, not enough bits in bitstream !
[HEVC] Error parsing NAL unit type 33
[HEVC] Error parsing NAL unit type 16
Track Importing HEVC - Width -10 Height -20316159 FPS 25000/1000
[HEVC] Error parsing NAL Unit 8 (size 0 type 0 frame 0 last POC 0) - skipping
[HEVC] Error parsing NAL unit type 16
[HEVC] Error parsing NAL unit type 0
[Core] exp-golomb read failed, not enough bits in bitstream !
[HEVC] Error parsing NAL unit type 32
[Core] exp-golomb read failed, not enough bits in bitstream !
[HEVC] Error parsing NAL unit type 33
[Core] exp-golomb read failed, not enough bits in bitstream !
[HEVC] Error parsing NAL unit type 34
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[HEVC] Wrong number of layer sets in VPS 5
[HEVC] Error parsing NAL unit type 32
[HEVC] Error parsing Video Param Set
[Core] exp-golomb read failed, not enough bits in bitstream !
[HEVC] Error parsing NAL unit type 32
[Core] exp-golomb read failed, not enough bits in bitstream !
[HEVC] Error parsing NAL unit type 33
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[HEVC] Error parsing NAL unit type 34
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[HEVC] Error parsing NAL unit type 34
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[HEVC] sorry, 11 layers in VPS but only 4 supported
[HEVC] Error parsing NAL unit type 32
[HEVC] Error parsing Video Param Set
media_tools/av_parsers.c:8261:45: runtime error: index 45 out of bounds for type 'u32 [16]'

POC

poc_bof8.zip

Impact

Potentially causing DoS and RCE

Credit

Xdchase

@jeanlf jeanlf closed this as completed in 88e7b87 Dec 13, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant