You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
$ ./MP4Box -version
MP4Box - GPAC version 2.3-DEV-rev566-g50c2ab06f-master
Platform
$ uname -a
Linux user-GE40-2PC-Dragon-Eyes 6.2.0-33-generic #33~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep 7 10:33:52 UTC 2 x86_64 x86_64 x86_64 GNU/Linux
Asan
/home/user/vul/MP4Box_crash/id000007sig06src000693time11039870execs108242ophavocrep4
[33m[M3U8] Unsupported directive #EXT-X-TARGETDURATIh_track1_init.mp4"
[0m[33m[M3U8] Unsupported directive #EXT-X-T-X-MEDIA-SEQUENCE:1
[0m=================================================================
==823827==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6040000006b8 at pc 0x7f4d8f3047fc bp 0x7ffff56f9b80 sp 0x7ffff56f9b78
WRITE of size 8 at 0x6040000006b8 thread T0
#0 0x7f4d8f3047fb in extract_attributes /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:345:26
#1 0x7f4d8f2fc3e4 in parse_attributes /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:525:8
#2 0x7f4d8f2fc3e4 in gf_m3u8_parse_sub_playlist /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:1233:18
#3 0x7f4d8f318174 in gf_m3u8_to_mpd /home/user/fuzzing_gpac/gpac/src/media_tools/mpd.c:2230:6
#4 0x7f4d8f35ad99 in gf_dash_open /home/user/fuzzing_gpac/gpac/src/media_tools/dash_client.c:8506:8
#5 0x7f4d8fae97fe in dashdmx_configure_pid /home/user/fuzzing_gpac/gpac/src/filters/dmx_dash.c:1973:7
#6 0x7f4d8f90740c in gf_filter_pid_configure /home/user/fuzzing_gpac/gpac/src/filter_core/filter_pid.c:876:6
#7 0x7f4d8f9262a6 in gf_filter_pid_connect_task /home/user/fuzzing_gpac/gpac/src/filter_core/filter_pid.c:1230:3
#8 0x7f4d8f97d47b in gf_fs_thread_proc /home/user/fuzzing_gpac/gpac/src/filter_core/filter_session.c:2105:3
#9 0x7f4d8f97b5cf in gf_fs_run /home/user/fuzzing_gpac/gpac/src/filter_core/filter_session.c:2405:3
#10 0x7f4d8f22ac6a in gf_dasher_process /home/user/fuzzing_gpac/gpac/src/media_tools/dash_segmenter.c:1236:6
#11 0x56365db0a6dc in do_dash /home/user/fuzzing_gpac/gpac/applications/mp4box/mp4box.c:4831:15
#12 0x56365dafbb6e in mp4box_main /home/user/fuzzing_gpac/gpac/applications/mp4box/mp4box.c:6245:7
#13 0x7f4d8e229d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#14 0x7f4d8e229e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#15 0x56365da23dd4 in _start (/home/user/fuzzing_gpac/gpac/bin/gcc/MP4Box+0x82dd4) (BuildId: 53333ca7bff59dd9a3d1b2821e7c5f3a9aac76b9)
0x6040000006b8 is located 0 bytes to the right of 40-byte region [0x604000000690,0x6040000006b8)
allocated by thread T0 here:
#0 0x56365daa6e08 in __interceptor_calloc (/home/user/fuzzing_gpac/gpac/bin/gcc/MP4Box+0x105e08) (BuildId: 53333ca7bff59dd9a3d1b2821e7c5f3a9aac76b9)
#1 0x7f4d8f3043c0 in extract_attributes /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:329:8
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:345:26 in extract_attributes
Shadow bytes around the buggy address:
0x0c087fff8080: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
0x0c087fff8090: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
0x0c087fff80a0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
0x0c087fff80b0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
0x0c087fff80c0: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
=>0x0c087fff80d0: fa fa 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa
0x0c087fff80e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c087fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c087fff8100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c087fff8110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c087fff8120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==823827==ABORTING
Version
Platform
Asan
Reproduce
POC File
https://github.com/gandalf4a/crash_report/blob/main/gpac/MP4Box/hbo_345
Credit
The text was updated successfully, but these errors were encountered: