heap-buffer-overflow in /gpac/src/media_tools/m3u8.c:538:39 in parse_attributes

[gandalf4a]

Version

$ ./MP4Box -version
MP4Box - GPAC version 2.3-DEV-rev566-g50c2ab06f-master

Platform

$ uname -a
Linux user-GE40-2PC-Dragon-Eyes 6.2.0-33-generic #33~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep  7 10:33:52 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

Asan

/home/user/vul/MP4Box_crash/id000001sig06src000693time10921735execs106934ophavocrep8
[33m[M3U8] Unsupported directive #EXT-X-VERSION:
[0m=================================================================
==823056==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000001f2f at pc 0x7f5320f00fca bp 0x7fffc6bb8070 sp 0x7fffc6bb8068
WRITE of size 1 at 0x602000001f2f thread T0
    #0 0x7f5320f00fc9 in parse_attributes /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:538:39
    #1 0x7f5320f00fc9 in gf_m3u8_parse_sub_playlist /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:1233:18
    #2 0x7f5320f18174 in gf_m3u8_to_mpd /home/user/fuzzing_gpac/gpac/src/media_tools/mpd.c:2230:6
    #3 0x7f5320f5ad99 in gf_dash_open /home/user/fuzzing_gpac/gpac/src/media_tools/dash_client.c:8506:8
    #4 0x7f53216e97fe in dashdmx_configure_pid /home/user/fuzzing_gpac/gpac/src/filters/dmx_dash.c:1973:7
    #5 0x7f532150740c in gf_filter_pid_configure /home/user/fuzzing_gpac/gpac/src/filter_core/filter_pid.c:876:6
    #6 0x7f53215262a6 in gf_filter_pid_connect_task /home/user/fuzzing_gpac/gpac/src/filter_core/filter_pid.c:1230:3
    #7 0x7f532157d47b in gf_fs_thread_proc /home/user/fuzzing_gpac/gpac/src/filter_core/filter_session.c:2105:3
    #8 0x7f532157b5cf in gf_fs_run /home/user/fuzzing_gpac/gpac/src/filter_core/filter_session.c:2405:3
    #9 0x7f5320e2ac6a in gf_dasher_process /home/user/fuzzing_gpac/gpac/src/media_tools/dash_segmenter.c:1236:6
    #10 0x562f308dc6dc in do_dash /home/user/fuzzing_gpac/gpac/applications/mp4box/mp4box.c:4831:15
    #11 0x562f308cdb6e in mp4box_main /home/user/fuzzing_gpac/gpac/applications/mp4box/mp4box.c:6245:7
    #12 0x7f531fe29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #13 0x7f531fe29e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #14 0x562f307f5dd4 in _start (/home/user/fuzzing_gpac/gpac/bin/gcc/MP4Box+0x82dd4) (BuildId: 53333ca7bff59dd9a3d1b2821e7c5f3a9aac76b9)

0x602000001f2f is located 1 bytes to the left of 1-byte region [0x602000001f30,0x602000001f31)
allocated by thread T0 here:
    #0 0x562f30863623 in strdup (/home/user/fuzzing_gpac/gpac/bin/gcc/MP4Box+0xf0623) (BuildId: 53333ca7bff59dd9a3d1b2821e7c5f3a9aac76b9)
    #1 0x7f5320efc6a4 in parse_attributes /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:537:29
    #2 0x7f5320efc6a4 in gf_m3u8_parse_sub_playlist /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:1233:18
    #3 0x7f5320f18174 in gf_m3u8_to_mpd /home/user/fuzzing_gpac/gpac/src/media_tools/mpd.c:2230:6
    #4 0x7f5320f5ad99 in gf_dash_open /home/user/fuzzing_gpac/gpac/src/media_tools/dash_client.c:8506:8
    #5 0x7f53216e97fe in dashdmx_configure_pid /home/user/fuzzing_gpac/gpac/src/filters/dmx_dash.c:1973:7
    #6 0x7f532150740c in gf_filter_pid_configure /home/user/fuzzing_gpac/gpac/src/filter_core/filter_pid.c:876:6
    #7 0x7f53215262a6 in gf_filter_pid_connect_task /home/user/fuzzing_gpac/gpac/src/filter_core/filter_pid.c:1230:3
    #8 0x7f532157d47b in gf_fs_thread_proc /home/user/fuzzing_gpac/gpac/src/filter_core/filter_session.c:2105:3

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:538:39 in parse_attributes
Shadow bytes around the buggy address:
  0x0c047fff8390: fa fa 07 fa fa fa 05 fa fa fa 00 00 fa fa 00 00
  0x0c047fff83a0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 03
  0x0c047fff83b0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff83c0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff83d0: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fa
=>0x0c047fff83e0: fa fa 07 fa fa[fa]01 fa fa fa fa fa fa fa fa fa
  0x0c047fff83f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8410: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8420: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8430: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==823056==ABORTING

Reproduce

./MP4Box -dash 10000 poc

POC File

https://github.com/gandalf4a/crash_report/blob/main/gpac/MP4Box/hbo_538

Credit

Gandalf4a