You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
$ ./MP4Box -version
MP4Box - GPAC version 2.3-DEV-rev566-g50c2ab06f-master
Platform
$ uname -a
Linux user-GE40-2PC-Dragon-Eyes 6.2.0-33-generic #33~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep 7 10:33:52 UTC 2 x86_64 x86_64 x86_64 GNU/Linux
Asan
/home/user/vul/MP4Box_crash/id000003sig06src000693time10932099execs107049ophavocrep8
=================================================================
==823268==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000001ea0 at pc 0x7fd156d00a7c bp 0x7ffd836ab610 sp 0x7ffd836ab608
READ of size 8 at 0x602000001ea0 thread T0
#0 0x7fd156d00a7b in gf_m3u8_parse_sub_playlist /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:1239:13
#1 0x7fd156d18174 in gf_m3u8_to_mpd /home/user/fuzzing_gpac/gpac/src/media_tools/mpd.c:2230:6
#2 0x7fd156d5ad99 in gf_dash_open /home/user/fuzzing_gpac/gpac/src/media_tools/dash_client.c:8506:8
#3 0x7fd1574e97fe in dashdmx_configure_pid /home/user/fuzzing_gpac/gpac/src/filters/dmx_dash.c:1973:7
#4 0x7fd15730740c in gf_filter_pid_configure /home/user/fuzzing_gpac/gpac/src/filter_core/filter_pid.c:876:6
#5 0x7fd1573262a6 in gf_filter_pid_connect_task /home/user/fuzzing_gpac/gpac/src/filter_core/filter_pid.c:1230:3
#6 0x7fd15737d47b in gf_fs_thread_proc /home/user/fuzzing_gpac/gpac/src/filter_core/filter_session.c:2105:3
#7 0x7fd15737b5cf in gf_fs_run /home/user/fuzzing_gpac/gpac/src/filter_core/filter_session.c:2405:3
#8 0x7fd156c2ac6a in gf_dasher_process /home/user/fuzzing_gpac/gpac/src/media_tools/dash_segmenter.c:1236:6
#9 0x564c90dad6dc in do_dash /home/user/fuzzing_gpac/gpac/applications/mp4box/mp4box.c:4831:15
#10 0x564c90d9eb6e in mp4box_main /home/user/fuzzing_gpac/gpac/applications/mp4box/mp4box.c:6245:7
#11 0x7fd155c29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#12 0x7fd155c29e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#13 0x564c90cc6dd4 in _start (/home/user/fuzzing_gpac/gpac/bin/gcc/MP4Box+0x82dd4) (BuildId: 53333ca7bff59dd9a3d1b2821e7c5f3a9aac76b9)
0x602000001ea0 is located 0 bytes to the right of 16-byte region [0x602000001e90,0x602000001ea0)
allocated by thread T0 here:
#0 0x564c90d49e08 in __interceptor_calloc (/home/user/fuzzing_gpac/gpac/bin/gcc/MP4Box+0x105e08) (BuildId: 53333ca7bff59dd9a3d1b2821e7c5f3a9aac76b9)
#1 0x7fd156d043c0 in extract_attributes /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:329:8
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:1239:13 in gf_m3u8_parse_sub_playlist
Shadow bytes around the buggy address:
0x0c047fff8380: fa fa 00 00 fa fa 00 00 fa fa fd fd fa fa fd fd
0x0c047fff8390: fa fa 07 fa fa fa 05 fa fa fa 00 00 fa fa 00 00
0x0c047fff83a0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 03
0x0c047fff83b0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
0x0c047fff83c0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
=>0x0c047fff83d0: fa fa 00 00[fa]fa fd fa fa fa fa fa fa fa fa fa
0x0c047fff83e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff83f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8410: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8420: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==823268==ABORTING
Version
Platform
Asan
Reproduce
POC File
https://github.com/gandalf4a/crash_report/blob/main/gpac/MP4Box/hbo_1239
Credit
The text was updated successfully, but these errors were encountered: