You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
$ ./MP4Box -version
MP4Box - GPAC version 2.3-DEV-rev566-g50c2ab06f-master
Platform
$ uname -a
Linux user-GE40-2PC-Dragon-Eyes 6.2.0-33-generic #33~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep 7 10:33:52 UTC 2 x86_64 x86_64 x86_64 GNU/Linux
Asan
/home/user/vul/MP4Box_crash/id000034sig06src004073time23307882execs220140ophavocrep16
=================================================================
==827076==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000001e17 at pc 0x7f543e2bd2f9 bp 0x7ffc29e81a50 sp 0x7ffc29e81a48
WRITE of size 8 at 0x602000001e17 thread T0
#0 0x7f543e2bd2f8 in swf_init_decompress /home/user/fuzzing_gpac/gpac/src/scene_manager/swf_parse.c:110:2
#1 0x7f543e2bd2f8 in gf_swf_read_header /home/user/fuzzing_gpac/gpac/src/scene_manager/swf_parse.c:2611:3
#2 0x7f543eac760b in gf_text_swf_setup /home/user/fuzzing_gpac/gpac/src/filters/load_text.c:2488:6
#3 0x7f543eac760b in gf_text_process_swf /home/user/fuzzing_gpac/gpac/src/filters/load_text.c:2535:10
#4 0x7f543eaa0f8f in txtin_process /home/user/fuzzing_gpac/gpac/src/filters/load_text.c:4015:6
#5 0x7f543e7afa33 in gf_filter_process_task /home/user/fuzzing_gpac/gpac/src/filter_core/filter.c:2971:7
#6 0x7f543e77d47b in gf_fs_thread_proc /home/user/fuzzing_gpac/gpac/src/filter_core/filter_session.c:2105:3
#7 0x7f543e77b5cf in gf_fs_run /home/user/fuzzing_gpac/gpac/src/filter_core/filter_session.c:2405:3
#8 0x7f543e02ac6a in gf_dasher_process /home/user/fuzzing_gpac/gpac/src/media_tools/dash_segmenter.c:1236:6
#9 0x5651df0cd6dc in do_dash /home/user/fuzzing_gpac/gpac/applications/mp4box/mp4box.c:4831:15
#10 0x5651df0beb6e in mp4box_main /home/user/fuzzing_gpac/gpac/applications/mp4box/mp4box.c:6245:7
#11 0x7f543d029d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#12 0x7f543d029e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#13 0x5651defe6dd4 in _start (/home/user/fuzzing_gpac/gpac/bin/gcc/MP4Box+0x82dd4) (BuildId: 53333ca7bff59dd9a3d1b2821e7c5f3a9aac76b9)
0x602000001e17 is located 6 bytes to the right of 1-byte region [0x602000001e10,0x602000001e11)
allocated by thread T0 here:
#0 0x5651df069c1e in malloc (/home/user/fuzzing_gpac/gpac/bin/gcc/MP4Box+0x105c1e) (BuildId: 53333ca7bff59dd9a3d1b2821e7c5f3a9aac76b9)
#1 0x7f543e2bcd0a in swf_init_decompress /home/user/fuzzing_gpac/gpac/src/scene_manager/swf_parse.c:109:8
#2 0x7f543e2bcd0a in gf_swf_read_header /home/user/fuzzing_gpac/gpac/src/scene_manager/swf_parse.c:2611:3
#3 0x7f543eac760b in gf_text_swf_setup /home/user/fuzzing_gpac/gpac/src/filters/load_text.c:2488:6
#4 0x7f543eac760b in gf_text_process_swf /home/user/fuzzing_gpac/gpac/src/filters/load_text.c:2535:10
#5 0x7f543eaa0f8f in txtin_process /home/user/fuzzing_gpac/gpac/src/filters/load_text.c:4015:6
#6 0x7f543e7afa33 in gf_filter_process_task /home/user/fuzzing_gpac/gpac/src/filter_core/filter.c:2971:7
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/user/fuzzing_gpac/gpac/src/scene_manager/swf_parse.c:110:2 in swf_init_decompress
Shadow bytes around the buggy address:
0x0c047fff8370: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa fd fd
0x0c047fff8380: fa fa fd fd fa fa 06 fa fa fa 00 00 fa fa 00 00
0x0c047fff8390: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
0x0c047fff83a0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
0x0c047fff83b0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
=>0x0c047fff83c0: fa fa[01]fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff83d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff83e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff83f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8410: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==827076==ABORTING
Version
Platform
Asan
Reproduce
POC File
https://github.com/gandalf4a/crash_report/blob/main/gpac/MP4Box/hbo_110
Credit
The text was updated successfully, but these errors were encountered: