Out of write in swf_get_string at scene_manager/swf_parse.c:325

[Janette88]

Description

Out of write in swf_get_string at scene_manager/swf_parse.c:325

Version

git log
commit 422b78ecf79ceeee97104d219cc4f184b1348cec (HEAD -> master, origin/master, origin/HEAD)
Author: Aurelien David <aurelien.david@telecom-paristech.fr>
Date:   Mon Feb 26 10:53:25 2024 +0100
./MP4Box -version
MP4Box - GPAC version 2.3-DEV-rev921-g422b78ecf-master

Asan log

./MP4Box -info test2.dat
SWF Import - Scene Size -230376x-52424.6 - 56880 frames @ 145 FPS
[TXTIn] swf -> svg not fully migrated, using SWF flags 0 and no flatten angle. Patch welcome
[SWF Parsing] Tag UnknownTag (0x37b) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x94) not implemented - skipping (frame 1)
[SWF Parsing] Tag FreeCharacter (0x 3) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x35) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x1fc) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x137) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x68) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x3fc) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x5c) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x158) not implemented - skipping (frame 1)
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3594==ERROR: AddressSanitizer: SEGV on unknown address 0x7ffec244f28f (pc 0x7f8801ebe5ee bp 0x7ffdc244f760 sp 0x7ffdc244f230 T0)
==3594==The signal is caused by a WRITE memory access.
    #0 0x7f8801ebe5ed in swf_get_string scene_manager/swf_parse.c:325
    #1 0x7f8801ed40b0 in swf_def_edit_text scene_manager/swf_parse.c:1718
    #2 0x7f8801ed40b0 in swf_process_tag scene_manager/swf_parse.c:2355
    #3 0x7f8801ed40b0 in swf_parse_tag scene_manager/swf_parse.c:2417
    #4 0x7f88025da329 in gf_text_process_swf filters/load_text.c:2554
    #5 0x7f88025da329 in gf_text_process_swf filters/load_text.c:2531
    #6 0x7f88025ef9d3 in txtin_process filters/load_text.c:4025
    #7 0x7f88022da2b5 in gf_filter_process_task filter_core/filter.c:3025
    #8 0x7f88022a73f1 in gf_fs_thread_proc filter_core/filter_session.c:2100
    #9 0x7f88022ac1a6 in gf_fs_run filter_core/filter_session.c:2400
    #10 0x7f8801ccd406 in gf_media_import media_tools/media_import.c:1239
    #11 0x55b1a98da4b1 in convert_file_info /home/fuzz/gpac/applications/mp4box/fileimport.c:130
    #12 0x55b1a98a4ff4 in mp4box_main /home/fuzz/gpac/applications/mp4box/mp4box.c:6391
    #13 0x7f87fee93082 in __libc_start_main ../csu/libc-start.c:308
    #14 0x55b1a987c09d in _start (/home/fuzz/gpac/bin/gcc/MP4Box+0xa609d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV scene_manager/swf_parse.c:325 in swf_get_string
==3594==ABORTING

poc download:

https://github.com/Janette88/test_pocs/blob/main/test2.dat

impact

Impact
An OOB write on the heap can potentially cause a crash or information disclosure in some cases. Could be leveraged with other vulnerabilities for a more serious impact.