Repository navigation
Conversation
…check (CCExtractor#2443) Fixes CCExtractor#2443 Fixes CCExtractor#2449 In `process_avc_sample()`, the bounds check `i + nal_length <= previous_index || i + nal_length > s->dataLength` was evaluated in 32-bit unsigned arithmetic. A crafted `nal_length` near `UINT32_MAX` wraps around into `(previous_index, s->dataLength]`, bypassing both checks and causing a heap-buffer-overflow at `s->data[i]` (line 99) and inside `do_NAL()` (line 100). Perform the addition in 64-bit unsigned arithmetic (`uint64_t`) so `i + nal_length` cannot wrap around.
Author
|
Hi @cfsmp3, just a quick note here as well: The code fix is fully tested and ready for review (Docker, Mac, and Windows checks are all green). The Linux CI checks are failing early here too because of the same Let me know if any changes are needed in the code! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #2443
Fixes #2449
In
process_avc_sample(), the bounds checki + nal_length <= previous_index || i + nal_length > s->dataLengthwas evaluated in 32-bit unsigned arithmetic. A craftednal_lengthnearUINT32_MAXwraps around into(previous_index, s->dataLength], bypassing both checks and causing a heap-buffer-overflow read ats->data[i](src/lib_ccx/mp4.c:99) and insidedo_NAL()(src/lib_ccx/mp4.c:100).Perform the bounds-check addition in 64-bit unsigned arithmetic (
uint64_t) soi + nal_lengthcannot wrap around.In raising this pull request, I confirm the following (please check boxes):
Reason for this PR:
Sanity check:
Repro instructions:
ccextractorwith AddressSanitizer (-fsanitize=address).ccextractor crash-input.binusing the malformed MP4 sample attached in [Security] Heap buffer overflow (OOB read past GPAC sample buffer) in process_avc_sample() at mp4.c:99 when parsing a crafted MP4 file #2443 / [Security] Heap buffer overflow (OOB read past GPAC sample buffer) in process_avc_sample() at mp4.c:99 when parsing a crafted MP4 file #2449.process_avc_sample()aborts with a heap-buffer-overflow atsrc/lib_ccx/mp4.c:99. With this fix, the 64-bit bounds check catches the overflowednal_length, logs the corrupted sample message, and exits cleanly.