Enviar #876596: flvmeta 1.2.2 Heap-based Buffer Overflow

##Summary
A heap buffer overflow exists in amf_string_new() when processing a malformed FLV file. The function copies AMF string data using memcpy with an overly large length (514) into a 40-byte buffer, causing an out‑of‑bounds read.

##Vulnerability Details
Program: flvmeta (version 1.2.2)
Crash Type: heap-buffer-overflow (ASan)
Root Cause: Inconsistent string length – buffer allocated via strdup (40 bytes), but memcpy reads 514 bytes.

##ASAN report
=================================================================
==2150280==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x504000000df8 at pc 0x7ee9beefb42e bp 0x7ffd33c8ae60 sp 0x7ffd33c8a608
READ of size 514 at 0x504000000df8 thread T0
#0 0x7ee9beefb42d in memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115
#1 0x605fe61b6ec2 in amf_string_new /home/xmut/wyf/LLM-optionFuzz/benchlatest/flvmeta-asan/flvmeta-1.2.2/src/amf.c:915
#2 0x605fe61b61a3 in amf_data_clone /home/xmut/wyf/LLM-optionFuzz/benchlatest/flvmeta-asan/flvmeta-1.2.2/src/amf.c:730
#3 0x605fe61d6f7d in compute_metadata /home/xmut/wyf/LLM-optionFuzz/benchlatest/flvmeta-asan/flvmeta-1.2.2/src/info.c:667
#4 0x605fe61d9eec in update_metadata /home/xmut/wyf/LLM-optionFuzz/benchlatest/flvmeta-asan/flvmeta-1.2.2/src/update.c:279
#5 0x605fe61d0fd5 in main /home/xmut/wyf/LLM-optionFuzz/benchlatest/flvmeta-asan/flvmeta-1.2.2/src/flvmeta.c:388
#6 0x7ee9bea2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#7 0x7ee9bea2a28a in __libc_start_main_impl ../csu/libc-start.c:360
#8 0x605fe61b2844 in _start (/home/xmut/wyf/LLM-optionFuzz/benchlatest/flvmeta-asan/build/src/flvmeta+0x12844) (BuildId: 0e3e850f77cbf5d18ae1ae702897d71336632326)

0x504000000df8 is located 0 bytes after 40-byte region [0x504000000dd0,0x504000000df8)
allocated by thread T0 here:
#0 0x7ee9beef74e8 in strdup ../../../../src/libsanitizer/asan/asan_interceptors.cpp:578
#1 0x605fe61b6199 in amf_data_clone /home/xmut/wyf/LLM-optionFuzz/benchlatest/flvmeta-asan/flvmeta-1.2.2/src/amf.c:730
#2 0x605fe61d6f7d in compute_metadata /home/xmut/wyf/LLM-optionFuzz/benchlatest/flvmeta-asan/flvmeta-1.2.2/src/info.c:667
#3 0x605fe61d9eec in update_metadata /home/xmut/wyf/LLM-optionFuzz/benchlatest/flvmeta-asan/flvmeta-1.2.2/src/update.c:279
#4 0x605fe61d0fd5 in main /home/xmut/wyf/LLM-optionFuzz/benchlatest/flvmeta-asan/flvmeta-1.2.2/src/flvmeta.c:388
#5 0x7ee9bea2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#6 0x7ee9bea2a28a in __libc_start_main_impl ../csu/libc-start.c:360
#7 0x605fe61b2844 in _start (/home/xmut/wyf/LLM-optionFuzz/benchlatest/flvmeta-asan/build/src/flvmeta+0x12844) (BuildId: 0e3e850f77cbf5d18ae1ae702897d71336632326)

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115 in memcpy
Shadow bytes around the buggy address:
0x504000000b00: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
0x504000000b80: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
0x504000000c00: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
0x504000000c80: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
0x504000000d00: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
=>0x504000000d80: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00[fa]
0x504000000e00: fa fa 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
0x504000000e80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x504000000f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x504000000f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x504000001000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==2150280==ABORTING

###Root Cause
1.amf_data_clone() duplicates the original string using strdup – resulting buffer size equals the actual string length (40 bytes).
2.Later, amf_string_new() is called with a length parameter (514) taken from the corrupted AMF metadata.
3.No validation ensures the length fits the allocated memory; memcpy reads beyond the buffer.

###Vulnerable Code (amf.c:915)
```c
memcpy(data->string_data.mbstr, str, data->string_data.size); // length = 514, buffer size = 40
```

##Proof of Concept
**PoC File**: flvmeta_heap_buffer_overflow (malformed FLV with invalid AMF string length)

**Reproduction**:
``bash
flvmeta -p -f -i --dump-format=json -m flvmeta_heap_buffer_overflow /tmp/out.flv
```

• Usuario: Raind (UID 99455)
• Sumisión: 2026-07-01 14:47 (hace 2 meses)
• Moderación: 2026-08-31 09:04 (2 months later)
• Estado: Aceptado
• Entrada de VulDB: 397243 [FLVMeta hasta 1.2.2 AMF String Processing src/amf.c amf_string_new length desbordamiento de búfer]
• Puntos: 17