| Titolo | GPAC GPAC MP4Box v26.07.0 Stack Overflow due to Uncontrolled Recursion |
|---|
| Descrizione | Affected Versions
GPAC master commit f1219cde dated 2026-07-25: reproduced with AddressSanitizer.
GPAC v26.07.0: vulnerable source logic is present; the packaged release binary was not rerun as part of this submission material.
The issue was fixed by commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24. No later formal release is identified as the fixed release without separate verification.
Classification
Attack type: Local
Attack complexity: Low
Privileges required: None
User interaction: Required
Exploit availability: Public proof-of-concept
Proven impact: Application crash and loss of availability
Suggested severity: Medium
CVSS 3.1 score: 5.5
CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Technical Description
GPAC MP4Box is affected by uncontrolled recursion while importing a crafted scene through the -add operation. The function gf_sg_dom_event_bubble in src/scenegraph/dom_events.c recursively follows parent nodes obtained through gf_node_get_parent. A cyclic or malformed parent chain can prevent traversal from reaching a valid root.
In the vulnerable implementation, event bubbling continues through an unconditional recursive call near line 516. Repeated calls consume the process stack until AddressSanitizer reports a stack overflow and aborts MP4Box. A malicious scene file can therefore cause denial of service when it is imported by a user or automated processing workflow.
No confidentiality loss, integrity impact, or code execution has been demonstrated.
Proof of Concept
PoC archive: poc_08_add.zip
PoC URL: https://github.com/user-attachments/files/30398880/poc_08_add.zip
Command:
MP4Box -add poc_08_add -new /tmp/out.mp4
Observed sanitizer result:
ERROR: AddressSanitizer: stack-overflow
#0 gf_sg_dom_event_bubble scenegraph/dom_events.c:477
#1 gf_sg_dom_event_bubble scenegraph/dom_events.c:516
#2 gf_sg_dom_event_bubble scenegraph/dom_events.c:516
...
SUMMARY: AddressSanitizer: stack-overflow in gf_sg_dom_event_bubble
ABORTING
Root Cause
The DOM event bubbling path trusts the scene graph parent relationship to terminate. The affected path lacks a reliable cycle/termination check before recurring into a parent node. A malformed scene graph can therefore create an effectively unbounded recursion path.
Countermeasure
Upgrade to a GPAC build containing commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24:
https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24
The patch adds a termination condition before the recursive bubbling call. Environments that cannot upgrade should backport the change and avoid processing untrusted scene files. Sandboxing, low-privilege execution, process timeouts, and failed-file quarantine reduce operational impact. |
|---|
| Fonte | ⚠️ https://github.com/gpac/gpac/issues/3804 |
|---|
| Utente | fczhang (UID 97720) |
|---|
| Sottomissione | 04/08/2026 15:54 (1 mese fa) |
|---|
| Moderazione | 13/09/2026 21:16 (1 month later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 403326 [GPAC 26.07.0 MP4Box dom_events.c gf_sg_dom_event_bubble buffer overflow] |
|---|
| Punti | 20 |
|---|