| Titolo | GPAC v26.07.0 (commit 2d7da22e) / master HEAD 6fed75df — fixed in 37bccbb Memory Corruption (CWE-122: Heap-based Buffer Overflow) |
|---|
| Descrizione | Heap buffer overflow in GPAC rmt_client_handle_ws_frame (src/utils/rmt_ws.c).
The rmt_ws WebSocket remote management service (port 6363) accepts a 64-bit payload size from the WebSocket frame header. When an attacker sets payload_size = 0xFFFFFFFFFFFFFFFF, two unsigned 64-bit integer wraparounds occur:
1. The bounds check (payload_size + gf_bs_get_position(bs) > gf_bs_get_size(bs)) wraps to a small value, bypassing the early-exit branch.
2. The allocation gf_malloc(payload_size * sizeof(u8) + 1) wraps to 0, returning a zero-size heap buffer.
The subsequent unmasking loop writes approximately 1023 attacker-controlled bytes to this 1-byte buffer, causing a heap buffer overflow.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (Base 8.1, High)
Confirmed via ASAN on x86_64 Linux with GPAC v26.07.0:
==NNNN==ERROR: AddressSanitizer: heap-buffer-overflow
WRITE of size 1 at rmt_ws.c:603
#0 rmt_client_handle_ws_frame utils/rmt_ws.c:603
The service is disabled by default (requires sys.enable_rmtws() in JS). An attacker who can reach the open port can trigger a crash deterministically with a single crafted WebSocket frame, with potential for arbitrary code execution due to the heap corruption.
Fixed by maintainer in commit 37bccbb ("rmtws: handle extra_payload better"). |
|---|
| Fonte | ⚠️ https://github.com/gpac/gpac/issues/3860 |
|---|
| Utente | JerryGW (UID 99144) |
|---|
| Sottomissione | 20/08/2026 07:31 (27 giorni fa) |
|---|
| Moderazione | 16/09/2026 10:47 (27 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 405551 [GPAC 26.07.0 WebSocket src/utils/rmt_ws.c rmt_client_handle_ws_frame payload_size buffer overflow] |
|---|
| Punti | 20 |
|---|