| 제목 | GPAC v26.07.0 (commit 2d7da22e) / master HEAD 6fed75df — fixed in 37bccbb Memory Corruption (CWE-122: Heap-based Buffer Overflow) |
|---|
| 설명 | Heap buffer overflow in GPAC rmt_client_handle_ws_frame (src/utils/rmt_ws.c).
The rmt_ws WebSocket remote management service (port 6363) accepts a 64-bit payload size from the WebSocket frame header. When an attacker sets payload_size = 0xFFFFFFFFFFFFFFFF, two unsigned 64-bit integer wraparounds occur:
1. The bounds check (payload_size + gf_bs_get_position(bs) > gf_bs_get_size(bs)) wraps to a small value, bypassing the early-exit branch.
2. The allocation gf_malloc(payload_size * sizeof(u8) + 1) wraps to 0, returning a zero-size heap buffer.
The subsequent unmasking loop writes approximately 1023 attacker-controlled bytes to this 1-byte buffer, causing a heap buffer overflow.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (Base 8.1, High)
Confirmed via ASAN on x86_64 Linux with GPAC v26.07.0:
==NNNN==ERROR: AddressSanitizer: heap-buffer-overflow
WRITE of size 1 at rmt_ws.c:603
#0 rmt_client_handle_ws_frame utils/rmt_ws.c:603
The service is disabled by default (requires sys.enable_rmtws() in JS). An attacker who can reach the open port can trigger a crash deterministically with a single crafted WebSocket frame, with potential for arbitrary code execution due to the heap corruption.
Fixed by maintainer in commit 37bccbb ("rmtws: handle extra_payload better"). |
|---|
| 원천 | ⚠️ https://github.com/gpac/gpac/issues/3860 |
|---|
| 사용자 | JerryGW (UID 99144) |
|---|
| 제출 | 2026. 08. 20. AM 07:31 (29 날 ago) |
|---|
| 모더레이션 | 2026. 09. 16. AM 10:47 (27 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 405551 [GPAC 26.07.0 WebSocket src/utils/rmt_ws.c rmt_client_handle_ws_frame payload_size 메모리 손상] |
|---|
| 포인트들 | 20 |
|---|