| Title | flvmeta 1.2.2 Heap-based Buffer Overflow |
|---|
| Description | ##Summary
A heap buffer overflow exists in amf_string_new() when processing a malformed FLV file. The function copies AMF string data using memcpy with an overly large length (514) into a 40-byte buffer, causing an out‑of‑bounds read.
##Vulnerability Details
Program: flvmeta (version 1.2.2)
Crash Type: heap-buffer-overflow (ASan)
Root Cause: Inconsistent string length – buffer allocated via strdup (40 bytes), but memcpy reads 514 bytes.
##ASAN report
=================================================================
==2150280==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x504000000df8 at pc 0x7ee9beefb42e bp 0x7ffd33c8ae60 sp 0x7ffd33c8a608
READ of size 514 at 0x504000000df8 thread T0
#0 0x7ee9beefb42d in memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115
#1 0x605fe61b6ec2 in amf_string_new /home/xmut/wyf/LLM-optionFuzz/benchlatest/flvmeta-asan/flvmeta-1.2.2/src/amf.c:915
#2 0x605fe61b61a3 in amf_data_clone /home/xmut/wyf/LLM-optionFuzz/benchlatest/flvmeta-asan/flvmeta-1.2.2/src/amf.c:730
#3 0x605fe61d6f7d in compute_metadata /home/xmut/wyf/LLM-optionFuzz/benchlatest/flvmeta-asan/flvmeta-1.2.2/src/info.c:667
#4 0x605fe61d9eec in update_metadata /home/xmut/wyf/LLM-optionFuzz/benchlatest/flvmeta-asan/flvmeta-1.2.2/src/update.c:279
#5 0x605fe61d0fd5 in main /home/xmut/wyf/LLM-optionFuzz/benchlatest/flvmeta-asan/flvmeta-1.2.2/src/flvmeta.c:388
#6 0x7ee9bea2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#7 0x7ee9bea2a28a in __libc_start_main_impl ../csu/libc-start.c:360
#8 0x605fe61b2844 in _start (/home/xmut/wyf/LLM-optionFuzz/benchlatest/flvmeta-asan/build/src/flvmeta+0x12844) (BuildId: 0e3e850f77cbf5d18ae1ae702897d71336632326)
0x504000000df8 is located 0 bytes after 40-byte region [0x504000000dd0,0x504000000df8)
allocated by thread T0 here:
#0 0x7ee9beef74e8 in strdup ../../../../src/libsanitizer/asan/asan_interceptors.cpp:578
#1 0x605fe61b6199 in amf_data_clone /home/xmut/wyf/LLM-optionFuzz/benchlatest/flvmeta-asan/flvmeta-1.2.2/src/amf.c:730
#2 0x605fe61d6f7d in compute_metadata /home/xmut/wyf/LLM-optionFuzz/benchlatest/flvmeta-asan/flvmeta-1.2.2/src/info.c:667
#3 0x605fe61d9eec in update_metadata /home/xmut/wyf/LLM-optionFuzz/benchlatest/flvmeta-asan/flvmeta-1.2.2/src/update.c:279
#4 0x605fe61d0fd5 in main /home/xmut/wyf/LLM-optionFuzz/benchlatest/flvmeta-asan/flvmeta-1.2.2/src/flvmeta.c:388
#5 0x7ee9bea2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#6 0x7ee9bea2a28a in __libc_start_main_impl ../csu/libc-start.c:360
#7 0x605fe61b2844 in _start (/home/xmut/wyf/LLM-optionFuzz/benchlatest/flvmeta-asan/build/src/flvmeta+0x12844) (BuildId: 0e3e850f77cbf5d18ae1ae702897d71336632326)
SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115 in memcpy
Shadow bytes around the buggy address:
0x504000000b00: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
0x504000000b80: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
0x504000000c00: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
0x504000000c80: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
0x504000000d00: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
=>0x504000000d80: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00[fa]
0x504000000e00: fa fa 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
0x504000000e80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x504000000f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x504000000f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x504000001000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==2150280==ABORTING
###Root Cause
1.amf_data_clone() duplicates the original string using strdup – resulting buffer size equals the actual string length (40 bytes).
2.Later, amf_string_new() is called with a length parameter (514) taken from the corrupted AMF metadata.
3.No validation ensures the length fits the allocated memory; memcpy reads beyond the buffer.
###Vulnerable Code (amf.c:915)
```c
memcpy(data->string_data.mbstr, str, data->string_data.size); // length = 514, buffer size = 40
```
##Proof of Concept
**PoC File**: flvmeta_heap_buffer_overflow (malformed FLV with invalid AMF string length)
**Reproduction**:
``bash
flvmeta -p -f -i --dump-format=json -m flvmeta_heap_buffer_overflow /tmp/out.flv
``` |
|---|
| User | Raind (UID 99455) |
|---|
| Submission | 07/01/2026 14:47 (2 months ago) |
|---|
| Moderation | 08/31/2026 09:04 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 397243 [FLVMeta up to 1.2.2 AMF String Processing src/amf.c amf_string_new length heap-based overflow] |
|---|
| Points | 17 |
|---|