| tiêu đề | gpac GPAC b4f20f76ac0ac8f339adddd716e3c25c770a6690 Heap-based Buffer Overflow |
|---|
| Mô tả | GPAC builds configured with --enable-dvbx (GPAC_ENABLE_DSMCC) contain a heap out-of-bounds write (CWE-787) in the AIT parser gf_m2ts_decode_ait() in src/media_tools/ait.c. The function records each recognized application descriptor tag into a fixed 50-byte array, application_descriptors_id[50], inside GF_M2TS_AIT_APPLICATION_DECODE, using the u8 index_app_desc_id as the index. However, the descriptor loop is bounded only by the 12-bit application_descriptors_loop_length field (up to 4095), not by the descriptor count. Since the smallest descriptor is 3 bytes, a single application can carry well over 50 descriptors. None of the six write sites performs a bounds check, allowing a crafted MPEG-TS file to trigger an out-of-bounds write. ASan reports the write past an 80-byte heap allocation at ait.c:346; because index_app_desc_id is a u8 and wraps around, corruption can repeat across a roughly 256-byte window and overwrite adjacent heap objects. The issue was verified on current master (b4f20f76) and only affects builds with dvbx enabled. The fix is to check index_app_desc_id >= 50 before each write and return GF_CORRUPTED_DATA, or break out of the descriptor loop once 50 entries have been recorded.
|
|---|
| Nguồn | ⚠️ https://github.com/gpac/gpac/issues/3930 |
|---|
| Người dùng | suyuanwang (UID 101634) |
|---|
| Đệ trình | 26/09/2026 08:52 (cách đây 19 ngày) |
|---|
| Kiểm duyệt | 13/10/2026 06:55 (17 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 417465 [GPAC đến 26.07.0 AIT Parser src/media_tools/ait.c gf_m2ts_decode_ait tràn bộ đệm] |
|---|
| điểm | 20 |
|---|