| tiêu đề | GPAC master f1219cde (2026-07-25) Stack Overflow |
|---|
| Mô tả | A stack overflow vulnerability exists in GPAC master (commit f1219cde, 2026-07-25). The issue occurs due to unbounded recursion in the gf_node_activate_ex function in scenegraph/base_scenegraph.c at line 2281 (self-recursion) via MP4Box -nstatx. The -nstatx scene-stats path (dump_isom_scene_stats -> gf_sg_command_apply / StatNodeGraph) applies scene commands on an untrusted embedded scene graph without bounding activation recursion depth, exhausting the stack. This may be an incomplete fix for commit 3e535640b48ed3218e74929cbf3e42250fce3ddf. The vulnerability can be triggered with: MP4Box -nstatx poc. PoC and ASan crash log are available in the GitHub issue report. |
|---|
| Nguồn | ⚠️ https://github.com/gpac/gpac/issues/3810 |
|---|
| Người dùng | wsstssw (UID 100468) |
|---|
| Đệ trình | 09/08/2026 14:36 (cách đây 1 tháng) |
|---|
| Kiểm duyệt | 14/09/2026 20:00 (1 month later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 403652 [GPAC đến f1219cde base_scenegraph.c gf_node_activate_ex tràn bộ đệm] |
|---|
| điểm | 20 |
|---|