提交 #914951: msgpack GPAC MP4Box v26.07.0 Heap Buffer Over-Read / Out-of-Bounds Read

Affected Versions
GPAC master commit f1219cde dated 2026-07-25: reproduced with AddressSanitizer.
GPAC v26.07.0: the release source contains the incomplete SVG tag-range validation; its packaged binary was not rerun as part of this material.
The issue was closed by commit afca1f1181668d85941d51ed1adf647807d5d975. No later formal release is identified as fixed without separate verification.

Classification
Attack type: Local
Attack complexity: Low
Privileges required: None
User interaction: Required
Exploit availability: Public proof-of-concept
Proven impact: Out-of-bounds read, application crash, and loss of availability
Suggested severity: Medium
CVSS 3.1 score: 5.5
CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Technical Description
GPAC MP4Box contains a heap buffer over-read in scene statistics processing. The vulnerable gf_node_new implementation accepts any tag less than or equal to GF_NODE_RANGE_LAST_SVG for SVG object creation, without also requiring the tag to be at least GF_NODE_RANGE_FIRST_SVG. A lower, non-SVG tag can therefore be passed to gf_svg_create_node, producing an object whose allocation and semantic node type do not match.

During MP4Box -nstatx processing of a crafted MP4, StatNodeGraph later unregisters and deletes the object. gf_node_del accesses data beyond the actual allocation. AddressSanitizer reports an eight-byte read located eight bytes beyond a 24-byte heap region.

The demonstrated effect is a process abort and denial of service. Information disclosure, data modification, and code execution have not been demonstrated.

Proof of Concept
PoC archive: poc_19_nstatx.zip
PoC URL: https://github.com/user-attachments/files/30400210/poc_19_nstatx.zip

Command:

MP4Box -nstatx poc_19_nstatx
Observed sanitizer result:

ERROR: AddressSanitizer: heap-buffer-overflow
READ of size 8
#0 gf_node_del scenegraph/base_scenegraph.c:1964
#1 gf_node_unregister scenegraph/base_scenegraph.c:801
#2 StatNodeGraph scene_manager/scene_stats.c:470
...
Address is 8 bytes to the right of a 24-byte region
Allocation: gf_svg_create_node -> gf_node_new -> StatNodeGraph
SUMMARY: AddressSanitizer: heap-buffer-overflow in gf_node_del
ABORTING
Root Cause
The SVG node factory branch validates only the maximum tag value. Missing lower-bound validation permits an out-of-range tag to be instantiated using an incompatible SVG allocation path. Later deletion uses the tag to select object-specific handling and reads beyond the allocated object.

Countermeasure
Upgrade to a GPAC build containing commit afca1f1181668d85941d51ed1adf647807d5d975:

https://github.com/gpac/gpac/commit/afca1f1181668d85941d51ed1adf647807d5d975

The relevant patch changes the SVG creation condition to require both tag >= GF_NODE_RANGE_FIRST_SVG and tag <= GF_NODE_RANGE_LAST_SVG. The commit closes several fuzz reports, so the issue-specific PoC should be used for regression testing.

Until an upgrade is available, avoid -nstatx processing of untrusted files, run MP4Box with low privileges in a sandbox, and isolate crashing inputs from retry queues.

• 来源: ⚠️ https://github.com/gpac/gpac/issues/3812
• 用户: fczhang (UID 97720)
• 提交: 2026-08-04 15時57分 (1 月前)
• 管理: 2026-09-13 21時17分 (1 month later)
• 状态: 已接受
• VulDB条目: 403328 [GPAC 26.07.0 MP4Box base_scenegraph.c gf_node_del 信息公开]
• 积分: 20