Product: GPAC (MP4Box)
Affected: gpac/gpac prior to fix commit
(e95f3064d846e4606276fff111e0f97df1576a04)
CVE: CVE-2025-55645
CWE: CWE-120 (Buffer Copy without Checking Size of Input)
CVSS 3.1: 5.4 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L)
Reporter: sigdevel <https://infosec.exchange/@sigdevel>
Description:
When MP4Box processes a crafted MP4 file containing malformed
Protection System Specific Header (PSSH) data, gf_cenc_set_pssh() in
isomedia/drm_sample.c does not sufficiently validate the declared
PSSH payload size before copying it into a fixed-size heap buffer.
AddressSanitizer reports a heap-buffer-overflow READ of size
2097152016 at memcpy(), 0 bytes after a 512-byte heap region allocated
by gf_bs_new(), at isomedia/drm_sample.c:982, reached via
mp4_mux_cenc_insert_pssh() while MP4Box performs DASH/CENC processing
on the crafted file. The oversized read may also disclose adjacent
heap memory.
Crash is reproducible on the current master branch at the time of
discovery. No authentication or special privileges required beyond
ability to provide a crafted file.
Reproduction:
-Build-opts: CC="gcc -fsanitize=address -g" CXX="g++ -fsanitize=address -g" ;
-Command: ./MP4Box -dash 10000 ./16_poc.mp4
Asan-log:
==3761620==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x515000019500 at pc 0x7fd5d4ef2956 bp 0x7ffcfa1a9150 sp 0x7ffcfa1a8910
READ of size 2097152016 at 0x515000019500 thread T0
#0 0x7fd5d4ef2955 in memcpy
../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115
#1 0x55bf75d4dedb in gf_cenc_set_pssh isomedia/drm_sample.c:982
#2 0x55bf765e47b9 in mp4_mux_cenc_insert_pssh filters/mux_isom.c:4338
PoC:
https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/16/16_poc.mp4
References:
https://github.com/gpac/gpac/issues/3236
https://www.cve.org/CVERecord?id=CVE-2025-55645
https://infosec.exchange/@sigdevel/116736802253007654
——
Best regards, Alexander A. Shvedov
https://github.com/sigdevel
