POC: ./MP4Box -dash 1000 POC3

LINK: https://drive.google.com/file/d/1gBaPQJhDbiyUkDfMDYFDIDoMRF0fVyA2/view?usp=share_link

```
A stack buffer overflow vulnerability has been identified in the GPAC MP4Box while processing SWF text input files. The issue occurs in the swf_get_string function, causing a write of size 1 at an address that overflows the 'szName' variable. This vulnerability can be exploited by an attacker to cause arbitrary code execution or a denial of service.

Impact

Attackers could exploit this vulnerability to execute arbitrary code or cause a denial of service in the affected system. Users are advised to update to the latest version of GPAC MP4Box and apply proper input validation when processing SWF text files to mitigate this risk.
Occurrences

swf_parse.c L324

==2227669==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffcb1b83f90 at pc 0x7fb3e9bce988 bp 0x7ffcb1b83b30 sp 0x7ffcb1b83b20 WRITE of size 1 at 0x7ffcb1b83f90 thread T0 #0 0x7fb3e9bce987 in swf_get_string (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x25f7987) #1 0x7fb3e9be52e7 in swf_parse_tag (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x260e2e7) #2 0x7fb3ea3e78d9 in gf_text_process_swf (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2e108d9) #3 0x7fb3ea3d87ef in txtin_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2e017ef) #4 0x7fb3ea11597c in gf_filter_process_task (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b3e97c) #5 0x7fb3ea0d100a in gf_fs_thread_proc (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2afa00a) #6 0x7fb3ea0de92e in gf_fs_run (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b0792e) #7 0x7fb3e994f0ce in gf_dasher_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x23780ce) #8 0x56089d2b4338 in do_dash /root/gpac2/gpac/applications/mp4box/mp4box.c:4807 #9 0x56089d2b4338 in mp4box_main /root/gpac2/gpac/applications/mp4box/mp4box.c:6184 #10 0x7fb3e6da3d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #11 0x7fb3e6da3e3f in __libc_start_main_impl ../csu/libc-start.c:392 #12 0x56089d28acb4 in _start (/root/gpac2/gpac/bin/gcc/MP4Box+0xabcb4)

Address 0x7ffcb1b83f90 is located in stack of thread T0 at offset 1056 in frame #0 0x7fb3e9bce6cf in swf_get_string (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x25f76cf)

This frame has 1 object(s): [32, 1056) 'szName' (line 326) <== Memory access at offset 1056 overflows this variable HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp and C++ exceptions are supported) SUMMARY: AddressSanitizer: stack-buffer-overflow (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x25f7987) in swf_get_string Shadow bytes around the buggy address: 0x1000163687a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x1000163687b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x1000163687c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x1000163687d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x1000163687e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x1000163687f0: 00 00[f3]f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 0x100016368800: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100016368810: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100016368820: f1 f1 f1 f1 04 f2 04 f2 04 f2 00 00 f2 f2 00 00 0x100016368830: f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100016368840: f2 f2 f2 f2 04 f3 f3 f3 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==2227669==ABORTING

```
Stack Buffer Overflow in GPAC MP4Box SWF Text Processing
This is a GitHub Issue
repo:gpac
owner:gpac
Title : Stack Buffer Overflow in GPAC MP4Box SWF Text Processing
Issue date:

--- start body ---
POC: ./MP4Box -dash 1000 POC3

LINK: https://drive.google.com/file/d/1gBaPQJhDbiyUkDfMDYFDIDoMRF0fVyA2/view?usp=share_link

```
A stack buffer overflow vulnerability has been identified in the GPAC MP4Box while processing SWF text input files. The issue occurs in the swf_get_string function, causing a write of size 1 at an address that overflows the 'szName' variable. This vulnerability can be exploited by an attacker to cause arbitrary code execution or a denial of service.

Impact

Attackers could exploit this vulnerability to execute arbitrary code or cause a denial of service in the affected system. Users are advised to update to the latest version of GPAC MP4Box and apply proper input validation when processing SWF text files to mitigate this risk.
Occurrences

swf_parse.c L324

==2227669==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffcb1b83f90 at pc 0x7fb3e9bce988 bp 0x7ffcb1b83b30 sp 0x7ffcb1b83b20 WRITE of size 1 at 0x7ffcb1b83f90 thread T0 #0 0x7fb3e9bce987 in swf_get_string (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x25f7987) #1 0x7fb3e9be52e7 in swf_parse_tag (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x260e2e7) #2 0x7fb3ea3e78d9 in gf_text_process_swf (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2e108d9) #3 0x7fb3ea3d87ef in txtin_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2e017ef) #4 0x7fb3ea11597c in gf_filter_process_task (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b3e97c) #5 0x7fb3ea0d100a in gf_fs_thread_proc (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2afa00a) #6 0x7fb3ea0de92e in gf_fs_run (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b0792e) #7 0x7fb3e994f0ce in gf_dasher_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x23780ce) #8 0x56089d2b4338 in do_dash /root/gpac2/gpac/applications/mp4box/mp4box.c:4807 #9 0x56089d2b4338 in mp4box_main /root/gpac2/gpac/applications/mp4box/mp4box.c:6184 #10 0x7fb3e6da3d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #11 0x7fb3e6da3e3f in __libc_start_main_impl ../csu/libc-start.c:392 #12 0x56089d28acb4 in _start (/root/gpac2/gpac/bin/gcc/MP4Box+0xabcb4)

Address 0x7ffcb1b83f90 is located in stack of thread T0 at offset 1056 in frame #0 0x7fb3e9bce6cf in swf_get_string (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x25f76cf)

This frame has 1 object(s): [32, 1056) 'szName' (line 326) <== Memory access at offset 1056 overflows this variable HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp and C++ exceptions are supported) SUMMARY: AddressSanitizer: stack-buffer-overflow (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x25f7987) in swf_get_string Shadow bytes around the buggy address: 0x1000163687a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x1000163687b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x1000163687c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x1000163687d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x1000163687e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x1000163687f0: 00 00[f3]f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 0x100016368800: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100016368810: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100016368820: f1 f1 f1 f1 04 f2 04 f2 04 f2 00 00 f2 f2 00 00 0x100016368830: f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100016368840: f2 f2 f2 f2 04 f3 f3 f3 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==2227669==ABORTING

```
--- end body ---

A stack buffer overflow vulnerability has been identified in the GPAC MP4Box while processing SWF text input files. The vulnerability occurs in the swf_get_string function, which can lead to arbitrary code execution or a denial of service. Attackers can exploit this vulnerability by providing specially crafted SWF text files, resulting in a write operation that overflows the 'szName' variable on the stack. Users are advised to update to the latest version of GPAC MP4Box and implement proper input validation to mitigate this risk.