GPAC 0.7.1 has a buffer overflow issue in gf_import_message() in media_import.c.
There is a buffer overflow issue in gf_import_message () function, media_import.c

szMsg overflow when srt file contains more than one txt line and the line is long enough.

GF_Err gf_import_message(GF_MediaImporter *import, GF_Err e, char *format, ...)
{

	if (gf_log_tool_level_on(GF_LOG_AUTHOR, e ? GF_LOG_WARNING : GF_LOG_INFO)) {
		va_list args;
		char szMsg[1024];
		va_start(args, format);
		vsprintf(szMsg, format, args);
		va_end(args);
		GF_LOG((u32) (e ? GF_LOG_WARNING : GF_LOG_INFO), GF_LOG_AUTHOR, ("%s\n", szMsg) );
	}

	return e;
}

//////////////////////debug/////////////////////
(gdb) set args -srt 0 crafted_text.srt
(gdb) r
Starting program: /opt/niugx/cov_product/gpac/gpac-master/bin/gcc/MP4Box -srt 0 crafted_text.srt
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Timed Text (SRT) import - text track 400 x 60, font Serif (size 18)
Bad SRT formatting - expecting number got "hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hel"
*** stack smashing detected ***: /opt/niugx/cov_product/gpac/gpac-master/bin/gcc/MP4Box terminated

Program received signal SIGABRT, Aborted.
0x00007ffff725bc37 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56      ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0  0x00007ffff725bc37 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007ffff725f028 in __GI_abort () at abort.c:89
#2  0x00007ffff72982a4 in __libc_message (do_abort=do_abort@entry=1, fmt=fmt@entry=0x7ffff73a4113 "*** %s ***: %s terminated\n") at ../sysdeps/posix/libc_fatal.c:175
#3  0x00007ffff732fbbc in __GI___fortify_fail (msg=<optimized out>, msg@entry=0x7ffff73a40fb "stack smashing detected") at fortify_fail.c:38
#4  0x00007ffff732fb60 in __stack_chk_fail () at stack_chk_fail.c:28
#5  0x00007ffff78b28eb in gf_import_message (import=0x7fffffff9b60, e=GF_CORRUPTED_DATA, format=0x7ffff7b3d7f0 "Bad SRT formatting - expecting number got \"%s\"") at media_tools/media_import.c:59
#6  0x00007ffff795db01 in gf_text_import_srt (import=0x7fffffff9b60) at media_tools/text_import.c:505
#7  0x00007ffff7966e38 in gf_import_timed_text (import=0x7fffffff9b60) at media_tools/text_import.c:2673
#8  0x00007ffff78ded42 in gf_media_import (importer=0x7fffffff9b60) at media_tools/media_import.c:10663
#9  0x000000000041c71c in mp4boxMain (argc=4, argv=0x7fffffffe548) at main.c:4129
#10 0x0000000000423d05 in main (argc=4, argv=0x7fffffffe548) at main.c:5712
(gdb) 

Guoxiang Niu, EaglEye Team

buffer overflow issue 6#
This is a GitHub Issue
repo:gpac
owner:gpac
Title : buffer overflow issue 6#
Issue date:

--- start body ---
There is a buffer overflow issue in gf_import_message () function, media_import.c

szMsg overflow when srt file contains more than one txt line and the line is long enough.

GF_Err gf_import_message(GF_MediaImporter *import, GF_Err e, char *format, ...)
{

	if (gf_log_tool_level_on(GF_LOG_AUTHOR, e ? GF_LOG_WARNING : GF_LOG_INFO)) {
		va_list args;
		char szMsg[1024];
		va_start(args, format);
		vsprintf(szMsg, format, args);
		va_end(args);
		GF_LOG((u32) (e ? GF_LOG_WARNING : GF_LOG_INFO), GF_LOG_AUTHOR, ("%s\n", szMsg) );
	}

	return e;
}

//////////////////////debug/////////////////////
(gdb) set args -srt 0 crafted_text.srt
(gdb) r
Starting program: /opt/niugx/cov_product/gpac/gpac-master/bin/gcc/MP4Box -srt 0 crafted_text.srt
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Timed Text (SRT) import - text track 400 x 60, font Serif (size 18)
Bad SRT formatting - expecting number got "hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hel"
*** stack smashing detected ***: /opt/niugx/cov_product/gpac/gpac-master/bin/gcc/MP4Box terminated

Program received signal SIGABRT, Aborted.
0x00007ffff725bc37 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56      ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0  0x00007ffff725bc37 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007ffff725f028 in __GI_abort () at abort.c:89
#2  0x00007ffff72982a4 in __libc_message (do_abort=do_abort@entry=1, fmt=fmt@entry=0x7ffff73a4113 "*** %s ***: %s terminated\n") at ../sysdeps/posix/libc_fatal.c:175
#3  0x00007ffff732fbbc in __GI___fortify_fail (msg=<optimized out>, msg@entry=0x7ffff73a40fb "stack smashing detected") at fortify_fail.c:38
#4  0x00007ffff732fb60 in __stack_chk_fail () at stack_chk_fail.c:28
#5  0x00007ffff78b28eb in gf_import_message (import=0x7fffffff9b60, e=GF_CORRUPTED_DATA, format=0x7ffff7b3d7f0 "Bad SRT formatting - expecting number got \"%s\"") at media_tools/media_import.c:59
#6  0x00007ffff795db01 in gf_text_import_srt (import=0x7fffffff9b60) at media_tools/text_import.c:505
#7  0x00007ffff7966e38 in gf_import_timed_text (import=0x7fffffff9b60) at media_tools/text_import.c:2673
#8  0x00007ffff78ded42 in gf_media_import (importer=0x7fffffff9b60) at media_tools/media_import.c:10663
#9  0x000000000041c71c in mp4boxMain (argc=4, argv=0x7fffffffe548) at main.c:4129
#10 0x0000000000423d05 in main (argc=4, argv=0x7fffffffe548) at main.c:5712
(gdb) 

Guoxiang Niu, EaglEye Team

--- end body ---

A buffer overflow vulnerability exists in the gf_import_message function of the GPAC library, specifically in media_import.c. The function uses a fixed-size buffer (szMsg) of 1024 bytes to store formatted messages. If the input SRT file contains a long line of text, it can exceed this buffer size, leading to a stack smashing condition and potential arbitrary code execution or application crash. This vulnerability can be exploited by providing a specially crafted SRT file that triggers the overflow.