gf_bin128_parse in utils/os_divers.c in GPAC 0.7.1 has a buffer overflow issue for the crypt feature when encountering a crafted_drm_file.xml file.
there is a buffer overflow issue for crypt feature when use a crafted_drm_file.xml file.

overflow occur when use a crafted key value.

root@ubuntu:/opt/niugx/cov_product/gpac/gpac-master/bin/gcc# gdb ./MP4Box 
(gdb) set args -crypt crafted_drm_file.xml overview.mp4 -out overview_encrypted.mp4
(gdb) r
Starting program: /opt/niugx/cov_product/gpac/gpac-master/bin/gcc/MP4Box -crypt crafted_drm_file.xml overview.mp4 -out overview_encrypted.mp4
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[CORE] 128bit blob is not 16-bytes long: 5544694d47473326622665665a396b3611111111111111111111111111111111111111111111111111111111111111111111111111111111
[CENC] Cannnot parse key value
*** Error in `/opt/niugx/cov_product/gpac/gpac-master/bin/gcc/MP4Box': free(): corrupted unsorted chunks: 0x0000000000692030 ***

Program received signal SIGABRT, Aborted.
0x00007ffff725bc37 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56      ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.

(gdb) bt
#0  0x00007ffff725bc37 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007ffff725f028 in __GI_abort () at abort.c:89
#2  0x00007ffff72982a4 in __libc_message (do_abort=do_abort@entry=1, fmt=fmt@entry=0x7ffff73a66b0 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175
#3  0x00007ffff72a455e in malloc_printerr (ptr=<optimized out>, str=0x7ffff73a6800 "free(): corrupted unsorted chunks", action=1) at malloc.c:4996
#4  _int_free (av=<optimized out>, p=<optimized out>, have_lock=0) at malloc.c:3840
#5  0x00007ffff6812e1b in inflateEnd () from /lib/x86_64-linux-gnu/libz.so.1
#6  0x00007ffff68183d9 in gzclose_r () from /lib/x86_64-linux-gnu/libz.so.1
#7  0x00007ffff76609fd in xml_sax_read_file (parser=0x68ba30) at utils/xml_parser.c:1177
#8  0x00007ffff7660db2 in gf_xml_sax_parse_file (parser=0x68ba30, fileName=0x7fffffffe7d3 "crafted_drm_file.xml", OnProgress=0x0) at utils/xml_parser.c:1269
#9  0x00007ffff794c69a in load_crypt_file (file=0x7fffffffe7d3 "crafted_drm_file.xml") at media_tools/ismacryp.c:388
#10 0x00007ffff79552ad in gf_crypt_file (mp4=0x670c20, drm_file=0x7fffffffe7d3 "crafted_drm_file.xml") at media_tools/ismacryp.c:2882
#11 0x000000000042188c in mp4boxMain (argc=6, argv=0x7fffffffe548) at main.c:5202
#12 0x0000000000423d05 in main (argc=6, argv=0x7fffffffe548) at main.c:5712
(gdb) 

Guoxiang Niu, EaglEye Team

buffer overflow issue 7#
This is a GitHub Issue
repo:gpac
owner:gpac
Title : buffer overflow issue 7#
Issue date:

--- start body ---
there is a buffer overflow issue for crypt feature when use a crafted_drm_file.xml file.

overflow occur when use a crafted key value.

root@ubuntu:/opt/niugx/cov_product/gpac/gpac-master/bin/gcc# gdb ./MP4Box 
(gdb) set args -crypt crafted_drm_file.xml overview.mp4 -out overview_encrypted.mp4
(gdb) r
Starting program: /opt/niugx/cov_product/gpac/gpac-master/bin/gcc/MP4Box -crypt crafted_drm_file.xml overview.mp4 -out overview_encrypted.mp4
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[CORE] 128bit blob is not 16-bytes long: 5544694d47473326622665665a396b3611111111111111111111111111111111111111111111111111111111111111111111111111111111
[CENC] Cannnot parse key value
*** Error in `/opt/niugx/cov_product/gpac/gpac-master/bin/gcc/MP4Box': free(): corrupted unsorted chunks: 0x0000000000692030 ***

Program received signal SIGABRT, Aborted.
0x00007ffff725bc37 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56      ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.

(gdb) bt
#0  0x00007ffff725bc37 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007ffff725f028 in __GI_abort () at abort.c:89
#2  0x00007ffff72982a4 in __libc_message (do_abort=do_abort@entry=1, fmt=fmt@entry=0x7ffff73a66b0 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175
#3  0x00007ffff72a455e in malloc_printerr (ptr=<optimized out>, str=0x7ffff73a6800 "free(): corrupted unsorted chunks", action=1) at malloc.c:4996
#4  _int_free (av=<optimized out>, p=<optimized out>, have_lock=0) at malloc.c:3840
#5  0x00007ffff6812e1b in inflateEnd () from /lib/x86_64-linux-gnu/libz.so.1
#6  0x00007ffff68183d9 in gzclose_r () from /lib/x86_64-linux-gnu/libz.so.1
#7  0x00007ffff76609fd in xml_sax_read_file (parser=0x68ba30) at utils/xml_parser.c:1177
#8  0x00007ffff7660db2 in gf_xml_sax_parse_file (parser=0x68ba30, fileName=0x7fffffffe7d3 "crafted_drm_file.xml", OnProgress=0x0) at utils/xml_parser.c:1269
#9  0x00007ffff794c69a in load_crypt_file (file=0x7fffffffe7d3 "crafted_drm_file.xml") at media_tools/ismacryp.c:388
#10 0x00007ffff79552ad in gf_crypt_file (mp4=0x670c20, drm_file=0x7fffffffe7d3 "crafted_drm_file.xml") at media_tools/ismacryp.c:2882
#11 0x000000000042188c in mp4boxMain (argc=6, argv=0x7fffffffe548) at main.c:5202
#12 0x0000000000423d05 in main (argc=6, argv=0x7fffffffe548) at main.c:5712
(gdb) 

Guoxiang Niu, EaglEye Team

--- end body ---

A buffer overflow vulnerability exists in the crypt feature of GPAC when processing a specially crafted DRM file (crafted_drm_file.xml). The overflow occurs due to an improperly handled key value, leading to memory corruption and potential arbitrary code execution. This vulnerability can be exploited by providing a maliciously crafted key value in the DRM file, which causes the application to crash and may allow an attacker to execute arbitrary code.