MP4Box XMT Parsing Heap-Use-After-Free in Proto Instantiation

Key Vulnerability Information Summary Vulnerability Overview Title: MP4Box -add/-info: triggers heap-use-after-free during proto instantiation Type: Heap Use-After-Free (heap-use-after-free) Trigger Scenario: When importing or inspecting an input file containing a malicious XMT scene, the proto instantiation phase calls to process a forged string, triggering a heap-use-after-free. The string is freed during / / / / / , but subsequent code still references the freed string. Status: Closed, marked as completed Impact Scope Affected Components: MP4Box / commands Trigger Condition: Importing or inspecting an input file containing a malicious XMT scene Reproduction Environment: ; built with Reproduction Command: (the same issue can also be triggered by ) Fix Details Fix PR: #305 (the page mentions "The fix of issue #305 may not be complete," indicating the fix might be incomplete) This issue was closed by and marked as completed POC / Exploit Code The page does not contain a complete POC code block, only the ASAN log (heap-use-after-free call stack): ``` ==3433294==ERROR: AddressSanitizer: heap-use-after-free on address 0x000c0006040 at pc 0x55555553520f bp 0x7fffffff READ of size 8 at 0x000c0006040 thread T0 #0 strcascope #1 gf_inline_get_proto_lib src/compositor/vrml_proto.c:68:16 #2 gf_sg_proto_instantiate src/compositor/vrml_proto.c:108:16 #3 gf_sg_url_table_del src/compositor/vrml_proto.c:108:16 #4 gf_sg_url_del src/compositor/vrml_proto.c:108:16 #5 gf_sg_command_apply src/compositor/vrml_proto.c:108:16 #6 gf_media_import src/compositor/vrml_proto.c:108:16 #7 gf_media_import src/compositor/vrml_proto.c:108:16 #8 gf_media_import src/compositor/vrml_proto.c:108:16 #9 gf_media_import src/compositor/vrml_proto.c:108:16 #10 gf_media_import src/compositor/vrml_proto.c:108:16 #11 gf_media_import src/compositor/vrml_proto.c:108:16 #12 gf_media_import src/compositor/vrml_proto.c:108:16 #13 gf_media_import src/compositor/vrml_proto.c:108:16 #14 gf_media_import src/compositor/vrml_proto.c:108:16 #15 gf_media_import src/compositor/vrml_proto.c:108:16 #16 gf_media_import src/compositor/vrml_proto.c:108:16 #17 gf_media_import src/compositor/vrml_proto.c:108:16 #18 gf_media_import src/compositor/vrml_proto.c:108:16 #19 gf_media_import src/compositor/vrml_proto.c:108:16 #20 gf_media_import src/compositor/vrml_proto.c:108:16 #21 gf_media_import src/compositor/vrml_proto.c:108:16 #22 gf_media_import src/compositor/vrml_proto.c:108:16 #23 gf_media_import src/compositor/vrml_proto.c:108:16 #24 gf_media_import src/compositor/vrml_proto.c:108:16 #25 gf_media_import src/compositor/vrml_proto.c:108:16 #26 gf_media_import src/compositor/vrml_proto.c:108:16 #27 gf_media_import src/compositor/vrml_proto.c:108:16 #28 gf_media_import src/compositor/vrml_proto.c:108:16 #29 gf_media_import src/compositor/vrml_proto.c:108:16 #30 gf_media_import src/compositor/vrml_proto.c:108:16 #31 gf_media_import src/compositor/vrml_proto.c:108:16 #32 gf_media_import src/compositor/vrml_proto.c:108:16 #33 gf_media_import src/compositor/vrml_proto.c:108:16 #34 gf_media_import src/compositor/vrml_proto.c:108:16 #35 gf_media_import src/compositor/vrml_proto.c:108:16 #36 gf_media_import src/compositor/vrml_proto.c:108:16 #37 gf_media_import src/compositor/vrml_proto.c:108:16 #38 gf_media_import src/compositor/vrml_proto.c:108:16 #39 gf_media_import src/compositor/vrml_proto.c:108:16 #40 gf_media_import src/compositor/vrml_proto.c:108:16 #41 gf_media_import src/compositor/vrml_proto.c:108:16 #42 gf_media_import src/compositor/vrml_proto.c:108:16 #43 gf_media_import src/compositor/vrml_proto.c:108:16 #44 gf_media_import src/compositor/vrml_proto.c:108:16 #45 gf_media_import src/compositor/vrml_proto.c:108:16 #46 gf_media_import src/compositor/vrml_proto.c:108:16 #47 gf_media_import src/compositor/vrml_proto.c:108:16 #48 gf_media_import src/compositor/vrml_proto.c:108:16 #49 gf_media_import src/compositor/vrml_proto.c:108:16 #50 gf_media_import src/compositor/vrml_proto.c:108:16 #51 gf_media_import src/compositor/vrml_proto.c:108:16 #52 gf_media_import src/compositor/vrml_proto.c:108:16 #53 gf_media_import src/compositor/vrml_proto.c:108:16 #54 gf_media_import src/compositor/vrml_proto.c:108:16 #55 gf_media_import src/compositor/vrml_proto.c:108:16 #56 gf_media_import src/compositor/vrml_proto.c:108:16 #57 gf_media_import src/compositor/vrml_proto.c:108:16 #58 gf_media_import src/compositor/vrml_proto.c:108:16 #59 gf_media_import src/compositor/vrml_proto.c:108:16 #60 gf_media_import src/compositor/vrml_proto.c:108:16 #61 gf_media_import src/compositor/vrml_proto.c:108:16 #62 gf_media_import src/compositor/vrml_proto.c:108:16 #63 gf_media_import src/compositor/vrml_proto.c:16:16 #64 gf_media_import src/compositor/vrml_proto.c:16:16 #65 gf_media_import src/compositor/vrml_proto.c:16:16 #66 gf_media_import src/compositor/vrml_proto.c:16:16 #67 gf_media_import src/compositor/vrml_proto.c:16:16 #68 gf_media_import src/compositor/vrml_proto.c:16:16 #69 gf_media_imp

Goal Reached Thanks to every supporter — we hit 100%!

MP4Box XMT Parsing Heap-Use-After-Free in Proto Instantiation

More from this source