Stack Overflow in GPAC MP4Box via MP4 File

Executive Summary

This vulnerability is a stack overflow in the GPAC Project's MP4Box tool, specifically in the gf_bifs_dec_node function located in the bifs/field_decode.c file. It occurs when processing maliciously crafted MP4 files with specially designed BIFS scene data. The BIFS parser enters uncontrolled recursion, consuming excessive stack memory and causing a stack overflow, leading to a Denial of Service (DoS).

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, use AddressSanitizer with GPAC's MP4Box tool. Run the command ./MP4Box -x3d 59_gf_bifs_dec_node_bifs_field_decode_c_905 on a test MP4 file. If a stack overflow occurs, AddressSanitizer will detect it and terminate the process.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a Denial of Service (DoS) by crashing the MP4Box application when processing a malicious MP4 file. If exploited, it may lead to application termination, potential data loss, or system instability. Users processing untrusted MP4 files with MP4Box are at risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability is a stack overflow in a media processing library (GPAC/MP4Box) that could lead to denial of service when processing maliciously crafted files. It does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a technical implementation flaw rather than a data protection or privacy issue.

Useful 0 Not Useful 0

Mitigation Strategies

Update GPAC to version 2.5 or later, which includes a fix for the stack overflow by enforcing a maximum tree depth of 1500 in the BIFS decoder. Avoid processing untrusted MP4 files until the update is applied.

Useful 0 Not Useful 0