Heap Out-of-Bounds Write in L-SMASH

Executive Summary

L-SMASH through version 2.14.5 has a heap out-of-bounds write vulnerability in its ISOBMFF box demuxer. The issue occurs in functions isom_read_hdlr() and isom_read_dref_entry() in core/read.c when processing crafted MP4 or MOV files. Attackers declare oversized box sizes for hdlr or url boxes, causing the stream position to stall at end-of-file. This leads to heap memory corruption as copy loops run indefinitely, writing past allocated buffers and crashing applications.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect media files processed by L-SMASH for malformed box sizes in hdlr or url boxes. Use tools like ffprobe or mediainfo to analyze MP4/MOV files for abnormal box declarations. Check for crashes or memory corruption when processing files with L-SMASH.

• Use ffprobe -show_boxes input.mp4 to inspect box structures for oversized size fields.
• Monitor L-SMASH applications for heap corruption errors or crashes during file parsing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to crash applications by providing maliciously crafted media files. Successful exploitation could lead to denial of service, application crashes, or potentially arbitrary code execution if heap memory is overwritten. Users processing untrusted media files with vulnerable L-SMASH versions are at risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service attacks or arbitrary code execution through crafted media files. If exploited, it may lead to unauthorized access, data breaches, or service disruptions, which are critical violations under these regulations. The heap corruption could compromise data integrity and availability.

Useful 0 Not Useful 0

Mitigation Strategies

Update L-SMASH to the latest version or apply the patch from commit 805ee3c. Avoid processing untrusted media files with vulnerable versions. Implement file validation to reject files with oversized box sizes before parsing.

• Upgrade to a patched version of L-SMASH (post-commit 805ee3c) to fix the heap OOB write issue.
• Disable or sandbox applications using L-SMASH until patched to prevent exploitation via crafted files.

Useful 0 Not Useful 0