GPAC GSF demuxer Heap Out-of-Bounds Read Vulnerability Analysis

Vulnerability Key Information 1. Vulnerability Overview Project/Product: GPAC Affected Component: GSF demuxer filter ( ) — Vulnerability Type: Heap-based out-of-bounds read (heap memory read beyond bounds) Trigger Condition: A specially crafted file where the "tune-in" header contains a field of length that is not NULL-terminated, followed by logging using . Impact: - Denial of service (crash) in certain builds/environments - Potential information leakage if out-of-bounds bytes are read and printed before encountering a NULL byte (not demonstrated in this document) Attack Vector: Victim opens/processes a specially crafted file containing the filter graph. 2. Affected Versions Confirmed Affected Version: GPAC 2.4.0 Possibly Affected Versions: Other versions containing the same "magic" parsing/logging logic. 3. Root Cause Analysis 3.1 Location File: Function: (tune-in packet parsing) 3.2 Root Cause Details During tune-in header parsing, reads a variable-length , allocates a buffer of exactly bytes, and reads bytes into that buffer. Since is not NULL-terminated, the format string causes -style code to read beyond the heap-allocated buffer until it encounters a NULL byte, resulting in an out-of-bounds heap read. Secondary issue (also leading to out-of-bounds read): uses attacker-controlled . If (where comes from filter parameters), may read beyond the end of . 4. Proof of Concept (PoC) and Reproduction 4.1 PoC Generator Attachment: Script Function: Generates a file with a tune-in header containing and (not NULL-terminated). 4.2 Generate PoC 4.3 Reproduction Command Note: Use an ASan build to reliably detect heap out-of-bounds reads. 5. Impact Assessment Minimum Impact: DoS (crash in certain builds/environments) Potential Information Leak: Out-of-bounds bytes may be read and printed as part of the logged "magic" string until a NULL byte is encountered. This depends on allocator behavior and log output availability; not demonstrated in this document. Since this is an out-of-bounds read (not a write), the issue primarily affects stability and potential information leakage, rather than direct memory corruption. 6. Attachments : Affected code (context for "magic" parsing and logging) : PoC generator script

Goal Reached Thanks to every supporter — we hit 100%!

GPAC GSF demuxer Heap Out-of-Bounds Read Vulnerability Analysis

More from this source