In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because of missing szLineConv bounds checking.
cpe:2.3:a:gpac_project:gpac:*:*:*:*:*:*:*:*
B4ED3B4A-F8B8-4E70-BDF7-811129A50B0F
0.7.1
OR
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43
OR
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
07C312A0-CD2C-4B9C-B064-6409B25C278F
OR
There is a buffer overflow issue in gf_text_get_utf8_line () function, text_import.c

in line 429 of gf_text_import_srt, parameter lineSize is 2048, but in gf_text_get_utf8_line (), the size of  szLineConv is 1024, so, when the size of szLine is more than 1024, the buffer of szLineConv will overflow.

429        char *sOK = gf_text_get_utf8_line(szLine, 2048, srt_in, unicode_type);

char *gf_text_get_utf8_line(char *szLine, u32 lineSize, FILE *txt_in, s32 unicode_type)
{
……
         char szLineConv[1024];
……
		len = (u32) strlen(szLine);                                 // len might be more than 1024
		for (i=0; i<len; i++) {
			if (!unicode_type && (szLine[i] & 0x80)) {
				/*non UTF8 (likely some win-CP)*/
				if ((szLine[i+1] & 0xc0) != 0x80) {
					szLineConv[j] = 0xc0 | ( (szLine[i] >> 6) & 0x3 );    // j may more than 1024 here
					j++;
					szLine[i] &= 0xbf;
				}
……
 }


root@ubuntu:/opt/niugx/cov_product/gpac/gpac-master/bin/gcc# ./MP4Box -srt 0 crafted_text.srt 
Timed Text (SRT) import - text track 400 x 60, font Serif (size 18)
*** stack smashing detected ***: ./MP4Box terminated
Aborted (core dumped)


root@ubuntu:/opt/niugx/cov_product/gpac/gpac-master/bin/gcc# gdb ./MP4Box
GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.3) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./MP4Box...done.
(gdb) set args -srt 0 crafted_text.srt 
(gdb) b text_import.c:250
No source file named text_import.c.
Make breakpoint pending on future shared library load? (y or [n]) y
Breakpoint 1 (text_import.c:250) pending.
(gdb) r
Starting program: /opt/niugx/cov_product/gpac/gpac-master/bin/gcc/MP4Box -srt 0 crafted_text.srt 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Timed Text (SRT) import - text track 400 x 60, font Serif (size 18)

Breakpoint 1, gf_text_get_utf8_line (szLine=0x7fffffff88e0 "1\n", lineSize=2048, txt_in=0x65d570, unicode_type=0) at media_tools/text_import.c:250
250                     szLineConv[j] = 0;
(gdb) c
Continuing.

Breakpoint 1, gf_text_get_utf8_line (szLine=0x7fffffff88e0 "00:00:12,375 --> 00:00:13,425\n", lineSize=2048, txt_in=0x65d570, unicode_type=0) at media_tools/text_import.c:250
250                     szLineConv[j] = 0;
(gdb) c
Continuing.

Breakpoint 1, gf_text_get_utf8_line (
    szLine=0x7fffffff88e0 "hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello wo"..., lineSize=2048, txt_in=0x65d570, unicode_type=0) at media_tools/text_import.c:250
250                     szLineConv[j] = 0;
(gdb) p j
$1 = 1729
(gdb) c
Continuing.
*** stack smashing detected ***: /opt/niugx/cov_product/gpac/gpac-master/bin/gcc/MP4Box terminated

Program received signal SIGABRT, Aborted.
0x00007ffff72b7c37 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56      ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb)

Guoxiang Niu, EaglEye Team

buffer overflow issue 5#
This is a GitHub Issue
repo:gpac
owner:gpac
Title : buffer overflow issue 5#
Issue date:

--- start body ---
There is a buffer overflow issue in gf_text_get_utf8_line () function, text_import.c

in line 429 of gf_text_import_srt, parameter lineSize is 2048, but in gf_text_get_utf8_line (), the size of  szLineConv is 1024, so, when the size of szLine is more than 1024, the buffer of szLineConv will overflow.

429        char *sOK = gf_text_get_utf8_line(szLine, 2048, srt_in, unicode_type);

char *gf_text_get_utf8_line(char *szLine, u32 lineSize, FILE *txt_in, s32 unicode_type)
{
……
         char szLineConv[1024];
……
		len = (u32) strlen(szLine);                                 // len might be more than 1024
		for (i=0; i<len; i++) {
			if (!unicode_type && (szLine[i] & 0x80)) {
				/*non UTF8 (likely some win-CP)*/
				if ((szLine[i+1] & 0xc0) != 0x80) {
					szLineConv[j] = 0xc0 | ( (szLine[i] >> 6) & 0x3 );    // j may more than 1024 here
					j++;
					szLine[i] &= 0xbf;
				}
……
 }


root@ubuntu:/opt/niugx/cov_product/gpac/gpac-master/bin/gcc# ./MP4Box -srt 0 crafted_text.srt 
Timed Text (SRT) import - text track 400 x 60, font Serif (size 18)
*** stack smashing detected ***: ./MP4Box terminated
Aborted (core dumped)


root@ubuntu:/opt/niugx/cov_product/gpac/gpac-master/bin/gcc# gdb ./MP4Box
GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.3) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./MP4Box...done.
(gdb) set args -srt 0 crafted_text.srt 
(gdb) b text_import.c:250
No source file named text_import.c.
Make breakpoint pending on future shared library load? (y or [n]) y
Breakpoint 1 (text_import.c:250) pending.
(gdb) r
Starting program: /opt/niugx/cov_product/gpac/gpac-master/bin/gcc/MP4Box -srt 0 crafted_text.srt 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Timed Text (SRT) import - text track 400 x 60, font Serif (size 18)

Breakpoint 1, gf_text_get_utf8_line (szLine=0x7fffffff88e0 "1\n", lineSize=2048, txt_in=0x65d570, unicode_type=0) at media_tools/text_import.c:250
250                     szLineConv[j] = 0;
(gdb) c
Continuing.

Breakpoint 1, gf_text_get_utf8_line (szLine=0x7fffffff88e0 "00:00:12,375 --> 00:00:13,425\n", lineSize=2048, txt_in=0x65d570, unicode_type=0) at media_tools/text_import.c:250
250                     szLineConv[j] = 0;
(gdb) c
Continuing.

Breakpoint 1, gf_text_get_utf8_line (
    szLine=0x7fffffff88e0 "hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello world hello wo"..., lineSize=2048, txt_in=0x65d570, unicode_type=0) at media_tools/text_import.c:250
250                     szLineConv[j] = 0;
(gdb) p j
$1 = 1729
(gdb) c
Continuing.
*** stack smashing detected ***: /opt/niugx/cov_product/gpac/gpac-master/bin/gcc/MP4Box terminated

Program received signal SIGABRT, Aborted.
0x00007ffff72b7c37 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56      ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb)

Guoxiang Niu, EaglEye Team

--- end body ---

comments :
--- start comments ---

--- end comments ---