https://arzedlab.github.io/tags/mp4box/Recent content in MP4Box on Arzedlab 🪵Hugoen-us© RavshanTue, 04 Apr 2023 00:00:00 +0000https://arzedlab.github.io/posts/cve-2021-36414-1cb3648c0bf480a3b897cfdfea0a9efc/Tue, 04 Apr 2023 00:00:00 +0000https://arzedlab.github.io/posts/cve-2021-36414-1cb3648c0bf480a3b897cfdfea0a9efc/<h1 id="cve-2021-36414">CVE-2021-36414</h1> <p>A heap-buffer-overflow has occurred when running program MP4Box,which leads to a Deny of Service caused by dividing zero without sanity check,this can reproduce on the lattest commit.</p> <p>Here: the main problem is dividing into zero</p> <p><img src="image.png" alt="image.png"></p> <p><strong>Assigning <code>block_size</code>:</strong></p> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#282a36;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-c" data-lang="c"><span style="display:flex;"><span>block_size <span style="color:#ff79c6">=</span> ent <span style="color:#ff79c6">?</span> ent<span style="color:#ff79c6">-&gt;</span><span style="color:#8be9fd;font-style:italic">sampleDelta</span> : <span style="color:#bd93f9">160</span>; </span></span></code></pre></div><ul> <li>This line uses the conditional (ternary) operator to assign a value to <code>block_size</code>.</li> <li>It checks if <code>ent</code> is not <code>NULL</code>. <ul> <li>If <code>ent</code> is valid (i.e., not <code>NULL</code>), <code>block_size</code> is assigned the value of <code>ent-&gt;sampleDelta</code>.</li> <li>If <code>ent</code> is <code>NULL</code>, <code>block_size</code> is assigned a default value of <code>160</code>.</li> </ul> </li> </ul> <h2 id="fix">Fix</h2> <p><img src="image%201.png" alt="image.png"></p>