Skip to content

Panic when using read_box #5

Closed
Closed
Panic when using read_box#5

Description

@frewsxcv
frewsxcv
opened on Oct 29, 2015
extern crate mp4parse;

use std::io::Cursor;

fn main() {
    let mut c = Cursor::new(b"\x30\x30\x30\x30\x66\x74\x79\x70\x30\x30\x30\x30\x30\x30\x30\x30".to_vec());
    let mut context = mp4parse::MediaContext::new();
    let _ = mp4parse::read_box(&mut c, &mut context);
}

panic discovered using afl.rs

Activity

  1. rillian
    added a commit that references this issue on Oct 29, 2015

    Add regression test from fuzzing.

    6899348

  2. rillian commented on Oct 29, 2015

    @rillian
    rillian
    on Oct 29, 2015
    Contributor

    Nice one! This declares a very large number of compatible brands in an ftyp box but doesn't supply them. Since be_fourcc didn't check for short reads, we would hit EOF but return a fourcc value each time. The programme only halts (after creating all 808M?) on the assert at the end of read_box which checks that we've read all the data.

    I've added the testcase as 6899348 and a return value check as b154acc which fixes the slow crash.

  3. rillian
    closed this as completedon Oct 29, 2015

  4. rillian commented on Oct 29, 2015

    @rillian
    rillian
    on Oct 29, 2015
    Contributor

    Sorry, only 202116105 compatible brands. Forgot to divide by 4 for the fourcc width.

  5. lilith
    added a commit that references this issue on Jul 17, 2026

    Add regression test from fuzzing.

    bd4967e
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    Priority

    None yet

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions