Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Panic when using read_box #5

Closed
frewsxcv opened this issue Oct 29, 2015 · 2 comments
Closed

Panic when using read_box #5

frewsxcv opened this issue Oct 29, 2015 · 2 comments

Comments

@frewsxcv
Copy link
Contributor

extern crate mp4parse;

use std::io::Cursor;

fn main() {
    let mut c = Cursor::new(b"\x30\x30\x30\x30\x66\x74\x79\x70\x30\x30\x30\x30\x30\x30\x30\x30".to_vec());
    let mut context = mp4parse::MediaContext::new();
    let _ = mp4parse::read_box(&mut c, &mut context);
}

panic discovered using afl.rs

rillian added a commit that referenced this issue Oct 29, 2015
This is the test case from frewsxcv's fuzzing work,
generated by American Fuzzy Lop's rust support.

It found a loop where we don't check the return value
of read().

#5
@rillian
Copy link
Contributor

rillian commented Oct 29, 2015

Nice one! This declares a very large number of compatible brands in an ftyp box but doesn't supply them. Since be_fourcc didn't check for short reads, we would hit EOF but return a fourcc value each time. The programme only halts (after creating all 808M?) on the assert at the end of read_box which checks that we've read all the data.

I've added the testcase as 6899348 and a return value check as b154acc which fixes the slow crash.

@rillian rillian closed this as completed Oct 29, 2015
@rillian
Copy link
Contributor

rillian commented Oct 29, 2015

Sorry, only 202116105 compatible brands. Forgot to divide by 4 for the fourcc width.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants