Posted by Ron E on Sep 08
The Box_stts structure defines decoding time to sample mapping. In
Box_stts::get_sample_duration(unsigned), the requested index is assumed
valid. A crafted file can set entry_count inconsistently with the actual
buffer size, leading to access beyond the bounds of the parsed vector.
*Root Cause:*
–
Lack of bounds checks on entry_count and indexing operations.
–
Blind trust in stts box metadata.
*Impact:*
–
Invalid memory…
– Read More – Full Disclosure
