Posted by Ron E on Sep 08
The FullBox::get_flags() method retrieves 24-bit flags from the underlying
box header. When a malformed box truncates the field, the function still
attempts to read three bytes. With insufficient data, this reads past valid
memory into uninitialized or out-of-bounds memory.
*Root Cause:*
–
No length validation before reading flag fields.
*Impact:*
–
Crash due to invalid memory access.
–
Potential leakage of heap memory…
– Read More – Full Disclosure
