src/ZenLib/Source/ZenLib/BitStream_Fast.h:198 Global Buffer Overflow in ZenLib::BitStream_Fast::Get4

[sigdevel]

src/ZenLib/Source/ZenLib/BitStream_Fast.h:198 Global Buffer Overflow in ZenLib::BitStream_Fast::Get4

Description:

When processing a crafted MP4 sample with a crafted meta/iloc box, MediaInfo crashes in ZenLib::BitStream_Fast::Get4() at src/ZenLib/Source/ZenLib/BitStream_Fast.h:198 with a global-buffer-overflow.

Get4() takes HowMany, the number of bits to read as an int8u and uses it in two places at the end of the function without checking that it fits within the declared bounds:

ToReturn |= (LastByte >> (Buffer_Size % 8)) & Mask[NewBits];
return ToReturn & Mask[HowMany];

Mask is const int32u[33], so indices 0–32 are valid. File_Mpeg4::meta_iloc() at File_Mpeg4_Elements.cpp:2717 calls Get4(80) based on a field decoded from the crafted iloc box. This causes both ToReturn = LastByte << NewBits with NewBits = 80 (undefined shift on a 32-bit type) and Mask[80] (out-of-bounds table read). UBSAN reports both violations; ASAN reports the global-buffer-overflow on the Mask access at line 198.

Output:

asan-build:

show relevant excerpt - click to expand

/run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Project/CMake/../../../ZenLib/Source/ZenLib/BitStream_Fast.h:184:30: runtime error: shift exponent 80 is too large for 32-bit type 'int'                                                                                                
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Project/CMake/../../../ZenLib/Source/ZenLib/BitStream_Fast.h:184:30 
/run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Project/CMake/../../../ZenLib/Source/ZenLib/BitStream_Fast.h:198:47: runtime error: index 80 out of bounds for type 'const int32u[33]' (aka 'const unsigned int[33]')                                                                   
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Project/CMake/../../../ZenLib/Source/ZenLib/BitStream_Fast.h:198:47 
=================================================================
==891440==ERROR: AddressSanitizer: global-buffer-overflow on address 0x55b400a6a120 at pc 0x55b3fddbff48 bp 0x7fffdbe87cf0 sp 0x7fffdbe87ce8
READ of size 4 at 0x55b400a6a120 thread T0                                                                                                                  
    #0 0x55b3fddbff47 in ZenLib::BitStream_Fast::Get4(unsigned char) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Project/CMake/../../../ZenLib/Source/ZenLib/BitStream_Fast.h:198:47
    #1 0x55b4001233ae in MediaInfoLib::File__Analyze::Get_BS(unsigned char, unsigned int&, char const*) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__Analyze_Buffer.cpp:2122:14
    #2 0x55b3fedc95f8 in MediaInfoLib::File_Mpeg4::meta_iloc() /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/Multiple/File_Mpeg4_Elements.cpp:2717:17
    #3 0x55b3fed6da27 in MediaInfoLib::File_Mpeg4::Data_Parse() /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/Multiple/File_Mpeg4_Elements.cpp:1168:9
    #4 0x55b400049521 in MediaInfoLib::File__Analyze::Data_Manage() /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__Analyze.cpp:2858:9
    #5 0x55b400033e9e in MediaInfoLib::File__Analyze::Buffer_Parse() /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__Analyze.cpp:1961:10
    #6 0x55b40001aaa5 in MediaInfoLib::File__Analyze::Open_Buffer_Continue_Loop() /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__Analyze.cpp:1526:14
    #7 0x55b40000d10b in MediaInfoLib::File__Analyze::Open_Buffer_Continue(unsigned char const*, unsigned long) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__Analyze.cpp:1114:16
    #8 0x55b40029984c in MediaInfoLib::File__MultipleParsing::Read_Buffer_Continue() /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__MultipleParsing.cpp:950:22
    #9 0x55b400019d6c in MediaInfoLib::File__Analyze::Open_Buffer_Continue_Loop() /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__Analyze.cpp:1501:5
    #10 0x55b40000d10b in MediaInfoLib::File__Analyze::Open_Buffer_Continue(unsigned char const*, unsigned long) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__Analyze.cpp:1114:16
    #11 0x55b3fdbb6057 in MediaInfoLib::MediaInfo_Internal::Open_Buffer_Continue(unsigned char const*, unsigned long) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/MediaInfo_Internal.cpp:1723:11
    #12 0x55b3fda5cebb in MediaInfoLib::MediaInfo::Open_Buffer_Continue(unsigned char const*, unsigned long) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/MediaInfo.cpp:110:22
    #13 0x55b3fda5c12f in run_one(MediaInfoLib::MediaInfo&, unsigned char const*, unsigned long) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/runtime/fuzz_harness/fuzz_mediainfo.cpp:53:28
    #14 0x55b3fda5c12f in main /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/runtime/fuzz_harness/fuzz_mediainfo.cpp:101:5
    #15 0x7f0e57f3df74 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #16 0x7f0e57f3e026 in __libc_start_main csu/../csu/libc-start.c:360:3
    #17 0x55b3fd978830 in _start (/run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/runtime/fuzz_harness/fuzz_mediainfo_asan+0x2313830) (BuildId: bea5f1543242f0d0639eacc3bc8ac2978314c4a4)

0x55b400a6a120 is located 32 bytes before global variable 'MediaInfoLib::AC3_MLP_Resolution' defined in '/run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/Audio/File_Ac3.cpp:857' (0x55b400a6a140) of size 64                                                           
0x55b400a6a120 is located 0 bytes after global variable 'MediaInfoLib::AC3_MLP_Channels' defined in '/run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/Audio/File_Ac3.cpp:820' (0x55b400a6a0a0) of size 128                                                              
SUMMARY: AddressSanitizer: global-buffer-overflow /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Project/CMake/../../../ZenLib/Source/ZenLib/BitStream_Fast.h:198:47 in ZenLib::BitStream_Fast::Get4(unsigned char)
Shadow bytes around the buggy address:
  0x55b400a69e80: 04 f9 f9 f9 04 f9 f9 f9 04 f9 f9 f9 04 f9 f9 f9
  0x55b400a69f00: 03 f9 f9 f9 03 f9 f9 f9 00 00 05 f9 f9 f9 f9 f9
  0x55b400a69f80: 00 00 00 00 00 00 07 f9 f9 f9 f9 f9 00 00 00 00
  0x55b400a6a000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x55b400a6a080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x55b400a6a100: 00 00 00 00[f9]f9 f9 f9 00 00 00 00 00 00 00 00
  0x55b400a6a180: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
  0x55b400a6a200: 00 00 00 05 f9 f9 f9 f9 00 00 03 f9 f9 f9 f9 f9
  0x55b400a6a280: 00 00 06 f9 f9 f9 f9 f9 00 00 00 01 f9 f9 f9 f9
  0x55b400a6a300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x55b400a6a380: 00 01 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==891440==ABORTING

Environment

OS: Linux rack1 6.19.14+kali-amd64 #1 SMP PREEMPT_DYNAMIC Kali 6.19.14-1+kali1 (2026-05-05) x86_64 GNU/Linux ;
Compiler version: Debian clang version 21.1.8 (3+b1) ;
Build-opts: -fsanitize=address,undefined -g ;
CPU type: x86_64 ;
MediaInfo - commit hash c1b98df276b93c95849380248e82acb8554def26 ;
MediaInfo version - 26.01 ;

Additional context

sample:

mediainfo_7

Screenshot

[cjee21]

Cannot reproduce this on Windows.

Anyway, there are many Get functions that can only accept a certain size but they are called without checking that the size passed in is within supported range. The only checks are for remaining buffer.

[sigdevel]

Just in case, I'm also including a reproduction of this bug (702c9b7).
If you'd like, you can close this issue and move it to the security notices section
asan-build:

show relevant excerpt - click to expand

/run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Project/CMake/../../../ZenLib/Source/ZenLib/BitStream_Fast.h:184:30: runtime error: shift exponent 80 is too large for 32-bit type 'int'
    #0 0x557201f7c03c in ZenLib::BitStream_Fast::Get4(unsigned char) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Project/CMake/../../../ZenLib/Source/ZenLib/BitStream_Fast.h:184:30
    #1 0x55720372f1e3 in MediaInfoLib::File__Analyze::Get_BS(unsigned char, unsigned int&, char const*) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__Analyze_Buffer.cpp:2122:14
    #2 0x557202a560a4 in MediaInfoLib::File_Mpeg4::meta_iloc() /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/Multiple/File_Mpeg4_Elements.cpp:2717:17
    #3 0x55720368e6ea in MediaInfoLib::File__Analyze::Data_Manage() /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__Analyze.cpp:2859:9
    #4 0x55720367cfc9 in MediaInfoLib::File__Analyze::Buffer_Parse() /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__Analyze.cpp:1961:10
    #5 0x5572036673d1 in MediaInfoLib::File__Analyze::Open_Buffer_Continue_Loop() /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__Analyze.cpp:1526:14
    #6 0x55720365b29a in MediaInfoLib::File__Analyze::Open_Buffer_Continue(unsigned char const*, unsigned long) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__Analyze.cpp:1114:16
    #7 0x55720384af23 in MediaInfoLib::File__MultipleParsing::Read_Buffer_Continue() /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__MultipleParsing.cpp:950:22
    #8 0x55720366684e in MediaInfoLib::File__Analyze::Open_Buffer_Continue_Loop() /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__Analyze.cpp:1501:5
    #9 0x55720365b29a in MediaInfoLib::File__Analyze::Open_Buffer_Continue(unsigned char const*, unsigned long) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__Analyze.cpp:1114:16
    #10 0x557201e31171 in MediaInfoLib::MediaInfo_Internal::Open_Buffer_Continue(unsigned char const*, unsigned long) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/MediaInfo_Internal.cpp:1723:11
    #11 0x557201d60d8f in run_one(MediaInfoLib::MediaInfo&, unsigned char const*, unsigned long) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/runtime/fuzz_harness/fuzz_mediainfo.cpp:53:28
    #12 0x557201d60d8f in main /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/runtime/fuzz_harness/fuzz_mediainfo.cpp:101:5
    #13 0x7fb560033f74 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #14 0x7fb560034026 in __libc_start_main csu/../csu/libc-start.c:360:3
    #15 0x557201d5f6f0 in _start (/run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/runtime/fuzz_harness/fuzz_mediainfo_asan+0xf8b6f0) (BuildId: a36ff63e8a4dcd9a83125b75d59401c897f711a6)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Project/CMake/../../../ZenLib/Source/ZenLib/BitStream_Fast.h:184:30 

[cjee21]

ISO/IEC 14496-12 says:

offset_size is taken from the set {0, 4, 8} and indicates the length in bytes of the offset field.
length_size is taken from the set {0, 4, 8} and indicates the length in bytes of the length field.
base_offset_size is taken from the set {0, 4, 8} and indicates the length in bytes of the base_offset
field.
index_size is taken from the set {0, 4, 8} and indicates the length in bytes of the extent_index field.

MediaInfoLib does not validate that the values are valid and just multiplies them by 8 and uses the value for Get4 which at the moment does not reject values it does not support (>32).

So a few problems here...

1. Since it is not validated, malformed file can have a value up to 15 as the fields are 4-bits. 15 x 8 is a large 120 as well as not spec compliant.
2. Spec compliant streams can have value 8. 8 x 8 is 64. Get8 should be used instead of Get4.
3. ZenLib needs to be patched to reject unsupported values that can cause array overreads and undefined behaviour.