VULNERABILITY DETAILS
Integer overflow happens in ChunkDemuxer of Chrome(Android), leading to Out-of-bounds Write.

FFmpegDemuxer and ChunkDemuxer in Chrome.

https://cs.chromium.org/chromium/src/media/blink/webmediaplayer_impl.cc?dr=CSs&sq=package:chromium&rcl=1484007841&l=1643

	void WebMediaPlayerImpl::StartPipeline() {
		//...

		#if !defined(MEDIA_DISABLE_FFMPEG)
		    Demuxer::MediaTracksUpdatedCB media_tracks_updated_cb =
		        BIND_TO_RENDER_LOOP(&WebMediaPlayerImpl::OnFFmpegMediaTracksUpdated);

		    demuxer_.reset(new FFmpegDemuxer(media_task_runner_, data_source_.get(),
		                                     encrypted_media_init_data_cb,
		                                     media_tracks_updated_cb, media_log_));
		#else
		    OnError(PipelineStatus::DEMUXER_ERROR_COULD_NOT_OPEN);
		    return;
		#endif
		} else {
		  DCHECK(!chunk_demuxer_);
		  DCHECK(!data_source_);

		  chunk_demuxer_ = new ChunkDemuxer(
		      BIND_TO_RENDER_LOOP(&WebMediaPlayerImpl::OnDemuxerOpened),
		      encrypted_media_init_data_cb, media_log_);
		  demuxer_.reset(chunk_demuxer_);
		}

		//...
	}

When playing video by Media Source Extention, chrome will call ChunkDemuxer to parse video.

ChunkDemuxer provide some media formats, such as https://cs.chromium.org/chromium/src/media/formats/.

When parsing 'SGPD' box of MP4 in file box_definitions.cc, integer overflow happens. 

	https://cs.chromium.org/chromium/src/media/formats/mp4/box_definitions.cc

	bool SampleGroupDescription::Parse(BoxReader* reader) {
	  RCHECK(reader->ReadFullBoxHeader() &&
	         reader->Read4(&grouping_type));

	  if (grouping_type != FOURCC_SEIG) {
	    DLOG(WARNING) << "SampleGroupDescription box with grouping_type '"
	                  << grouping_type << "' is not supported.";
	    return true;
	  }

	  const uint8_t version = reader->version();

	  const size_t kEntrySize = sizeof(uint32_t) + kKeyIdSize;
	  uint32_t default_length = 0;
	  if (version == 1) {
	      RCHECK(reader->Read4(&default_length));
	      RCHECK(default_length == 0 || default_length >= kEntrySize);
	  }

	  uint32_t count;
	  RCHECK(reader->Read4(&count));
	  entries.resize(count);
	  for (uint32_t i = 0; i < count; ++i) {
	    if (version == 1) {
	      if (default_length == 0) {
	        uint32_t description_length = 0;
	        RCHECK(reader->Read4(&description_length));
	        RCHECK(description_length >= kEntrySize);
	      }
	    }
	    RCHECK(entries[i].Parse(reader));
	  }
	  return true;
	}

count is read from mp4 file, which is between 0x0 and 0xffffffff.
entries is defined as std::vector<CencSampleEncryptionInfoEntry> entries;, entries.resize(count); will malloc count * sizeof(CencSampleEncryptionInfoEntry) bytes, this will also overflow, leading to out-of-bounds write.

Because SGPD is in encrypted video, playing encrypted video requires deploying a whole system using Encrypted Media Extensions(EME). So I will not provide a PoC file, just patch file.

PATCH:
	--- box_definitions_a.cc        2017-01-10 14:53:55.000000000 +0800
	+++ box_definitions_b.cc        2017-01-10 15:32:06.000000000 +0800
	@@ -1254,6 +1254,7 @@

	   uint32_t count;
	   RCHECK(reader->Read4(&count));
	+  RCHECK(((count * sizeof(CencSampleEncryptionInfoEntry)) / sizeof(CencSampleEncryptionInfoEntry)) == count);
	   entries.resize(count);
	   for (uint32_t i = 0; i < count; ++i) {
	     if (version == 1) {


 

Deleted: patch.diff 403 bytes

patch.diff 403 bytes Download