CVE-2025-55664: Heap-based Buffer Overflow in GPAC/MP4Box via m2tsdmx_send_packet on crafted MPEG-2 TS file

["Alexander A. Shvedov" <shvedov () gmx com>]

Product:   GPAC (MP4Box)
Affected:  gpac/MP4Box prior to fix commit 8e3b5e1dde7b9ea041dbdc14456a5bb74a9851ea (GPAC version 
2.5-DEV-rev1644-g8e3b5e1dd-master)
CVE:       CVE-2025-55664
CWE:       CWE-122 (Heap-based Buffer Overflow)
CVSS 3.1:  8.8 HIGH (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Reporter:  sigdevel <https://infosec.exchange/@sigdevel>

Description:
  The m2tsdmx_send_packet function in filters/dmx_m2ts.c performs a memcpy whose
  size argument is derived from stream-controlled PES packet data without
  validation. A crafted MPEG-2 TS file with missing sync markers (0x47), corrupted
  PMT descriptor sizes, PID conflicts, and packet discontinuities causes the
  computed copy size to wrap to 4294967295 (0xFFFFFFFF) at line 916.

  The resulting memcpy reads and writes starting one byte past the end of a
  183-byte heap-allocated region, resulting in a heap buffer overflow. Due to the
  write-capable nature of the oversized memcpy, arbitrary code execution cannot
  be ruled out.

  Crash is reproducible on the current master branch at the time of
  discovery. No authentication or special privileges required beyond
  ability to provide a crafted file.

Reproduction:
  -Build-opts: `--static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0"` ;
  -Command: ./MP4Box -dash 100 51_m2tsdmx_send_packet_filters_dmx_m2ts_c_916

Asan-log:
==294950==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5100000006f8 at pc 0x7fc5766f2956 bp 
0x7ffde8b91e70 sp 0x7ffde8b91630
==294950==The signal is caused by a READ memory access.
    #0 0x7fc5766f2955 in memcpy 
../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115
    #1 0x7fc57582aec6 in m2tsdmx_send_packet filters/dmx_m2ts.c:916
    #2 0x7fc57582aec6 in m2tsdmx_on_event filters/dmx_m2ts.c:1164

PoC:
  https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/51/51_m2tsdmx_send_packet_filters_dmx_m2ts_c_916

References:
  https://github.com/gpac/gpac/issues/3310
  https://nvd.nist.gov/vuln/detail/CVE-2025-55664
  https://www.cve.org/CVERecord?id=CVE-2025-55664

 
---
Best regards,
Alexander A. Shvedov
https://github.com/sigdevel