CVE-2025-55640: Heap Buffer Overflow in GPAC/MP4Box via stbl_AddSize on crafted MP4 with corrupted sample metadata

["Alexander A. Shvedov" <sigdevel () caramail com>]

Product:   GPAC (MP4Box)
Affected:  gpac/gpac prior to fix commit (321624f28d19a413449fd1718d1eb59037f8f7fc)
CVE:       CVE-2025-55640
CWE:       CWE-122 (Heap-based Buffer Overflow)
CVSS 3.1:  8.8 HIGH (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Reporter:  @sigdevel (Alexander Shvedov) <https://infosec.exchange/@sigdevel>

Description:
  When MP4Box imports a crafted MP4 file containing manipulated sample
  metadata (corrupted sample counts, invalid aspect ratios, and oversized
  box declarations), the stbl_AddSize() function in isomedia/stbl_write.c
  fails to validate sample count boundaries before writing to the sample
  size table (stsz box). The function writes beyond the allocated heap
  buffer for stbl->sampleSize->sizes, resulting in a heap-buffer-overflow.

  AddressSanitizer reports a WRITE of size 4 at isomedia/stbl_write.c:492
  immediately after a 64-byte heap allocation, reached via
  mp4_mux_process_sample() / gf_isom_add_sample() / trak_add_sample() /
  Media_AddSample() while MP4Box imports the crafted track.

  Crash is reproducible on the current master branch at the time of
  discovery. No authentication or special privileges required beyond
  ability to provide a crafted file.

Reproduction:
  -Build-opts: CC="gcc -fsanitize=address -g" CXX="g++ -fsanitize=address -g" ;
  -Command: ./MP4Box -add 25_poc.mp4 -new /dev/null

Asan-log:
==459908==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x506000006480 at pc 0x7f708f8531f1 bp 
0x7fff5014c390 sp 0x7fff5014c388
WRITE of size 4 at 0x506000006480 thread T0
    #0 0x7f708f8531f0 in stbl_AddSize isomedia/stbl_write.c:492
    #1 0x7f708f80cb60 in Media_AddSample isomedia/media.c:1033
    #2 0x7f708f7d12fb in trak_add_sample isomedia/isom_write.c:1048
    #3 0x7f708f7d1f33 in gf_isom_add_sample isomedia/isom_write.c:1120
    #4 0x7f70901cdf7f in mp4_mux_process_sample filters/mux_isom.c:5103
    #5 0x7f70901f7a09 in mp4_mux_process filters/mux_isom.c:7701
    #6 0x7f708feed9d1 in gf_filter_process_task filter_core/filter.c:3179
    #7 0x7f708fec0d25 in gf_fs_thread_proc filter_core/filter_session.c:2420
    #8 0x7f708fec5f84 in gf_fs_run filter_core/filter_session.c:2727
    #9 0x7f708f9a931d in gf_media_import media_tools/media_import.c:1601
    #10 0x55c0e9ef2be6 in import_file applications/mp4box/fileimport.c:1693

0x506000006480 is located 0 bytes after 64-byte region [0x506000006440,0x506000006480)
allocated by thread T0 here:
    #0 0x7f7090ef4c77 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
    #1 0x7f708f85a080 in stbl_SampleSizeAppend isomedia/stbl_write.c:1678

SUMMARY: AddressSanitizer: heap-buffer-overflow isomedia/stbl_write.c:492 in stbl_AddSize

PoC:
  https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/25/25_poc.mp4

References:
  https://github.com/gpac/gpac/issues/3261
  https://www.cve.org/CVERecord?id=CVE-2025-55640
  https://infosec.exchange/@sigdevel/116769271709415444

——
Best regards, Alexander A. Shvedov
@sigdevel