L-SMASH vulnerabilities

L-SMASH through 2.14.5 contains a heap out-of-bounds write vulnerability in isom_read_hdlr() and isom_read_dref_entry() in core/read.c triggered by oversized box sizes. Crafted MP4 or MOV files declaring hdlr or url box sizes larger than remaining data stall the stream position and corrupt heap memory.

L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmash_read_file() or the boxdumper, remuxer, or muxer tools, causing use-after-free, heap corruption, and crashes.

L-SMASH through 2.14.5 contains an infinite loop vulnerability in vc1_importer_probe() in importer/vc1_imp.c. Attackers can supply a file consisting only of zero bytes, which lsmash_read_file() probes automatically, causing indefinite CPU consumption and denial of service.