The Box_stts structure defines decoding time to sample mapping. In Box_stts::get_sample_duration(unsigned), the requested index is assumed valid. A crafted file can set entry_count inconsistently with the actual buffer size, leading to access beyond the bounds of the parsed vector.
*Root Cause:* - Lack of bounds checks on entry_count and indexing operations. - Blind trust in stts box metadata. *Impact:* - Invalid memory access → denial of service. - Information disclosure: reading adjacent heap contents may leak sensitive data. *Evidence:*SUMMARY: AddressSanitizer: SEGV in Box_stts::get_sample_duration(unsigned) _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
