src/MediaInfoLib/Source/MediaInfo/Video/File_Mpegv.cpp:1277-1278 Invalid Array Index Leading to SEGV in MediaInfoLib::File_Mpegv::Streams_Fill

[sigdevel]

src/MediaInfoLib/Source/MediaInfo/Video/File_Mpegv.cpp:1277-1278 Invalid Array Index Leading to SEGV in MediaInfoLib::File_Mpegv::Streams_Fill

Description:

When processing a crafted MPEG video sample, MediaInfo crashes in MediaInfoLib::File_Mpegv::Streams_Fill() at src/MediaInfoLib/Source/MediaInfo/Video/File_Mpegv.cpp:1277–1278.

Streams_Fill() uses the bitstream-derived chroma_format field as a direct index into two 4-entry const char* tables with no range check preceding either access:

Fill(Stream_Video, 0, Video_ChromaSubsampling, Mpegv_chroma_format[chroma_format]);
Fill(Stream_Video, 0, Video_ColorSpace, Mpegv_chroma_format_Colorspace[chroma_format]);

Both Mpegv_chroma_format and Mpegv_chroma_format_Colorspace are const char *[4]. A crafted MPEG video bitstream sets chroma_format to 190, producing out-of-bounds reads at both lines. UBSAN reports index 190 out of bounds for type 'const char *[4]' twice; the garbage pointer returned from the table is forwarded into Fill() and eventually to strlen() inside Ztring::From_UTF8(), which faults on the near-zero address.

Output:

asan-build:

show relevant excerpt - click to expand

/run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/Video/File_Mpegv.cpp:1277:52: runtime error: index 190 out of bounds for type 'const char *[4]'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/Video/File_Mpegv.cpp:1277:52 
/run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/Video/File_Mpegv.cpp:1278:45: runtime error: index 190 out of bounds for type 'const char *[4]'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/Video/File_Mpegv.cpp:1278:45 
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1091041==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000003 (pc 0x7fabc514f0d9 bp 0x7ffda26abf20 sp 0x7ffda26ab6d8 T0)
==1091041==The signal is caused by a READ memory access.
==1091041==Hint: address points to the zero page.
    #0 0x7fabc514f0d9 in __strlen_avx2_rtm string/../sysdeps/x86_64/multiarch/strlen-avx2.S:76
    #1 0x562958cbe547 in strlen (/run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/runtime/fuzz_harness/fuzz_mediainfo_asan+0x232b547) (BuildId: bea5f1543242f0d0639eacc3bc8ac2978314c4a4)
    #2 0x56295bb07cf0 in ZenLib::Ztring::From_UTF8(char const*, unsigned long, unsigned long) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/ZenLib/Source/ZenLib/Ztring.cpp:408:16
    #3 0x562958f1c9d8 in ZenLib::Ztring::From_UTF8(char const*, unsigned long) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Project/CMake/../../../ZenLib/Source/ZenLib/Ztring.h:91:89
    #4 0x562958f1bb48 in MediaInfoLib::File__Analyze::Fill(MediaInfoLib::stream_t, unsigned long, unsigned long, char const*, unsigned long, bool, bool) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Project/CMake/../../Source/MediaInfo/File__Analyze.h:1162:226
    #5 0x56295b13b093 in MediaInfoLib::File_Mpegv::Streams_Fill() /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/Video/File_Mpegv.cpp:1278:5
    #6 0x56295b366451 in MediaInfoLib::File__Analyze::Fill(char const*) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__Analyze.cpp:3569:5
    #7 0x56295b3a6eae in MediaInfoLib::File__Analyze::Fill(MediaInfoLib::File__Analyze*) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__Analyze.cpp:3586:13
    #8 0x562959f7f730 in MediaInfoLib::File_Mpeg4::Streams_Finish() /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/Multiple/File_Mpeg4.cpp:983:17
    #9 0x56295b34f080 in MediaInfoLib::File__Analyze::ForceFinish(char const*) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__Analyze.cpp:3672:9
    #10 0x56295b363c37 in MediaInfoLib::File__Analyze::Open_Buffer_Finalize(bool) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__Analyze.cpp:1732:9
    #11 0x56295b5c7c75 in MediaInfoLib::File__MultipleParsing::Read_Buffer_Continue() /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__MultipleParsing.cpp:952:26
    #12 0x56295b347d6c in MediaInfoLib::File__Analyze::Open_Buffer_Continue_Loop() /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__Analyze.cpp:1501:5
    #13 0x56295b33b10b in MediaInfoLib::File__Analyze::Open_Buffer_Continue(unsigned char const*, unsigned long) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__Analyze.cpp:1114:16
    #14 0x562958ee4057 in MediaInfoLib::MediaInfo_Internal::Open_Buffer_Continue(unsigned char const*, unsigned long) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/MediaInfo_Internal.cpp:1723:11
    #15 0x562958d8aebb in MediaInfoLib::MediaInfo::Open_Buffer_Continue(unsigned char const*, unsigned long) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/MediaInfo.cpp:110:22
    #16 0x562958d8a12f in run_one(MediaInfoLib::MediaInfo&, unsigned char const*, unsigned long) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/runtime/fuzz_harness/fuzz_mediainfo.cpp:53:28
    #17 0x562958d8a12f in main /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/runtime/fuzz_harness/fuzz_mediainfo.cpp:101:5
    #18 0x7fabc5005f74 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #19 0x7fabc5006026 in __libc_start_main csu/../csu/libc-start.c:360:3
    #20 0x562958ca6830 in _start (/run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/runtime/fuzz_harness/fuzz_mediainfo_asan+0x2313830) (BuildId: bea5f1543242f0d0639eacc3bc8ac2978314c4a4)

==1091041==Register values:
rax = 0x0000000000000003  rbx = 0x00000000a26ac001  rcx = 0x0000000000000001  rdx = 0x0000000000000003  
rdi = 0x0000000000000003  rsi = 0x0000000000000003  rbp = 0x00007ffda26abf20  rsp = 0x00007ffda26ab6d8  
 r8 = 0x0000000000000000   r9 = 0x00007fffffffff01  r10 = 0x000051f000009a01  r11 = 0x0000000000000246  
r12 = 0x000051b000000080  r13 = 0x0000000000000600  r14 = 0x0000000000000003  r15 = 0x000051b000000080  
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV string/../sysdeps/x86_64/multiarch/strlen-avx2.S:76 in __strlen_avx2_rtm
==1091041==ABORTING

Environment

OS: Linux rack1 6.19.14+kali-amd64 #1 SMP PREEMPT_DYNAMIC Kali 6.19.14-1+kali1 (2026-05-05) x86_64 GNU/Linux ;
Compiler version: Debian clang version 21.1.8 (3+b1) ;
Build-opts: -fsanitize=address,undefined -g ;
CPU type: x86_64 ;
MediaInfo - commit hash c1b98df276b93c95849380248e82acb8554def26 ;
MediaInfo version - 26.01 ;

Additional context

sample:

mediainfo_9

Screenshot

[cjee21]

There is another bug detected by MSVC with that PoC.

    for (int8u Pos=0x01; Pos<=0xAF; Pos++)
        Streams[Pos].Searching_Payload=false;

at Streams_Fill is accessing Streams of size 0 because Synched_Init did not execute.

[cjee21]

I cannot reproduce the crash in initial post on Windows.

A crafted MPEG video bitstream sets chroma_format to 190, producing out-of-bounds reads at both lines.

This is not possible as chroma_format is read from 2 bits so max value is 3 (total 4 possibilities) which is within array size of 4. If it crashes due to array over-access then it may be due to using uninitialized data.

@JeromeMartinez not wanting to initialize variables for optimization but when access happens before value is updated, that is an issue. That is why static analyzer and C++ recommends initializing all class member variables. Because when assignment and access happens in different methods, it is difficult to ascertain that the assignment method will always be called before the access.

There are 900+ of such warnings across entire codebase:

Severity	Code	Description	Project	File	Line	Suppression State	Details
Warning	C26495	Variable 'MediaInfoLib::File_Mpegv::chroma_format' is uninitialized. Always initialize a member variable (type.6).	MediaInfoLib	Source\MediaInfo\Video\File_Mpegv.cpp	1075		

---

UPDATE: On Windows, chroma_format is always 0 when that line is executed. So I manually set the uninitialized chroma_format to 190 and [Address Sanitizer Error: Global buffer overflow] happens. So this one is a random crash that is due to uninitialized variable and not directly due to the file although the file may have caused that part to be executed before the value is read from stream.

[sigdevel]

Just in case, I'm also including a reproduction of this bug (702c9b7).
If you'd like, you can close this issue and move it to the security notices section
asan-build:

show relevant excerpt - click to expand

/run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/Video/File_Mpegv.cpp:1277:52: runtime error: index 190 out of bounds for type 'const char *[4]'
    #0 0x555735f10136 in MediaInfoLib::File_Mpegv::Streams_Fill() /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/Video/File_Mpegv.cpp:1277:52
    #1 0x55573608434b in MediaInfoLib::File__Analyze::Fill(char const*) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__Analyze.cpp:3571:5
    #2 0x55573537b77b in MediaInfoLib::File_Mpeg4::Streams_Finish() /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/Multiple/File_Mpeg4.cpp:986:17
    #3 0x55573607073d in MediaInfoLib::File__Analyze::ForceFinish(char const*) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__Analyze.cpp:3674:9
    #4 0x555736082b57 in MediaInfoLib::File__Analyze::Open_Buffer_Finalize(bool) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__Analyze.cpp:1732:9
    #5 0x55573624f104 in MediaInfoLib::File__MultipleParsing::Read_Buffer_Continue() /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__MultipleParsing.cpp:952:26
    #6 0x55573606a84e in MediaInfoLib::File__Analyze::Open_Buffer_Continue_Loop() /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__Analyze.cpp:1501:5
    #7 0x55573605f29a in MediaInfoLib::File__Analyze::Open_Buffer_Continue(unsigned char const*, unsigned long) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/File__Analyze.cpp:1114:16
    #8 0x555734835171 in MediaInfoLib::MediaInfo_Internal::Open_Buffer_Continue(unsigned char const*, unsigned long) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/MediaInfo_Internal.cpp:1723:11
    #9 0x555734764d8f in run_one(MediaInfoLib::MediaInfo&, unsigned char const*, unsigned long) /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/runtime/fuzz_harness/fuzz_mediainfo.cpp:53:28
    #10 0x555734764d8f in main /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/runtime/fuzz_harness/fuzz_mediainfo.cpp:101:5
    #11 0x7f07b4a33f74 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #12 0x7f07b4a34026 in __libc_start_main csu/../csu/libc-start.c:360:3
    #13 0x5557347636f0 in _start (/run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/runtime/fuzz_harness/fuzz_mediainfo_asan+0xf8b6f0) (BuildId: a36ff63e8a4dcd9a83125b75d59401c897f711a6)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /run/media/user/81c71df6-ca99-4d27-a7b6-55107e347080/mediainfo/src/MediaInfoLib/Source/MediaInfo/Video/File_Mpegv.cpp:1277:52 

[JeromeMartinez]

If you'd like, you can close this issue and move it to the security notices section

We are late on them but we don't forget them, we'll fix that before the next release.