CVE-2024-47545

What it actually does

Integer underflow in qtdemux_parse_trak during strf box parsing allows size to become negative after subtracting 40, causing gst_buffer_fill to perform an oversized memcpy that results in an out-of-bounds read.

Why it matters to the business

Applications that process untrusted MP4 or QuickTime media with GStreamer can crash or leak memory contents, disrupting media pipelines and potentially exposing sensitive data from the process address space.

How an attack unfolds

An attacker crafts a specially malformed MP4 file containing a strf box whose size field is smaller than 40 bytes. When GStreamer parses the trak atom, the underflow produces a large tocopy value passed to gst_buffer_fill, triggering an out-of-bounds read that may crash the process or disclose memory.

How to fix it

Upgrade gstreamer to version 1.24.10 or apply commit 5be4b6f03689ab438822f6cfcd13f1f300afe203. Rebuild and redeploy all dependent applications after the update.

How to confirm the fix worked

Confirm the installed GStreamer version is at least 1.24.10, run regression tests with crafted MP4 files containing undersized strf boxes, and verify absence of crashes or sanitizer violations during parsing.

Typical attack path

1. Attacker creates MP4 file with undersized strf box inside trak atom
2. Victim application opens the file using GStreamer qtdemux
3. qtdemux_parse_trak subtracts 40 from size yielding negative value
4. gst_buffer_fill is called with oversized tocopy argument
5. memcpy performs out-of-bounds read leading to crash or data leak

How to detect it

Review application logs for segmentation faults or GLib/GStreamer critical errors during MP4 demuxing, inspect core dumps for memcpy-related crashes in qtdemux, and correlate file-processing timestamps with abnormal memory access events.

What your security team should do

• Immediately upgrade all GStreamer installations to 1.24.10 or later
• Add the fixed commit hash to internal dependency scanning rules
• Block or sanitize untrusted MP4/QuickTime files at ingestion points until patched
• Monitor for crashes in media-processing services that use qtdemux