CVE-2024-47597

What it actually does

Out-of-bounds read of up to 8 bytes in qtdemux_parse_samples when qt_atom_parser_get_offset_unchecked accesses data past the end of the stream->stco buffer during MP4 sample parsing.

Why it matters to the business

Media-processing applications may crash or leak limited memory contents when handling crafted video files, potentially disrupting content pipelines or workflows that rely on GStreamer.

How an attack unfolds

An attacker supplies a malicious MP4 file (such as the referenced crash sample) that is parsed by the qtdemux element; the parser reads beyond the allocated stco buffer, resulting in an out-of-bounds memory read that can cause denial of service or minor information disclosure.

How to fix it

Upgrade GStreamer to version 1.24.10 or later; apply commit 5be4b6f03689ab438822f6cfcd13f1f300afe203 in GIT builds to correct the buffer boundary check in qtdemux.c.

How to confirm the fix worked

Confirm the installed GStreamer version is at least 1.24.10; attempt to process the GHSL-2024-245_crash1.mp4 sample and verify the process no longer crashes or reports out-of-bounds access.

Typical attack path

1. Attacker crafts a specially formed MP4 file containing invalid stco atom data.
2. Victim application or service uses GStreamer to open or process the file via qtdemux.
3. qtdemux_parse_samples calls qt_atom_parser_get_offset_unchecked on the malformed buffer.
4. Read operation extends past the end of the stream->stco allocation.
5. Process encounters invalid memory, leading to crash or limited data exposure.

How to detect it

Review application logs and crash reports for segmentation faults or memory errors occurring inside libgstreamer or qtdemux during MP4 file processing; correlate with file names or sources that match known malicious samples.

• GHSL-2024-245_crash1.mp4
• qtdemux_parse_samples
• qt_atom_parser_get_offset_unchecked

What your security team should do

• Immediately update all GStreamer installations to 1.24.10 or the patched GIT commit.
• Scan media ingestion pipelines for use of the qtdemux element and prioritize patching.
• Add MP4 file validation or sandboxing for untrusted content until upgrades are complete.
• Monitor for application crashes during MP4 parsing as a temporary detection signal.