Skip to content

Conversation

Copy link
Contributor

Copilot AI commented Jan 10, 2026

Addresses potential integer overflow in ParseProtectionSystemSpecificHeaderBox where kidCount * 16 multiplication could wrap around, bypassing bounds checks and causing buffer overruns with malformed MP4 files.

Changes:

  • Add overflow validation before kidCount * 16 multiplication
  • Include <cstdint> for SIZE_MAX constant
  • Log error when overflow detected
uint32_t kidCount = ReadU32();
// Check for integer overflow before multiplication
if (kidCount > SIZE_MAX / 16)
{
    parseError = MP4_PARSE_ERROR_DATA_BOUNDARY_MISMATCH;
    MP4_LOG_ERR("Invalid KID count %u would cause integer overflow", kidCount);
    return;
}
size_t kidBytes = static_cast<size_t>(kidCount) * 16;

Without this check, a malicious kidCount value (e.g., SIZE_MAX / 16 + 1) would overflow to a small value, pass the subsequent bounds check at line 404, but advance ptr incorrectly at line 410.


💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

Co-authored-by: pstroffolino <20442081+pstroffolino@users.noreply.github.com>
Copilot AI changed the title [WIP] WIP address feedback on VPLAY-12333 mp4demux hardening PR Fix integer overflow in PSSH box KID count validation Jan 10, 2026
Copilot AI requested a review from pstroffolino January 10, 2026 22:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants