Fig 1. BF for CVE-2021-21834.
- DVR (Verify)
- Cause:
- Attributes:
- Mechanism:
- Source Code:
- Execution Space:
- Data State:
- Consequence:
- TCM (Calculate)
- Cause:
- Attributes:
- Mechanism:
- Source Code:
- Data Value Kind:
- Data Type Kind:
- Consequence:
- MAL (Allocate)
- Cause:
- Attributes:
- Mechanism:
- Source Code:
- Execution Space:
- Ownership:
- Location:
- Consequence:
- MAD (Reposition)
- Cause:
- Attributes:
- Mechanism:
- Source Code:
- Execution Space:
- Location:
- Consequence:
- MUS (Write)
- Cause:
- Attributes:
- Mechanism:
- Source Code:
- Execution Space:
- Span:
- Location:
- Consequence:
- The GPAC Project on Advanced Content is a C language implementation of the MPEG- 4 audio/video compression standard. In version 1.0.1, the library is vulnerable to decoding a specially crafted MPEG-4 input file.
- The library code reads the “number of entries” value from a file into a 32-bit integer object (
ptr−→nb_entries) and
checks if it is not larger than the 64- bits input size (ptr−→size/8). Then, the size of memory that should be
allocated is calculated by multiplying the “number of entries” by the size of a u64 object (sizeof(u64)), which can
result in an integer overflow on a 32-bit platform. When such an overflowed integer is used, the allocation routine
will create an undersized buffer, which will be populated based on its larger actual size, leading to a buffer
overflow. Fig.10 presents the BF taxonomy for this vulnerability.
- To fix the bug, the GPAC team checked the maximum integer size (
(u64)ptr−→nb_entries > (u64)SIZE_MAX/sizeof(u64)),
fixing the DVR bug and resolving the entire vulnerability.
Fig 2. BF for CWE-468.
- TCV (Cast)
- Cause:
- Attributes:
- Mechanism:
- Source Code:
- Data Value Kind:
- Data Type Kind:
- Consequence:
int instead of char )- NRS (Call)
- Cause:
- Attributes:
- Mechanism:
- Source Code:
- Entity:
- Data Type Kind:
- Consequence:
+(int*,int) instead of +(char*,int) ) - TCM (Calculate)
- Cause:
- Attributes:
- Mechanism:
- Source Code:
- Data Value Kind:
- Data Type Kind:
- Consequence:
- MAD (Reposition)
- Cause:
- Attributes:
- Mechanism:
- Source Code:
- Execution Space:
- Location:
- Consequence:
- MUS (Read)
- Cause:
- Attributes:
- Mechanism:
- Source Code:
- Execution Space:
- Span:
- Location:
- Consequence:
- The chain starts with an improper casting of the pointer
p to char * that leads to invocation of a wrong addition
operator *int + 16 instead of *char + 1. Therefore, the pointer moves 4 bytes instead of 1 byte (3 bytes off),
reading the wrong value, outside the object x (buffer overflow). Fig.11 presents the BF taxonomy for this weakness.
- To fix the bug, the programmer should first cast and then add:
int *p = x; char * second_char = (char *)p + 1;
Fig 3. First BF chain: Loose comparison misuse.
- TCM (Evaluate)
- Cause:
- Attributes:
- Mechanism:
- Source Code:
- Data Value Kind:
- Data Type Kind:
- Consequence:
Fig 4. Second BF chain: Conversion missing before loose comparison.
- TCV (Cast)
- Cause:
- Attributes:
- Mechanism:
- Source Code:
- Data Value Kind:
- Data Type Kind:
- Consequence:
‘_proto_’’] instead of string value - DVL (Validate)
- Cause:
‘_proto_’’] )- Attributes:
- Mechanism:
- Source Code:
- Execution Space:
- Data State:
- Consequence:
- The package set-value for JavaScript is vulnerable to prototype pollution in versions
<2.0.1, >=3.0.0, <4.0.1. It happens due to a type mismatch in the prototype pollution verification.
- This vulnerability has two possible BF chains. The first chain is: the loose comparison operator is misused. The
second chain is: a type conversion is missing before using the loose comparison, leading to improper input
validation and prototype pollution, a kind of command injection in JavaScript.
- There are two ways of fixing this vulnerability: the developers could use strict comparison, solving the TCM bug, or they could do a type conversion before the loose comparison. They chose the latter.