CVE-2024-7347: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might...

The vulnerability lies in the ngx_http_mp4_module.c file, specifically within the ngx_http_mp4_crop_stsc_data function. The provided patch clearly shows modifications to this function to prevent an integer overflow. The change in the data type of the variable n from uint32_t to uint64_t and the explicit cast during multiplication (uint64_t) (next_chunk - chunk) * samples are direct evidence of fixing an integer overflow vulnerability. This overflow could lead to an incorrect calculation of sample counts or offsets, resulting in an out-of-bounds read when processing a malicious MP4 file, as described in the vulnerability report. The function processes MP4 file metadata ('stsc' atom, which stands for Sample-To-Chunk), and an error here could lead to reading beyond allocated buffer boundaries.