# [3DS][SSL][SDK] Unchecked number of audio channels in Mobiclip SDK leads to RCE in eShop movie player

Mobiclip SDK fails to validate audio channel count in moflex videos, miscalculating heap free space and enabling heap overflow to RCE in 3DS eShop movie player.

- Payout: hidden
- Severity: none
- Program: Nintendo
- Found by: mrnbayoh
- Disclosed: 2020-12-18
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/897606
- Library page: https://bugbountylibrary.com/r/h1%3A897606
- Tags: area:os domain:desktop impact:rce kind:bounty platform:hackerone tech:payment technique:chained technique:source-review vuln:memory-corruption

**Target:** Mobiclip SDK moflex video audio stream parser in eShop movie player
**Root cause:** GetNextAudioDataPtr computes already_played_bytes as already_played << nbChannels instead of already_played * 2 * nbChannels; with unchecked nbChannels > 2 this overestimates free space and bypasses the size check.
**Steps:**
1. Craft a moflex video with an audio stream declaring nbChannels > 2 (up to 256).
2. Set previous_data_length and nbChannels so already_played_bytes = 0x8XXXXXXX, making free_space appear large.
3. Deliver the video to the 3DS eShop movie player (via SSL flaw #894922 or eShop submission).
4. Player calls GetNextAudioDataPtr, returns a pointer past real free space, and copies audio data causing heap overflow.
5. Overflow corrupts heap to achieve usermode RCE under eShop.
**How found:** Code review of GetNextAudioDataPtr revealed the shift-based byte calculation only matches 2*nbChannels for 1-2 channels; noting nbChannels is attacker-controlled from video files led to testing larger values to bypass the free_space check.
**Exploitation:** Attacker supplies a malicious moflex video; combined with SSL flaw #894922 to inject it into eShop playback, the unchecked channel count causes heap overflow leading to usermode RCE with no visible behavior change to the user.
**Escalation:** Chained with SSL vulnerability #894922 to deliver the crafted video to any eShop user.
**Insight:** When a size/offset calculation uses a shift (x << n) as a stand-in for multiplication, check whether n is attacker-controlled and whether the identity only holds for small n; audio/video container channel counts are a classic unchecked multiplier.