MP4box NULL Pointer Dereference Vulnerability Analysis in gf_filter_in_parent_chain

Vulnerability Overview Vulnerability Title: [security] filter_core/filter_pid.c:2145 SEGV in gf_filter_in_parent_chain #3285 Vulnerability Description: When processing files, the code fails to validate the parent filter pointer before accessing memory, resulting in a NULL pointer dereference when attempting to read from offset 0x8 (null+8), which triggers a segmentation fault. This vulnerability occurs during Packet ID chain verification, specifically in media import operations. Impact Scope Affected Component: Specific Location: Line 2145 Trigger Conditions: During file processing, specifically in media import operations when verifying the Packet ID chain. Remediation Remediation Status: Fixed Fix Commit: Fix Date: July 10, 2025 Fix Author: jeanlf POC Code Environment Information Operating System: Linux (x86_64 GNU/Linux) Compiler Version: Clang 19.1.7 Build Options: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" CPU Type: x86_64 MP4box Version: 2.5-DEV-rev1578-g6208015f-master Screenshots Screenshot 1: Shows details of the segmentation fault, including the stack trace and memory addresses. Screenshot 2: Displays additional stack trace information, further confirming the location and cause of the segmentation fault. Summary This vulnerability is caused by the failure to properly validate the parent filter pointer during file processing, leading to a NULL pointer dereference and resulting in a segmentation fault. The vulnerability has been fixed in commit on July 10, 2025.

Goal Reached Thanks to every supporter — we hit 100%!

MP4box NULL Pointer Dereference Vulnerability Analysis in gf_filter_in_parent_chain

More from this source