GPAC MP4Box 畸形BIFS导致gf_bt_report空指针解引用SEGV

漏洞概述 标题：解析畸形 BT/BIFS 场景时 中发生 SEGV（NULL 指针解引用） 根因： （ ）在收到来自 的错误消息后，未校验状态即调用 ，导致对 NULL 指针解引用。 触发条件：向 GPAC 输入一个畸形 BIFS 命令流。 影响范围 受影响版本： - （master，2020-07-25） - - 复现命令： 错误日志关键信息： ``` AddressSanitizer: SEGV (DEADLYSIGNAL) ==61724==ERROR: AddressSanitizer: SEGV on unknown fault (pc: 0x7f5465447428 sp: 0x7ff585480088 bp: 0x7ff585480018) ==61724==The signal is caused by a READ memory access. #0 0x7f5465480088 in __sanitizer::internal::x86_signal_handler(char const*, ...) #1 0x7f5465480088 in __sanitizer::internal::x86_signal_handler(...) #2 0x7f5465480088 in __interceptor_vsnprintf(...) #3 0x7f5465480088 in gf_bt_report (loader.c:126) #4 0x7f5465480088 in gf_bt_parse_bifs (loader.c:264) #5 0x7f5465480088 in gf_bt_parse_bifs (loader.c:1569) #6 0x7f5465480088 in gf_bt_parse_bifs (loader.c:1576) #7 0x7f5465480088 in gf_bt_parse_bifs (loader.c:1584) #8 0x7f5465480088 in gf_bt_parse_bifs (loader.c:3543) #9 0x7f5465480088 in gf_sm_load_bt (loader.c:3703) #10 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #11 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #12 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #13 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #14 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #15 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #16 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #17 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #18 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #19 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #20 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #21 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #22 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #23 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #24 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #25 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #26 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #27 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #28 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #29 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #30 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #31 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #32 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #33 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #34 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #35 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #36 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #37 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #38 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #39 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #40 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #41 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #42 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #43 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #44 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #45 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #46 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #47 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #48 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #49 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #50 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #51 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #52 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #53 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #54 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #55 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #56 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #57 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #58 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #59 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #60 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #61 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #62 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #63 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #64 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #65 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #66 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #67 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #68 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #69 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #70 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #71 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #72 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #73 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #74 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #75 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #76 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #77 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #78 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #79 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #80 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #81 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #82 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #83 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #84 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #85 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #86 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #87 0x7f5465480088 in gf_sm_load_bt (load

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

GPAC MP4Box 畸形BIFS导致gf_bt_report空指针解引用SEGV

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

GPAC MP4Box 畸形BIFS导致gf_bt_report空指针解引用SEGV

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！