GPAC MP4Box: NULL pointer dereference (SEGV) in gf_bt_report via malformed BIFS

Vulnerability Overview Title: SEGV (NULL pointer dereference) in when parsing malformed BT/BIFS scenarios Root Cause: ( ), upon receiving an error message from , fails to validate the state before calling , leading to a NULL pointer dereference. Trigger Condition: Feeding a malformed BIFS command stream into GPAC. Impact Scope Affected Versions: - (master, 2020-07-25) - - Reproduction Command: Key Information from Error Log: ``` AddressSanitizer: SEGV (DEADLYSIGNAL) ==61724==ERROR: AddressSanitizer: SEGV on unknown fault (pc: 0x7f5465447428 sp: 0x7ff585480088 bp: 0x7ff585480018) ==61724==The signal is caused by a READ memory access. #0 0x7f5465480088 in __sanitizer::internal::x86_signal_handler(char const*, ...) #1 0x7f5465480088 in __sanitizer::internal::x86_signal_handler(...) #2 0x7f5465480088 in __interceptor_vsnprintf(...) #3 0x7f5465480088 in gf_bt_report (loader.c:126) #4 0x7f5465480088 in gf_bt_parse_bifs (loader.c:264) #5 0x7f5465480088 in gf_bt_parse_bifs (loader.c:1569) #6 0x7f5465480088 in gf_bt_parse_bifs (loader.c:1576) #7 0x7f5465480088 in gf_bt_parse_bifs (loader.c:1584) #8 0x7f5465480088 in gf_bt_parse_bifs (loader.c:3543) #9 0x7f5465480088 in gf_sm_load_bt (loader.c:3703) #10 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #11 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #12 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #13 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #14 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #15 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #16 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #17 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #18 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #19 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #20 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #21 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #22 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #23 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #24 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #25 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #26 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #27 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #28 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #29 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #30 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #31 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #32 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #33 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #34 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #35 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #36 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #37 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #38 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #39 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #40 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #41 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #42 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #43 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #44 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #45 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #46 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #47 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #48 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #49 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #50 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #51 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #52 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #53 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #54 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #55 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #56 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #57 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #58 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #59 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #60 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #61 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #62 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #63 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #64 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #65 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #66 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #67 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #68 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #69 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #70 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #71 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #72 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #73 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #74 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #75 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #76 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #77 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #78 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #79 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #80 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #81 0x7f5465480088 in gf_sm_load_bt (loader.c:3839) #82 0x7f5465480088 in gf_sm_load_bt (loader.c:3

Goal Reached Thanks to every supporter — we hit 100%!

GPAC MP4Box: NULL pointer dereference (SEGV) in gf_bt_report via malformed BIFS

More from this source