GPAC MP4Box DEF Parser Heap Use-After-Free (CWE-416)

GPAC MP4Box Heap Use-After-Free Vulnerability Summary Vulnerability Overview Vulnerability Name: Heap Use-After-Free (Heap Use-After-Free) vulnerability in the function during the DEF parsing process in GPAC MP4Box. Severity: HIGH CWE: CWE-416 - Use After Free OWASP: N/A - Native File Parsing Memory Corruption Root Cause: When fails to parse a malformed node, the error path unregisters and frees the partially constructed node, but the pointer remains in the list. Subsequently, when traversing the list during DEFUSE parsing and calling , a heap use-after-free occurs. Scope of Impact Affected Files: - ( ) - ( ) - (path triggered by ) Impact: Crafted BT scenes leave dangling entries in the parser's DEF-node table, causing to crash during name resolution, resulting in a Denial of Service when processing untrusted scenes in the media import workflow. Because the dangling pointer references attacker-controllable heap data, it may trigger more severe memory corruption in certain environments. Remediation Fix Commit: Fix Method: The upstream fix removes the invalid node from the DEF-node registry before unregistration, ensuring the DEF-node registry entries remain consistent with the node lifecycle, thereby avoiding dangling pointers. Regression Testing Recommendations: Tests should include malformed DEFUSE and PROTO inputs that trigger the parser's error cleanup, along with additional name lookups. POC / Reproduction Code Reproduction Steps Expected Output (AddressSanitizer Report) Fix Patch (Key Code) Reference Links GPAC issue #3803: Fix Commit: Related earlier issue #3642: Vulnerable Commit: GPAC Repository: Reproduction Materials: Notes The original report indicates that this behavior may represent an incomplete fix for issue #3642; issue #3803 was directly closed by commit .

Goal Reached Thanks to every supporter — we hit 100%!

GPAC MP4Box DEF Parser Heap Use-After-Free (CWE-416)

More from this source