Closed
Description
- I looked for a similar issue and couldn't find any.
- I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...).
Hi, there.
There is a segmentation fault caused by null pointer dereference in naludmx_create_avc_decoder_config, reframe_nalu.c:1297 in commit 592ba26.
Here is my environment, compiler info and gpac version:
Distributor ID: Ubuntu
Description: Ubuntu 16.04.6 LTS
Release: 16.04
Codename: xenial
gcc: 5.4.0
MP4Box - GPAC version 1.1.0-DEV-rev1170-g592ba26-master
(c) 2000-2021 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io
MINI build (encoders, decoders, audio and video output disabled)
Please cite our work in your research:
GPAC Filters: https://doi.org/10.1145/3339825.3394929
GPAC: https://doi.org/10.1145/1291233.1291452
GPAC Configuration: --static-bin --enable-debug
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_FREETYPE GPAC_HAS_JPEG GPAC_HAS_PNG GPAC_DISABLE_3D
To reproduce, run
./MP4Box -info poc
POC:
poc.zip
(unzip first)
Here is the trace reported by gdb:
Stopped reason: SIGSEGV
gef➤ bt
#0 0x0000000001430251 in naludmx_create_avc_decoder_config (ctx=ctx@entry=0x24ada70, dsi=dsi@entry=0x7fffffff4d28, dsi_size=dsi_size@entry=0x7fffffff4d20, dsi_enh=dsi_enh@entry=0x7fffffff4d30, dsi_enh_size=dsi_enh_size@entry=0x7fffffff4d24, max_width=max_width@entry=0x7fffffff4d10, max_height=0x7fffffff4d14, max_enh_width=0x7fffffff4d18, max_enh_height=0x7fffffff4d1c, sar=0x7fffffff4d38) at /mnt/data/playground/gpac/src/filters/reframe_nalu.c:1297
#1 0x00000000014334ab in naludmx_check_pid (filter=filter@entry=0x24a0bd0, ctx=ctx@entry=0x24ada70) at /mnt/data/playground/gpac/src/filters/reframe_nalu.c:1462
#2 0x0000000001441315 in naludmx_process (filter=0x24a0bd0) at /mnt/data/playground/gpac/src/filters/reframe_nalu.c:2895
#3 0x0000000000fe4c18 in gf_filter_process_task (task=0x2492ed0) at /mnt/data/playground/gpac/src/filter_core/filter.c:2441
#4 0x0000000000f7b909 in gf_fs_thread_proc (sess_thread=sess_thread@entry=0x248c2b0) at /mnt/data/playground/gpac/src/filter_core/filter_session.c:1640
#5 0x0000000000f93558 in gf_fs_run (fsess=fsess@entry=0x248c220) at /mnt/data/playground/gpac/src/filter_core/filter_session.c:1877
#6 0x0000000000c18b4b in gf_media_import (importer=importer@entry=0x7fffffff5bf0) at /mnt/data/playground/gpac/src/media_tools/media_import.c:1178
#7 0x0000000000497345 in convert_file_info (inName=0x7fffffffe159 "tmp", trackID=0x0) at /mnt/data/playground/gpac/applications/mp4box/fileimport.c:128
#8 0x0000000000456aaa in mp4boxMain (argc=<optimized out>, argv=<optimized out>) at /mnt/data/playground/gpac/applications/mp4box/main.c:5925
#9 0x0000000001f06bb6 in generic_start_main ()
#10 0x0000000001f071a5 in __libc_start_main ()
#11 0x000000000041c4e9 in _start ()
The reason for this bug is that the program does not check the nullity of the pointer.

Metadata
Metadata
Assignees
Labels
No labels