Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Null Pointer Dereference in gf_dump_vrml_dyn_field.isra() #1962

Closed
3 tasks done
AiDaiP opened this issue Dec 10, 2021 · 0 comments
Closed
3 tasks done

Null Pointer Dereference in gf_dump_vrml_dyn_field.isra() #1962

AiDaiP opened this issue Dec 10, 2021 · 0 comments

Comments

@AiDaiP
Copy link

AiDaiP commented Dec 10, 2021

Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/

A null pointer dereference was discovered in gf_dump_vrml_dyn_field.isra(). The vulnerability causes a segmentation fault and application crash.

Version:

MP4Box - GPAC version 1.1.0-DEV-revUNKNOWN_REV
(c) 2000-2021 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
        GPAC Filters: https://doi.org/10.1145/3339825.3394929
        GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration:
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_JPEG GPAC_HAS_PNG GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D

System information
Ubuntu 20.04 focal, AMD EPYC 7742 64-Core @ 16x 2.25GHz

command:

./MP4Box -lsr ./poc4

poc4.zip

Result

[iso file] extra box maxr found in hinf, deleting
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type 80rak in parent moov
[iso file] Incomplete box mdat - start 11495 size 860238
[iso file] Incomplete file while reading for dump - aborting parsing
[iso file] extra box maxr found in hinf, deleting
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type 80rak in parent moov
[iso file] Incomplete box mdat - start 11495 size 860238
[iso file] Incomplete file while reading for dump - aborting parsing
MPEG-4 BIFS Scene Parsing
Scene loaded - dumping 1 systems streams
[1]    414421 segmentation fault  ./MP4Box -lsr ./poc4

gdb

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7ac0797 in gf_dump_vrml_dyn_field.isra () from /root/fuckit/test/gpac-master/bin/gcc/libgpac.so.10
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
────────────────────────────────────────────[ REGISTERS ]─────────────────────────────────────────────
 RAX  0xa
 RBX  0x0
 RCX  0x0
 RDX  0x7ffff72bf040 ◂— 0x7ffff72bf040
 RDI  0x7fffffff6af0 —▸ 0x7ffff75a21e0 (funlockfile) ◂— endbr64
 RSI  0x0
 R8   0xffffffff
 R9   0xa
 R10  0x7ffff7e37a2a ◂— 0x3e73252f3c00223d /* '="' */
 R11  0x7ffff7df0c38 ◂— 0x6e776f6e6b6e75 /* 'unknown' */
 R12  0x0
 R13  0x0
 R14  0x5555555ded60 —▸ 0x5555555d43b0 ◂— 0x0
 R15  0x1
 RBP  0x3c
 RSP  0x7fffffff7060 ◂— 0x3000000010
 RIP  0x7ffff7ac0797 (gf_dump_vrml_dyn_field.isra+631) ◂— mov    eax, dword ptr [r12]
──────────────────────────────────────────────[ DISASM ]──────────────────────────────────────────────
 ► 0x7ffff7ac0797 <gf_dump_vrml_dyn_field.isra+631>    mov    eax, dword ptr [r12]
   0x7ffff7ac079b <gf_dump_vrml_dyn_field.isra+635>    test   eax, eax
   0x7ffff7ac079d <gf_dump_vrml_dyn_field.isra+637>    je     gf_dump_vrml_dyn_field.isra+720
       <gf_dump_vrml_dyn_field.isra+720>
    ↓
   0x7ffff7ac07f0 <gf_dump_vrml_dyn_field.isra+720>    mov    eax, dword ptr [rsp + 0x70]
   0x7ffff7ac07f4 <gf_dump_vrml_dyn_field.isra+724>    mov    rdi, qword ptr [r14 + 0x10]
   0x7ffff7ac07f8 <gf_dump_vrml_dyn_field.isra+728>    test   eax, eax
   0x7ffff7ac07fa <gf_dump_vrml_dyn_field.isra+730>    jne    gf_dump_vrml_dyn_field.isra+292
       <gf_dump_vrml_dyn_field.isra+292>
    ↓
   0x7ffff7ac0644 <gf_dump_vrml_dyn_field.isra+292>    lea    rsi, [rip + 0x35ac0b]
   0x7ffff7ac064b <gf_dump_vrml_dyn_field.isra+299>    xor    eax, eax
   0x7ffff7ac064d <gf_dump_vrml_dyn_field.isra+301>    call   gf_fprintf@plt                <gf_fprintf@plt>

   0x7ffff7ac0652 <gf_dump_vrml_dyn_field.isra+306>    jmp    gf_dump_vrml_dyn_field.isra+391
       <gf_dump_vrml_dyn_field.isra+391>
──────────────────────────────────────────────[ STACK ]───────────────────────────────────────────────
00:0000│ rsp 0x7fffffff7060 ◂— 0x3000000010
01:0008│     0x7fffffff7068 —▸ 0x5555555df880 ◂— 0x31646c6569665f /* '_field1' */
02:0010│     0x7fffffff7070 ◂— 0x0
03:0018│     0x7fffffff7078 ◂— 0x38b85a8f00
04:0020│     0x7fffffff7080 ◂— 0x0
05:0028│     0x7fffffff7088 ◂— 0x7aa5d2dbb85a8f00
06:0030│     0x7fffffff7090 ◂— 0x1
07:0038│     0x7fffffff7098 —▸ 0x7ffff7e27f46 ◂— 0x65646f6d73006325 /* '%c' */
────────────────────────────────────────────[ BACKTRACE ]─────────────────────────────────────────────
 ► f 0   0x7ffff7ac0797 gf_dump_vrml_dyn_field.isra+631
   f 1   0x7ffff7ac15d1 DumpProtos+305
   f 2   0x7ffff7abb389 gf_sm_dump_command_list+857
   f 3   0x7ffff7ac24fc gf_sm_dump+1116
   f 4   0x555555584418 dump_isom_scene+616
   f 5   0x55555557b42c mp4boxMain+9228
   f 6   0x7ffff75630b3 __libc_start_main+243
──────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> bt
#0  0x00007ffff7ac0797 in gf_dump_vrml_dyn_field.isra () from /root/fuckit/test/gpac-master/bin/gcc/libgpac.so.10
#1  0x00007ffff7ac15d1 in DumpProtos () from /root/fuckit/test/gpac-master/bin/gcc/libgpac.so.10
#2  0x00007ffff7abb389 in gf_sm_dump_command_list () from /root/fuckit/test/gpac-master/bin/gcc/libgpac.so.10
#3  0x00007ffff7ac24fc in gf_sm_dump () from /root/fuckit/test/gpac-master/bin/gcc/libgpac.so.10
#4  0x0000555555584418 in dump_isom_scene ()
#5  0x000055555557b42c in mp4boxMain ()
#6  0x00007ffff75630b3 in __libc_start_main (main=0x55555556c420 <main>, argc=3, argv=0x7fffffffe1a8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe198) at ../csu/libc-start.c:308
#7  0x000055555556c45e in _start ()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant