Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Untrusted pointer dereference in gf_node_unregister () at scenegraph/base_scenegraph.c:710 #2033

Closed
3 tasks done
ZFeiXQ opened this issue Jan 5, 2022 · 0 comments
Closed
3 tasks done

Comments

@ZFeiXQ
Copy link

ZFeiXQ commented Jan 5, 2022

Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/

Version:

./MP4Box -version

MP4Box - GPAC version 1.1.0-DEV-rev1593-g786b21cdb-master
(c) 2000-2021 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io
	MINI build (encoders, decoders, audio and video output disabled)

Please cite our work in your research:
	GPAC Filters: https://doi.org/10.1145/3339825.3394929
	GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --static-mp4box --enable-debug --prefix=/home/zxq/CVE_testing/source/gpac/cmakebuild
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_FREETYPE GPAC_HAS_JPEG GPAC_HAS_PNG  GPAC_DISABLE_3D 

command:

./bin/gcc/MP4Box -svg POC2

POC2.zip

POC2.zip

Result

Segmentation fault.

bt

Program received signal SIGSEGV, Segmentation fault.
0x0000000000479ab6 in gf_node_unregister (pNode=0x10fc910, parentNode=0x0) at scenegraph/base_scenegraph.c:710
710		if (pSG && (pNode == (GF_Node*)pSG->pOwningProto)) pSG = pSG->parent_scene;
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
──────────────────────────────────────────────────────────────────────────────────────────────────[ REGISTERS ]───────────────────────────────────────────────────────────────────────────────────────────────────
 RAX  0x21
 RBX  0x10ee520 ◂— 0x0
 RCX  0x10fc910 —▸ 0x10fc9c0 ◂— 0x0
 RDX  0x0
 RDI  0x10fc910 —▸ 0x10fc9c0 ◂— 0x0
 RSI  0x0
 R8   0x4
 R9   0x0
 R10  0x10cdfa0 (main_arena+96) —▸ 0x10fcab0 ◂— 0x0
 R11  0x10cdfa0 (main_arena+96) —▸ 0x10fcab0 ◂— 0x0
 R12  0xd0bad0 (__libc_csu_fini) ◂— endbr64 
 R13  0x0
 R14  0x10a8018 (_GLOBAL_OFFSET_TABLE_+24) —▸ 0xd825d0 (__memmove_avx_unaligned_erms) ◂— endbr64 
 R15  0x0
 RBP  0x7fffffff7ff0 —▸ 0x7fffffff8030 —▸ 0x7fffffff80d0 —▸ 0x7fffffff80f0 —▸ 0x7fffffff8130 ◂— ...
 RSP  0x7fffffff7fb0 ◂— 0x0
 RIP  0x479ab6 (gf_node_unregister+295) ◂— mov    rax, qword ptr [rax + 0xf0]
────────────────────────────────────────────────────────────────────────────────────────────────────[ DISASM ]────────────────────────────────────────────────────────────────────────────────────────────────────
 ► 0x479ab6 <gf_node_unregister+295>    mov    rax, qword ptr [rax + 0xf0]
   0x479abd <gf_node_unregister+302>    cmp    qword ptr [rbp - 0x38], rax
   0x479ac1 <gf_node_unregister+306>    jne    gf_node_unregister+320                      <gf_node_unregister+320>
    ↓
   0x479acf <gf_node_unregister+320>    mov    rax, qword ptr [rbp - 0x38]
   0x479ad3 <gf_node_unregister+324>    mov    rax, qword ptr [rax]
   0x479ad6 <gf_node_unregister+327>    movzx  eax, word ptr [rax + 2]
   0x479ada <gf_node_unregister+331>    test   ax, ax
   0x479add <gf_node_unregister+334>    jne    gf_node_unregister+367                      <gf_node_unregister+367>
    ↓
   0x479afe <gf_node_unregister+367>    mov    rax, qword ptr [rbp - 0x38]
   0x479b02 <gf_node_unregister+371>    mov    rax, qword ptr [rax]
   0x479b05 <gf_node_unregister+374>    movzx  edx, word ptr [rax + 2]

@jeanlf jeanlf closed this as completed in 3cc122a Jan 5, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant