Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

NULL Pointer Dereference still exists in gf_isom_parse_movie_boxes_internal #2163

Closed
0xdd96 opened this issue Apr 1, 2022 · 1 comment
Closed

Comments

@0xdd96
Copy link

0xdd96 commented Apr 1, 2022

version info:

root@d8a714203f6e:# ./MP4Box -version
MP4Box - GPAC version 2.1-DEV-rev87-g053aae8-master
(c) 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
        GPAC Filters: https://doi.org/10.1145/3339825.3394929
        GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --prefix=/path_to_gpac/build --enable-debug --enable-sanitizer
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SSL GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_FAAD GPAC_HAS_MAD GPAC_HAS_LIBA52 GPAC_HAS_JPEG GPAC_HAS_PNG GPAC_HAS_FFMPEG GPAC_HAS_JP2 GPAC_HAS_THEORA GPAC_HAS_VORBIS GPAC_HAS_XVID GPAC_HAS_LINUX_DVB

poc:poc
command: MP4Box -hint -out /dev/null $poc$
crash:

root@d8a714203f6e:# ./MP4Box -hint -out /dev/null poc
[iso file] Read Box type 00000000 (0x00000000) at position 45 has size 0 but is not at root/file level. Forbidden, skipping end of parent box !
[iso file] Read Box "abst" (start 0) failed (Unknown Error (10)) - skipping
isomedia/isom_intern.c:392:12: runtime error: member access within null pointer of type 'struct GF_Box'

When size=0 and is_root_box=false, gf_isom_box_parse_ex will return GF_SKIP_BOX (i.e., 10) at line 138 of box_funcs.c.

https://github.com/gpac/gpac/blob/7f060bbb72966cae80d6fee338d0b07fa3fc06e1/src/isomedia/box_funcs.c#L129-L142

This will cause *outBox to be set to NULL (in box_funcs.c:312) and the return value GF_SKIP_BOX will be passed to the upper function ( in box_funcs.c:318).

https://github.com/gpac/gpac/blob/7f060bbb72966cae80d6fee338d0b07fa3fc06e1/src/isomedia/box_funcs.c#L310-L319

The program now executes the empty if block when e>=0( in isom_intern.c:375-377), and later dereferences the null pointer in line 392 of isom_intern.c.

https://github.com/gpac/gpac/blob/7f060bbb72966cae80d6fee338d0b07fa3fc06e1/src/isomedia/isom_intern.c#L373-L392

Note that although the crash path is the same as in issue #2155, their root cause is different.

@hmnthabit
Copy link

Thanks for reporting this

What's the problem of checking a strucut before the switch statement? @jeanlf

Also, it's better to test the poc against all the arguments that do file parsing.

@jeanlf jeanlf closed this as completed in 37592ad Apr 12, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants