root@d8a714203f6e:# ./MP4Box -hint -out /dev/null poc
[iso file] Read Box type 00000000 (0x00000000) at position 45 has size 0 but is not at root/file level. Forbidden, skipping end of parent box !
[iso file] Read Box "abst" (start 0) failed (Unknown Error (10)) - skipping
isomedia/isom_intern.c:392:12: runtime error: member access within null pointer of type 'struct GF_Box'
When size=0 and is_root_box=false, gf_isom_box_parse_ex will return GF_SKIP_BOX (i.e., 10) at line 138 of box_funcs.c.
This will cause *outBox to be set to NULL (in box_funcs.c:312) and the return value GF_SKIP_BOX will be passed to the upper function ( in box_funcs.c:318).
The program now executes the empty if block when e>=0( in isom_intern.c:375-377), and later dereferences the null pointer in line 392 of isom_intern.c.
version info:
poc:poc$poc$
command: MP4Box -hint -out /dev/null
crash:
When
size=0andis_root_box=false,gf_isom_box_parse_exwill returnGF_SKIP_BOX(i.e., 10) at line 138 of box_funcs.c.https://github.com/gpac/gpac/blob/7f060bbb72966cae80d6fee338d0b07fa3fc06e1/src/isomedia/box_funcs.c#L129-L142
This will cause
*outBoxto be set to NULL (in box_funcs.c:312) and the return valueGF_SKIP_BOXwill be passed to the upper function ( in box_funcs.c:318).https://github.com/gpac/gpac/blob/7f060bbb72966cae80d6fee338d0b07fa3fc06e1/src/isomedia/box_funcs.c#L310-L319
The program now executes the empty if block when
e>=0( in isom_intern.c:375-377), and later dereferences the null pointer in line 392 of isom_intern.c.https://github.com/gpac/gpac/blob/7f060bbb72966cae80d6fee338d0b07fa3fc06e1/src/isomedia/isom_intern.c#L373-L392
Note that although the crash path is the same as in issue #2155, their root cause is different.
The text was updated successfully, but these errors were encountered: