NULL Pointer Dereference in function gf_filter_pck_new_alloc_internal at filter_core/filter_pck.c:108.
git log
commit 5692dc729491805e0e5f55c21d50ba1e6b19e88e (HEAD -> master, origin/master, origin/HEAD)
Author: Aurelien David <aurelien.david@telecom-paristech.fr>
Date: Wed Oct 11 13:24:46 2023 +0200
ac3dmx: add remain size check (fixes #2627)
./MP4Box -version
MP4Box - GPAC version 2.3-DEV-rev577-g5692dc729-master
(c) 2000-2023 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io
reported (no instrumented program)
./configure --enable-sanitizer
make
./bin/gcc/MP4Box -dash 1000 -out /dev/null poc2_nul
[Dasher] No template assigned, using $File$_dash$FS$$Number$
[PCMReframe] Missing audio sample rate, cannot parse
filter_core/filter_pck.c:108:6: runtime error: member access within null pointer of type 'struct GF_FilterPid'
Reported with ASAN (instrumented program):
./bin/gcc/MP4Box -dash 1000 -out /dev/null poc2_null
[Dasher] No template assigned, using $File$_dash$FS$$Number$
[PCMReframe] Missing audio sample rate, cannot parse
AddressSanitizer:DEADLYSIGNAL
=================================================================
==2015631==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f6dd4798891 bp 0x7ffee005d790 sp 0x7ffee005d6a0 T0)
==2015631==The signal is caused by a READ memory access.
==2015631==Hint: address points to the zero page.
#0 0x7f6dd4798891 in gf_filter_pck_new_alloc_internal (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0x119b891)
#1 0x7f6dd4d1ef00 in pcmreframe_process (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0x1721f00)
#2 0x7f6dd48571ce in gf_filter_process_task (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0x125a1ce)
#3 0x7f6dd4825216 in gf_fs_thread_proc (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0x1228216)
#4 0x7f6dd4823b0f in gf_fs_run (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0x1226b0f)
#5 0x7f6dd41c2047 in gf_dasher_process (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0xbc5047)
#6 0x50205c in do_dash /home/fuzz/gpac/gpac/applications/mp4box/mp4box.c:4831:15
#7 0x4f34ee in mp4box_main /home/fuzz/gpac/gpac/applications/mp4box/mp4box.c:6245:7
#8 0x7f6dd327e082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
#9 0x42ad4d in _start (/home/fuzz/gpac/gpac/bin/gcc/MP4Box+0x42ad4d)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0x119b891) in gf_filter_pck_new_alloc_internal
POC:
https://github.com/Janette88/test_pocs/blob/main/poc2_null