CVE-2022-2549: NULL Pointer Dereference (CWE-476)
value: NULL Pointer Dereference in GitHub repository gpac/gpac prior to v2.1.0-DEV.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2022-07-27T15:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/scene_manager/scene_dump.c
Commit date: 2022-07-24 11:30:34 +0200
Commit message: fixed #2232

Diff: diff --git a/src/scene_manager/scene_dump.c b/src/scene_manager/scene_dump.c
index 6fe250f528d1..e9bb2e59d09f 100644
--- a/src/scene_manager/scene_dump.c
+++ b/src/scene_manager/scene_dump.c
@@ -783,11 +783,11 @@ static void gf_dump_vrml_simple_field(GF_SceneDumper *sdump, GF_FieldInfo field,
 		} else if (sf_type==GF_SG_VRML_SFSTRING) {
 			gf_fprintf(sdump->trace, " value=\'");
 		} else {
 			StartAttribute(sdump, "value");
 		}
-		for (i=0; i<mffield->count; i++) {
+		for (i=0; mffield && (i<mffield->count); i++) {
 			if (i) gf_fprintf(sdump->trace, " ");
 			gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
 			/*this is to cope with single MFString which shall appear as SF in XMT*/
 			gf_dump_vrml_sffield(sdump, sf_type, slot_ptr, 1, parent);
 		}
@@ -936,16 +936,14 @@ static void gf_dump_vrml_field(GF_SceneDumper *sdump, GF_Node *node, GF_FieldInf
 		} else {
 			StartAttribute(sdump, field.name);
 		}
 
 		if (!sdump->XMLDump) gf_fprintf(sdump->trace, "[");
-		if (mffield) {
-			for (i=0; i<mffield->count; i++) {
-				if (i) gf_fprintf(sdump->trace, " ");
-				gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
-				gf_dump_vrml_sffield(sdump, sf_type, slot_ptr, 1, node);
-			}
+		for (i=0; mffield && (i<mffield->count); i++) {
+			if (i) gf_fprintf(sdump->trace, " ");
+			gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
+			gf_dump_vrml_sffield(sdump, sf_type, slot_ptr, 1, node);
 		}
 		if (!sdump->XMLDump) gf_fprintf(sdump->trace, "]");
 
 		if (sdump->XMLDump && sdump->X3DDump) {
 			switch (sf_type) {
@@ -1148,11 +1146,11 @@ static void gf_dump_vrml_dyn_field(GF_SceneDumper *sdump, GF_Node *node, GF_Fiel
 						l = l->next;
 					}
 					sdump->indent--;
 					DUMP_IND(sdump);
 				} else {
-					for (i=0; i<mffield->count; i++) {
+					for (i=0; mffield && (i<mffield->count); i++) {
 						if (i) gf_fprintf(sdump->trace, " ");
 						if (field.fieldType != GF_SG_VRML_MFNODE) {
 							gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
 							gf_dump_vrml_sffield(sdump, sf_type, slot_ptr, (mffield->count>1) ? 1 : 0, node);
 						}
@@ -1189,11 +1187,11 @@ static void gf_dump_vrml_dyn_field(GF_SceneDumper *sdump, GF_Node *node, GF_Fiel
 					if (sdump->X3DDump) {
 						gf_fprintf(sdump->trace, " value=\"");
 					} else {
 						gf_fprintf(sdump->trace, " %s=\"", GetXMTFieldTypeValueName(field.fieldType));
 					}
-					for (i=0; i<mffield->count; i++) {
+					for (i=0; mffield && (i<mffield->count); i++) {
 						if (i) gf_fprintf(sdump->trace, " ");
 						if (field.fieldType != GF_SG_VRML_MFNODE) {
 							gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
 							gf_dump_vrml_sffield(sdump, sf_type, slot_ptr, (mffield->count>1) ? 1 : 0, node);
 						}
@@ -1260,17 +1258,15 @@ static void gf_dump_vrml_proto_field(GF_SceneDumper *sdump, GF_Node *node, GF_Fi
 				if (sdump->X3DDump) {
 					gf_fprintf(sdump->trace, " value=\"");
 				} else {
 					gf_fprintf(sdump->trace, " %s=\"", GetXMTFieldTypeValueName(field.fieldType));
 				}
-				if (mffield) {
-					for (i=0; i<mffield->count; i++) {
-						if (i) gf_fprintf(sdump->trace, " ");
-						if (field.fieldType != GF_SG_VRML_MFNODE) {
-							gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
-							gf_dump_vrml_sffield(sdump, sf_type, slot_ptr, (mffield->count>1) ? 1 : 0, node);
-						}
+				for (i=0; mffield && (i<mffield->count); i++) {
+					if (i) gf_fprintf(sdump->trace, " ");
+					if (field.fieldType != GF_SG_VRML_MFNODE) {
+						gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
+						gf_dump_vrml_sffield(sdump, sf_type, slot_ptr, (mffield->count>1) ? 1 : 0, node);
 					}
 				}
 				gf_fprintf(sdump->trace, "\"/>\n");
 			}
 		}

Vulnerable code: 		for (i=0; i<mffield->count; i++) {
		if (mffield) {
			for (i=0; i<mffield->count; i++) {
				if (i) gf_fprintf(sdump->trace, " ");
				gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
				gf_dump_vrml_sffield(sdump, sf_type, slot_ptr, 1, node);
			}
					for (i=0; i<mffield->count; i++) {
					for (i=0; i<mffield->count; i++) {
				if (mffield) {
					for (i=0; i<mffield->count; i++) {
						if (i) gf_fprintf(sdump->trace, " ");
						if (field.fieldType != GF_SG_VRML_MFNODE) {
							gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
							gf_dump_vrml_sffield(sdump, sf_type, slot_ptr, (mffield->count>1) ? 1 : 0, node);
						}
Fixed code: 		for (i=0; mffield && (i<mffield->count); i++) {
		for (i=0; mffield && (i<mffield->count); i++) {
			if (i) gf_fprintf(sdump->trace, " ");
			gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
			gf_dump_vrml_sffield(sdump, sf_type, slot_ptr, 1, node);
					for (i=0; mffield && (i<mffield->count); i++) {
					for (i=0; mffield && (i<mffield->count); i++) {
				for (i=0; mffield && (i<mffield->count); i++) {
					if (i) gf_fprintf(sdump->trace, " ");
					if (field.fieldType != GF_SG_VRML_MFNODE) {
						gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
						gf_dump_vrml_sffield(sdump, sf_type, slot_ptr, (mffield->count>1) ? 1 : 0, node);