Project: gpac (gpac/gpac), language: c++
Vulnerability instance: gpac.cve-2020-22352
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/gpac/gpac/issues/1423
## Description:
Issue: gpac/gpac#1423
Title: AddressSanitizer: NULL pointer dereference in media_tools/dash_segmenter.c:5264 in gf_dash_segmenter_probe_input
State: closed
Created by: dr3dd589
Created at: 2020-03-01 19:19:26+00:00

Issue Body:
Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [x] I looked for a similar issue and couldn't find any.
- [x] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [x] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/

System info:
Ubuntu 18.04.6 LTS, X64, gcc version 7.4.0, gpac (latest master 4a7a63)

Compile Command:

```asm
$ CC="gcc -fsanitize=address -g" CXX="g++ -fsanitize=address -g" ./configure --static-mp4box
$ make
```
Run Command:

```asm
./MP4Box -dash 1000 crash_3
```

ASAN info:

```asm
=================================================================
==13768==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000004 (pc 0x562656a3daf0 bp 0x000000000001 sp 0x7ffee325fef0 T0)
==13768==The signal is caused by a READ memory access.
==13768==Hint: address points to the zero page.
    #0 0x562656a3daef in gf_dash_segmenter_probe_input media_tools/dash_segmenter.c:5264
    #1 0x562656a6350a in gf_dasher_add_input media_tools/dash_segmenter.c:6669
    #2 0x56265663ea6f in mp4boxMain /home/dr3dd/fuzzing/gpac/applications/mp4box/main.c:4704
    #3 0x7fab411e9b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #4 0x56265662d7a9 in _start (/home/dr3dd/fuzzing/gpac/bin/gcc/MP4Box+0x1657a9)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV media_tools/dash_segmenter.c:5264 in gf_dash_segmenter_probe_input
==13768==ABORTING
```
gdb info:

```asm
(gdb) r -dash 1000 ~/gpac_poc/crash_3
Starting program: /home/dr3dd/fuzzing/gpac/bin/gcc/MP4Box -dash 1000 ~/gpac_poc/crash_2
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0x0000555555bf408c in gf_dash_segmenter_probe_input (io_dash_inputs=io_dash_inputs@entry=0x5555562c4978, 
    nb_dash_inputs=nb_dash_inputs@entry=0x5555562c4980, idx=idx@entry=0) at media_tools/dash_segmenter.c:5264
5264					if (esd && (esd->decoderConfig->objectTypeIndication == GPAC_OTI_VIDEO_HEVC || esd->decoderConfig->objectTypeIndication == GPAC_OTI_VIDEO_LHVC)) {
(gdb) bt
#0  0x0000555555bf408c in gf_dash_segmenter_probe_input (io_dash_inputs=io_dash_inputs@entry=0x5555562c4978, 
    nb_dash_inputs=nb_dash_inputs@entry=0x5555562c4980, idx=idx@entry=0) at media_tools/dash_segmenter.c:5264
#1  0x0000555555c2dabb in gf_dasher_add_input (dasher=0x5555562c4970, input=<optimized out>)
    at media_tools/dash_segmenter.c:6669
#2  0x00005555555c88f5 in mp4boxMain (argc=<optimized out>, argv=<optimized out>) at main.c:4704
#3  0x00007ffff722bb97 in __libc_start_main () from /lib/x86_64-linux-gnu/libc.so.6
#4  0x00005555555a3e0a in _start () at main.c:5985
(gdb)
```
Here is crash file:
[crash_3.zip](https://github.com/gpac/gpac/files/4272293/crash_3.zip)

Thanks
dr3dd


Comments:
Comment by jeanlf on 2020-06-11 17:19:32+00:00:
fixed, thanks for the report

Attachments:
https://github.com/gpac/gpac/files/4272293/crash_3.zip

Commit References:
eec9e058a9486fe4e99c33021481d9e1826ca9db

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./configure --static-build --extra-cflags="${CFLAGS}" --extra-ldflags="${CFLAGS}"
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y build-essential pkg-config libz-dev
RUN git clone https://github.com/gpac/gpac gpac
RUN git -C gpac checkout 6b4ab401297be43b57f9eddd675971a8a5feab44
WORKDIR $SRC/gpac
COPY build.sh $SRC/

Additional files:
filename: fuzz_parse.c
content: /* Copyright 2021 Google LLC
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
      http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#include <stdio.h>
#include <unistd.h>

#include <gpac/internal/isomedia_dev.h>
#include <gpac/constants.h>

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
    char filename[256];
    sprintf(filename, "/tmp/libfuzzer.%d", getpid());

    FILE *fp = fopen(filename, "wb");
    if (!fp) {
        return 0;
    }
    fwrite(data, size, 1, fp);
    fclose(fp);

    GF_ISOFile *movie = NULL;
    movie = gf_isom_open_file(filename, GF_ISOM_OPEN_READ_DUMP, NULL);
    if (movie != NULL) {
        gf_isom_close(movie);
    }
    unlink(filename);
    return 0;
}