Project: gpac (gpac/gpac), language: c++
Vulnerability instance: gpac.cve-2023-2839
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: Huntr
## URL: https://huntr.dev/bounties/42dce889-f63d-4ea9-970f-1f20fc573d5f
## Description:
Environment
Distributor ID: Debian
Description:    Debian GNU/Linux bookworm/sid
Release:    n/a
Codename:   bookworm
Version
I checked against the latest release as of 05/18/23 the current master branch at commit a6ae93532ea5615c876c81a6580badbfa01d4383 .
Description
This AddressSanitizer output is indicating that floating point exception occurred in the function dasher_mark_segment_start at line 7588 in the file dasher.c. This error is a divide by zero error ds->timescale is not properly checked and can be zero, leading to this FPE error.
//ds->timescale is zero here with the provided testcase
ds->last_min_segment_start_time /= ds->timescale;
POC
AFL_MAP_SIZE=260000 ./MP4Box -dash 1000 ./crash_file1
POC File
ASAN
[avc-h264] Unknown aspect_ratio_idc: your video may have a wrong aspect ratio. Contact the GPAC team!
[avc-h264] Unknown aspect_ratio_idc: your video may have a wrong aspect ratio. Contact the GPAC team!
[AVC|H264] Error parsing NAL unit type 7
[AVC|H264] Error parsing Sequence Param Set
[AVC|H264] Possible Variable Frame Rate: VUI "fixed_frame_rate_flag" absent
[avc-h264] Unknown aspect_ratio_idc: your video may have a wrong aspect ratio. Contact the GPAC team!
[avc-h264] Unknown aspect_ratio_idc: your video may have a wrong aspect ratio. Contact the GPAC team!
[avc-h264] Unknown aspect_ratio_idc: your video may have a wrong aspect ratio. Contact the GPAC team!
[avc-h264] Unknown aspect_ratio_idc: your video may have a wrong aspect ratio. Contact the GPAC team!
[avc-h264] Unknown aspect_ratio_idc: your video may have a wrong aspect ratio. Contact the GPAC team!
[avc-h264] Unknown aspect_ratio_idc: your video may have a wrong aspect ratio. Contact the GPAC team!
[avc-h264] Unknown aspect_ratio_idc: your video may have a wrong aspect ratio. Contact the GPAC team!
[avc-h264] Unknown aspect_ratio_idc: your video may have a wrong aspect ratio. Contact the GPAC team!
[avc-h264] Unknown aspect_ratio_idc: your video may have a wrong aspect ratio. Contact the GPAC team!
[avc-h264] Unknown aspect_ratio_idc: your video may have a wrong aspect ratio. Contact the GPAC team!
[avc-h264] Unknown aspect_ratio_idc: your video may have a wrong aspect ratio. Contact the GPAC team!
[avc-h264] Unknown aspect_ratio_idc: your video may have a wrong aspect ratio. Contact the GPAC team!
[avc-h264] Unknown aspect_ratio_idc: your video may have a wrong aspect ratio. Contact the GPAC team!
[avc-h264] SEI user message type 2035 size error (1658 but 16 remain), keeping full SEI untouched
[avc-h264] Unknown aspect_ratio_idc: your video may have a wrong aspect ratio. Contact the GPAC team!
[AVC|H264] Possible Variable Frame Rate: VUI "fixed_frame_rate_flag" absent
[AVC|H264] Possible Variable Frame Rate: VUI "fixed_frame_rate_flag" absent
[Dasher] No template assigned, using $File$_dash$FS$$Number$
[Dasher] No bitrate property assigned to PID crash_file1, computing from bitstream
[avc-h264] Unknown aspect_ratio_idc: your video may have a wrong aspect ratio. Contact the GPAC team!
[avc-h264] Unknown aspect_ratio_idc: your video may have a wrong aspect ratio. Contact the GPAC team!
[AVC|H264] Possible Variable Frame Rate: VUI "fixed_frame_rate_flag" absent
[AVC|H264] xPS changed but could not flush frames before signaling state change !
[AVC|H264] Possible Variable Frame Rate: VUI "fixed_frame_rate_flag" absent
[AVC|H264] xPS changed but could not flush frames before signaling state change !
[avc-h264] Unknown aspect_ratio_idc: your video may have a wrong aspect ratio. Contact the GPAC team!
[AVC|H264] Possible Variable Frame Rate: VUI "fixed_frame_rate_flag" absent
[AVC|H264] xPS changed but could not flush frames before signaling state change !
[AVC|H264] Possible Variable Frame Rate: VUI "fixed_frame_rate_flag" absent
[AVC|H264] xPS changed but could not flush frames before signaling state change !
[avc-h264] Unknown aspect_ratio_idc: your video may have a wrong aspect ratio. Contact the GPAC team!
[AVC|H264] Possible Variable Frame Rate: VUI "fixed_frame_rate_flag" absent
[AVC|H264] xPS changed but could not flush frames before signaling state change !
[AVC|H264] Possible Variable Frame Rate: VUI "fixed_frame_rate_flag" absent
[AVC|H264] xPS changed but could not flush frames before signaling state change !
[avc-h264] Unknown aspect_ratio_idc: your video may have a wrong aspect ratio. Contact the GPAC team!
[AVC|H264] Possible Variable Frame Rate: VUI "fixed_frame_rate_flag" absent
[AVC|H264] xPS changed but could not flush frames before signaling state change !
[avc-h264] Unknown aspect_ratio_idc: your video may have a wrong aspect ratio. Contact the GPAC team!
[AVC|H264] Possible Variable Frame Rate: VUI "fixed_frame_rate_flag" absent
[AVC|H264] xPS changed but could not flush frames before signaling state change !
[avc-h264] Unknown aspect_ratio_idc: your video may have a wrong aspect ratio. Contact the GPAC team!
[AVC|H264] Possible Variable Frame Rate: VUI "fixed_frame_rate_flag" absent
[AVC|H264] xPS changed but could not flush frames before signaling state change !
[AVC|H264] Possible Variable Frame Rate: VUI "fixed_frame_rate_flag" absent
[AVC|H264] xPS changed but could not flush frames before signaling state change !
[avc-h264] Unknown aspect_ratio_idc: your video may have a wrong aspect ratio. Contact the GPAC team!
[AVC|H264] Possible Variable Frame Rate: VUI "fixed_frame_rate_flag" absent
[AVC|H264] xPS changed but could not flush frames before signaling state change !
[AVC|H264] Possible Variable Frame Rate: VUI "fixed_frame_rate_flag" absent
[AVC|H264] xPS changed but could not flush frames before signaling state change !
[avc-h264] Unknown aspect_ratio_idc: your video may have a wrong aspect ratio. Contact the GPAC team!
[AVC|H264] Possible Variable Frame Rate: VUI "fixed_frame_rate_flag" absent
[AVC|H264] xPS changed but could not flush frames before signaling state change !
[avc-h264] Unknown aspect_ratio_idc: your video may have a wrong aspect ratio. Contact the GPAC team!
[AVC|H264] Possible Variable Frame Rate: VUI "fixed_frame_rate_flag" absent
[AVC|H264] xPS changed but could not flush frames before signaling state change !
[AVC|H264] Possible Variable Frame Rate: VUI "fixed_frame_rate_flag" absent
[AVC|H264] xPS changed but could not flush frames before signaling state change !
[avc-h264] Unknown aspect_ratio_idc: your video may have a wrong aspect ratio. Contact the GPAC team!
[AVC|H264] Possible Variable Frame Rate: VUI "fixed_frame_rate_flag" absent
[AVC|H264] xPS changed but could not flush frames before signaling state change !
[AVC|H264] Possible Variable Frame Rate: VUI "fixed_frame_rate_flag" absent
[AVC|H264] xPS changed but could not flush frames before signaling state change !
[AVC|H264] Incomplete last NAL and eos, discarding
[Dasher] No bitrate property assigned to PID crash_file1, computing from bitstream
[avc-h264] Unknown aspect_ratio_idc: your video may have a wrong aspect ratio. Contact the GPAC team!
[MP4Mux] No timescale specified, guessing from media: 892678964
AddressSanitizer:DEADLYSIGNAL
=================================================================
==2982015==ERROR: AddressSanitizer: FPE on unknown address 0x7ffff6e0e1ab (pc 0x7ffff6e0e1ab bp 0x7fffffff5bb0 sp 0x7fffffff26e0 T0)
    #0 0x7ffff6e0e1ab in dasher_mark_segment_start /path/to/gpac/src/filters/dasher.c:7588:34
    #1 0x7ffff6dd2223 in dasher_process /path/to/gpac/src/filters/dasher.c:9266:5
    #2 0x7ffff6d74d05 in gf_filter_process_task /path/to/gpac/src/filter_core/filter.c:2894:7
    #3 0x7ffff6d4153c in gf_fs_thread_proc /path/to/gpac/src/filter_core/filter_session.c:1962:3
    #4 0x7ffff6d3fd2f in gf_fs_run /path/to/gpac/src/filter_core/filter_session.c:2264:3
    #5 0x7ffff660245a in gf_dasher_process /path/to/gpac/src/media_tools/dash_segmenter.c:1236:6
    #6 0x5555556c15fc in do_dash /path/to/gpac/applications/mp4box/mp4box.c:4825:15
    #7 0x5555556b2a8e in mp4box_main /path/to/gpac/applications/mp4box/mp4box.c:6236:7
    #8 0x7ffff5846189 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #9 0x7ffff5846244 in __libc_start_main csu/../csu/libc-start.c:381:3
    #10 0x5555555dad30 in _start (/path/to/gpac/new_pull_2_build/bin/gcc/MP4Box+0x86d30) (BuildId: 764c86f2d59b4db3d4590a720eca33bd143620a7)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE /path/to/gpac/src/filters/dasher.c:7588:34 in dasher_mark_segment_start
==2982015==ABORTING
Impact
divide by zero can cause a crash which will affect the system availability or availability of the application.

Relevant Links:
https://github.com/gpac/gpac
https://drive.google.com/file/d/1yA4QV_zhDq0nv_OB7_b2yfBegbnGL4Vq

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./configure --static-build --extra-cflags="${CFLAGS}" --extra-ldflags="${CFLAGS}"
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y build-essential pkg-config libz-dev
RUN git clone https://github.com/gpac/gpac gpac
RUN git -C gpac checkout c88df2e202efad214c25b4e586f243b2038779ba
WORKDIR $SRC/gpac
COPY build.sh $SRC/

Additional files: