Project: gpac (gpac/gpac), language: c++
Vulnerability instance: gpac.cve-2020-11558
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/gpac/gpac/issues/1440
## Description:
Issue: gpac/gpac#1440
Title: 3 UAF bugs in box_funcs.c
State: closed
Created by: strongcourage
Created at: 2020-03-24 17:16:05+00:00

Issue Body:
Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [x] I looked for a similar issue and couldn't find any.
- [x] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [x] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/

Hi GPAC Team,

I found 3 new UAF bugs on the lastest commit 56eaea8 of GPAC version 0.8.0.

I think it is probably due to **an imcomplete fix** of the UAF bug https://github.com/gpac/gpac/issues/1340. Actually, these new bugs share the same buggy function which is `gf_isom_box_del()` in src/isomedia/box_funcs.c with https://github.com/gpac/gpac/issues/1340, but have different alloc function `esds_New()` in `src/isomedia/box_code_base.c` (instead of `stco_New()`).

Command: `MP4Box -info $POC` or `MP4Box -diso $POC`

#### 1) UAF Bug 1
PoC: https://github.com/strongcourage/PoCs/blob/master/gpac_56eaea8/uaf1

ASAN says:
~~~
=================================================================
==31565==ERROR: AddressSanitizer: heap-use-after-free on address 0x60400000dde8 at pc 0x0000006c601e bp 0x7fff726c3b70 sp 0x7fff726c3b60
READ of size 8 at 0x60400000dde8 thread T0
    #0 0x6c601d in gf_isom_box_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1504
    #1 0x6c5f5e in gf_isom_box_array_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:272
    #2 0x6c5f5e in gf_isom_box_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1520
    #3 0x6c5f5e in gf_isom_box_array_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:272
    #4 0x6c5f5e in gf_isom_box_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1520
    #5 0x6c5f5e in gf_isom_box_array_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:272
    #6 0x6c5f5e in gf_isom_box_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1520
    #7 0x6c5f5e in gf_isom_box_array_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:272
    #8 0x6c5f5e in gf_isom_box_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1520
    #9 0x6c72cd in gf_isom_box_array_read_ex /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1427
    #10 0xae0b0f in mdia_Read /home/dungnguyen/fuzz/gpac/src/isomedia/box_code_base.c:3021
    #11 0x6c6456 in gf_isom_box_read /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1532
    #12 0x6c6456 in gf_isom_box_parse_ex /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:210
    #13 0x6c6e02 in gf_isom_box_array_read_ex /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1425
    #14 0xaeffe8 in trak_Read /home/dungnguyen/fuzz/gpac/src/isomedia/box_code_base.c:7188
    #15 0x6c6456 in gf_isom_box_read /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1532
    #16 0x6c6456 in gf_isom_box_parse_ex /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:210
    #17 0x6c6e02 in gf_isom_box_array_read_ex /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1425
    #18 0xae3444 in moov_Read /home/dungnguyen/fuzz/gpac/src/isomedia/box_code_base.c:3749
    #19 0x6c7764 in gf_isom_box_read /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1532
    #20 0x6c7764 in gf_isom_box_parse_ex /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:210
    #21 0x6c7fb4 in gf_isom_parse_root_box /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:42
    #22 0x6dd940 in gf_isom_parse_movie_boxes /home/dungnguyen/fuzz/gpac/src/isomedia/isom_intern.c:207
    #23 0x6e05d3 in gf_isom_parse_movie_boxes /home/dungnguyen/fuzz/gpac/src/isomedia/isom_intern.c:195
    #24 0x6e05d3 in gf_isom_open_file /home/dungnguyen/fuzz/gpac/src/isomedia/isom_intern.c:616
    #25 0x43375d in mp4boxMain /home/dungnguyen/fuzz/gpac/applications/mp4box/main.c:4814
    #26 0x7fca8b87382f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #27 0x41e4f8 in _start (/home/dungnguyen/PoCs/gpac_new/MP4Box+0x41e4f8)

0x60400000dde8 is located 24 bytes inside of 48-byte region [0x60400000ddd0,0x60400000de00)
freed by thread T0 here:
    #0 0x7fca8c61732a in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9832a)
    #1 0x6c5f9f in gf_isom_box_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1512

previously allocated by thread T0 here:
    #0 0x7fca8c617662 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98662)
    #1 0xadb68d in esds_New /home/dungnguyen/fuzz/gpac/src/isomedia/box_code_base.c:1287

SUMMARY: AddressSanitizer: heap-use-after-free /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1504 gf_isom_box_del
~~~



Comments:
Comment by strongcourage on 2020-03-24 17:17:24+00:00:
#### 2) UAF Bug 2
PoC: https://github.com/strongcourage/PoCs/blob/master/gpac_56eaea8/uaf2

ASAN says:
~~~
=================================================================
==13425==ERROR: AddressSanitizer: heap-use-after-free on address 0x60400000dde8 at pc 0x0000006c601e bp 0x7ffec486f2b0 sp 0x7ffec486f2a0
READ of size 8 at 0x60400000dde8 thread T0
    #0 0x6c601d in gf_isom_box_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1504
    #1 0x6c5f5e in gf_isom_box_array_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:272
    #2 0x6c5f5e in gf_isom_box_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1520
    #3 0x6c5f5e in gf_isom_box_array_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:272
    #4 0x6c5f5e in gf_isom_box_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1520
    #5 0x6c5f5e in gf_isom_box_array_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:272
    #6 0x6c5f5e in gf_isom_box_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1520
    #7 0x6c5f5e in gf_isom_box_array_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:272
    #8 0x6c5f5e in gf_isom_box_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1520
    #9 0x6c5f5e in gf_isom_box_array_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:272
    #10 0x6c5f5e in gf_isom_box_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1520
    #11 0x6c5f5e in gf_isom_box_array_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:272
    #12 0x6c5f5e in gf_isom_box_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1520
    #13 0x6c5f5e in gf_isom_box_array_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:272
    #14 0x6c5f5e in gf_isom_box_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1520
    #15 0x6c6066 in gf_isom_box_array_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:272
    #16 0x6e00f8 in gf_isom_delete_movie /home/dungnguyen/fuzz/gpac/src/isomedia/isom_intern.c:658
    #17 0x42f981 in mp4boxMain /home/dungnguyen/fuzz/gpac/applications/mp4box/main.c:5819
    #18 0x7f460342e82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #19 0x41e4f8 in _start (/home/dungnguyen/PoCs/gpac_56eaea8/MP4Box+0x41e4f8)

0x60400000dde8 is located 24 bytes inside of 48-byte region [0x60400000ddd0,0x60400000de00)
freed by thread T0 here:
    #0 0x7f46041d232a in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9832a)
    #1 0x6c5f9f in gf_isom_box_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1512

previously allocated by thread T0 here:
    #0 0x7f46041d2662 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98662)
    #1 0xadb68d in esds_New /home/dungnguyen/fuzz/gpac/src/isomedia/box_code_base.c:1287

SUMMARY: AddressSanitizer: heap-use-after-free /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1504 gf_isom_box_del
~~~

---

Comment by strongcourage on 2020-03-24 17:18:44+00:00:
#### 3) UAF Bug 3
PoC: https://github.com/strongcourage/PoCs/blob/master/gpac_56eaea8/uaf3

ASAN says:
~~~
=================================================================
==27915==ERROR: AddressSanitizer: heap-use-after-free on address 0x60400000dda8 at pc 0x0000006c601e bp 0x7fffc791a180 sp 0x7fffc791a170
READ of size 8 at 0x60400000dda8 thread T0
    #0 0x6c601d in gf_isom_box_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1504
    #1 0x6c5f5e in gf_isom_box_array_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:272
    #2 0x6c5f5e in gf_isom_box_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1520
    #3 0x6c5f5e in gf_isom_box_array_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:272
    #4 0x6c5f5e in gf_isom_box_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1520
    #5 0x6c5f5e in gf_isom_box_array_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:272
    #6 0x6c5f5e in gf_isom_box_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1520
    #7 0x6c5f5e in gf_isom_box_array_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:272
    #8 0x6c5f5e in gf_isom_box_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1520
    #9 0x6c5f5e in gf_isom_box_array_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:272
    #10 0x6c5f5e in gf_isom_box_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1520
    #11 0x6c5f5e in gf_isom_box_array_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:272
    #12 0x6c5f5e in gf_isom_box_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1520
    #13 0x6c5f5e in gf_isom_box_array_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:272
    #14 0x6c5f5e in gf_isom_box_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1520
    #15 0x6c77ae in gf_isom_box_parse_ex /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:221
    #16 0x6c7fb4 in gf_isom_parse_root_box /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:42
    #17 0x6dd940 in gf_isom_parse_movie_boxes /home/dungnguyen/fuzz/gpac/src/isomedia/isom_intern.c:207
    #18 0x6e05d3 in gf_isom_parse_movie_boxes /home/dungnguyen/fuzz/gpac/src/isomedia/isom_intern.c:195
    #19 0x6e05d3 in gf_isom_open_file /home/dungnguyen/fuzz/gpac/src/isomedia/isom_intern.c:616
    #20 0x43375d in mp4boxMain /home/dungnguyen/fuzz/gpac/applications/mp4box/main.c:4814
    #21 0x7efe8551f82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #22 0x41e4f8 in _start (/home/dungnguyen/PoCs/gpac_56eaea8/MP4Box+0x41e4f8)

0x60400000dda8 is located 24 bytes inside of 48-byte region [0x60400000dd90,0x60400000ddc0)
freed by thread T0 here:
    #0 0x7efe862c332a in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9832a)
    #1 0x6c5f9f in gf_isom_box_del /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1512

previously allocated by thread T0 here:
    #0 0x7efe862c3662 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98662)
    #1 0xadb68d in esds_New /home/dungnguyen/fuzz/gpac/src/isomedia/box_code_base.c:1287

SUMMARY: AddressSanitizer: heap-use-after-free /home/dungnguyen/fuzz/gpac/src/isomedia/box_funcs.c:1504 gf_isom_box_del
~~~

---

Comment by aureliendavid on 2020-03-26 19:00:10+00:00:
Hi,

This should be fixed by the commit above. You can close the issue if you confirm it fixed. 

Thanks for the report. 

---

Comment by strongcourage on 2020-03-26 19:28:45+00:00:
Hi Aurelien,

Thanks for your patch. I do confirm that those UAF bugs have been fixed completely.

Best.

Commit References:
eec9e058a9486fe4e99c33021481d9e1826ca9db

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./configure --static-build --extra-cflags="${CFLAGS}" --extra-ldflags="${CFLAGS}"
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y build-essential pkg-config libz-dev
RUN git clone https://github.com/gpac/gpac gpac
RUN git -C gpac checkout fb8d9dc0607a84d385e94566783e147e0153d6d1
WORKDIR $SRC/gpac
COPY build.sh $SRC/

Additional files:
filename: fuzz_parse.c
content: /* Copyright 2021 Google LLC
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
      http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#include <stdio.h>
#include <unistd.h>

#include <gpac/internal/isomedia_dev.h>
#include <gpac/constants.h>

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
    char filename[256];
    sprintf(filename, "/tmp/libfuzzer.%d", getpid());

    FILE *fp = fopen(filename, "wb");
    if (!fp) {
        return 0;
    }
    fwrite(data, size, 1, fp);
    fclose(fp);

    GF_ISOFile *movie = NULL;
    movie = gf_isom_open_file(filename, GF_ISOM_OPEN_READ_DUMP, NULL);
    if (movie != NULL) {
        gf_isom_close(movie);
    }
    unlink(filename);
    return 0;
}