Project: gpac (gpac/gpac), language: c++
Vulnerability instance: gpac.cve-2020-23930
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/gpac/gpac/issues/1565
## Description:
Issue: gpac/gpac#1565
Title: A Segmentation fault in write_nhml.c:401
State: closed
Created by: seviezhou
Created at: 2020-08-07 02:28:14+00:00

Issue Body:
## System info

Ubuntu x86_64, gcc (Ubuntu 5.5.0-12ubuntu1), MP4Box (latest master [2aa266](https://github.com/gpac/gpac/commit/2aa266dfaab6aaad9f9f4f216ad7d1e62adc7fa0))

## Configure

CFLAGS="-g -fsanitize=address" LDFLAGS="-fsanitize=address" ./configure --static-mp4box

## Command line

./bin/gcc/MP4Box -dxml -x3d -diod -latm -keep-utc -out /dev/null @@

## Output

```
Scene loaded - dumping root scene
Exporting MPEG-4 AAC Audio - SampleRate 44100 2 channels 16 bits per sample
Segmentation fault (core dumped)
```

## AddressSanitizer output

```
ASAN:SIGSEGV
=================================================================
==1506==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x557beddb309a bp 0x0c2200000636 sp 0x7fff536d0ac0 T0)
    #0 0x557beddb3099 in nhmldump_send_header filters/write_nhml.c:401
    #1 0x557beddb3099 in nhmldump_process filters/write_nhml.c:864
    #2 0x557bed884315 in gf_filter_process_task filter_core/filter.c:2158
    #3 0x557bed82e4dd in gf_fs_thread_proc filter_core/filter_session.c:1463
    #4 0x557bed8403fe in gf_fs_run filter_core/filter_session.c:1700
    #5 0x557bed4e3171 in gf_media_export_filters media_tools/media_export.c:1391
    #6 0x557beca503df in dump_isom_xml /home/seviezhou/gpac/applications/mp4box/filedump.c:1733
    #7 0x557beca20fa4 in mp4boxMain /home/seviezhou/gpac/applications/mp4box/main.c:5548
    #8 0x7f4b75f6fb96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #9 0x557bec9fef09 in _start (/home/seviezhou/gpac/bin/gcc/MP4Box+0x27ff09)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV filters/write_nhml.c:401 nhmldump_send_header
==1506==ABORTING
```

## POC

[SEGV-nhmldump_send_header-write_nhml-401.zip](https://github.com/gpac/gpac/files/5038990/SEGV-nhmldump_send_header-write_nhml-401.zip)



Comments:
Comment by jeanlf on 2020-09-01 14:46:28+00:00:
fixed, thanks for the report

Attachments:
https://github.com/gpac/gpac/files/5038990/SEGV-nhmldump_send_header-write_nhml-401.zip

Commit References:
2aa266dfaab6aaad9f9f4f216ad7d1e62adc7fa0

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./configure --static-build --extra-cflags="${CFLAGS}" --extra-ldflags="${CFLAGS}"
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y build-essential pkg-config libz-dev
RUN git clone https://github.com/gpac/gpac gpac
RUN git -C gpac checkout 093283e727f396130651280609e687cd4778e0d1
WORKDIR $SRC/gpac
COPY build.sh $SRC/

Additional files:
filename: fuzz_parse.c
content: /* Copyright 2021 Google LLC
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
      http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#include <stdio.h>
#include <unistd.h>

#include <gpac/internal/isomedia_dev.h>
#include <gpac/constants.h>

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
    char filename[256];
    sprintf(filename, "/tmp/libfuzzer.%d", getpid());

    FILE *fp = fopen(filename, "wb");
    if (!fp) {
        return 0;
    }
    fwrite(data, size, 1, fp);
    fclose(fp);

    GF_ISOFile *movie = NULL;
    movie = gf_isom_open_file(filename, GF_ISOM_OPEN_READ_DUMP, NULL);
    if (movie != NULL) {
        gf_isom_close(movie);
    }
    unlink(filename);
    return 0;
}