Project: gpac (gpac/gpac), language: c++
Vulnerability instance: gpac.cve-2024-50665
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/gpac/gpac/issues/2987
## Description:
Issue: gpac/gpac#2987
Title: SEGV at src/isomedia/drm_sample.c:1562:96 in isom_cenc_get_sai_by_saiz_saio in MP4Box
State: closed
Created by: Frank-Z7
Created at: 2024-10-07 11:17:35+00:00

Issue Body:
### Description

Dear developers, 

We found the following segmentation violation bug on gpac(version 2.4), please confirm.

This may be due to a Segmentation violation caused by dereferencing a null pointer, which can sometimes lead to a crash.

The latest master branch and version 2.4 both have this bug.
```
isomedia/drm_sample.c:1562:118: runtime error: load of null pointer of type 'u8'
```
### Version
```shell
MP4Box - GPAC version 2.4-rev0-g5d70253ac-HEAD
```

### ASAN Log

./bin/gcc/MP4Box -dash 1000 -mvex-after-traks -daisy-chain -out /dev/null poc7gpac

```shell
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1963314==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f4f7ad3f484 bp 0x7ffd649eed20 sp 0x7ffd649eebc0 T0)
==1963314==The signal is caused by a READ memory access.
==1963314==Hint: address points to the zero page.
    #0 0x7f4f7ad3f484 in isom_cenc_get_sai_by_saiz_saio /gpac/src/isomedia/drm_sample.c:1562:96
    #1 0x7f4f7ad3f484 in gf_isom_cenc_get_sample_aux_info /gpac/src/isomedia/drm_sample.c:1672:10
    #2 0x7f4f7b8707ed in isor_update_cenc_info /gpac/src/filters/isoffin_read_ch.c:242:7
    #3 0x7f4f7b873f00 in isor_reader_get_sample /gpac/src/filters/isoffin_read_ch.c:655:4
    #4 0x7f4f7b8662a5 in isoffin_process /gpac/src/filters/isoffin_read.c:1486:5
    #5 0x7f4f7b5c57b1 in gf_filter_process_task /gpac/src/filter_core/filter.c:3143:7
    #6 0x7f4f7b592191 in gf_fs_thread_proc /gpac/src/filter_core/filter_session.c:2144:3
    #7 0x7f4f7b59020d in gf_fs_run /gpac/src/filter_core/filter_session.c:2451:3
    #8 0x7f4f7af30bca in gf_dasher_process /gpac/src/media_tools/dash_segmenter.c:1255:6
    #9 0x55bd003cea1c in do_dash /gpac/applications/mp4box/mp4box.c:4832:15
    #10 0x55bd003bfedf in mp4box_main /gpac/applications/mp4box/mp4box.c:6256:7
    #11 0x7f4f79faed8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) (BuildId: a43bfc8428df6623cd498c9c0caeb91aec9be4f9)
    #12 0x7f4f79faee3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f) (BuildId: a43bfc8428df6623cd498c9c0caeb91aec9be4f9)
    #13 0x55bd002e7fe4 in _start (/gpac/bin/gcc/MP4Box+0x85fe4) (BuildId: d351b6e65d0a70b69e40b457b1491e27ba84c191)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /gpac/src/isomedia/drm_sample.c:1562:96 in isom_cenc_get_sai_by_saiz_saio
==1963314==ABORTING
```

### Reproduction

```shell
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout 5d70253
./configure --enable-sanitizer
make -j24

./bin/gcc/MP4Box -dash 1000 -mvex-after-traks -daisy-chain -out /dev/null poc7gpac
```

### PoC

poc7gpac: https://github.com/Frank-Z7/z-vulnerabilitys/blob/main/poc7gpac

### Reference

https://github.com/gpac/gpac

### Environment

```
ubuntu:20.04
gcc version 9.4.0 (Ubuntu 9.4.0-1ubuntu1~20.04.2)
clang version 10.0.0-4ubuntu1
afl-cc++4.09
```


Comments:
Comment by Frank-Z7 on 2024-10-07 12:05:57+00:00:
Compile with afl-clang-fast, which can generate more detailed ASAN reports:

CC=afl-clang-fast CXX=afl-clang-fast++ CFLAGS="-ggdb -O0 -fsanitize=address -fno-omit-frame-pointer" CXXFLAGS="-ggdb -O0 -fsanitize=address -fno-omit-frame-pointer" LDFLAGS="-ggdb -O0 -fsanitize=address" ./configure

AFL_USE_ASAN=1 make -j30

Commit References:
d351b6e65d0a70b69e40b457b1491e27ba84c191
a43bfc8428df6623cd498c9c0caeb91aec9be4f9

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./configure --static-build --extra-cflags="${CFLAGS}" --extra-ldflags="${CFLAGS}"
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y build-essential pkg-config libz-dev
RUN git clone https://github.com/gpac/gpac gpac
RUN git -C gpac checkout 5d70253ac94e5840be7b86054131dd753af63cc7
WORKDIR $SRC/gpac
COPY build.sh $SRC/

Additional files: