Project: gpac (gpac/gpac), language: c++
Vulnerability instance: gpac.cve-2023-3013
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: Huntr
## URL: https://huntr.dev/bounties/52f95edc-cc03-4a9f-9bf8-74f641260073
## Description:
Environment
Distributor ID: Debian
Description:    Debian GNU/Linux bookworm/sid
Version
I checked against the latest release as of 05/29/23 the current master branch at commit 4f810869b06b5d7b0cb73d166864dfb4b1e900f6 .
Description
This AddressSanitizer output is indicating a read on an unknown address 0x8. This exception occurred in the function dasher_configure_pid at line 1418 in the file dasher.c. This root cause of this error is that the function call to gf_odf_avc_cfg_read on the line line 1418 just before the call to gf_list_get can return 0/NULL. This value is set to the variable avccfg and is then dereferenced like this:
avccfg->sequenceParameterSets  
The fix is to properly check the return value whenever gf_odf_avc_cfg_read is called, or change said function to exit cleanly with an error if it is fatal.
GF_AVCConfig* avccfg = gf_odf_avc_cfg_read(dsi->value.data.ptr, dsi->value.data.size);  
//The provided testcase causes avccfg to equal 0.
GF_NALUFFParam *sl = (GF_NALUFFParam *)gf_list_get(avccfg->sequenceParameterSets, 0); // the deref that causes the asan output is here
POC
./MP4Box -dash 1000 ./POC3_config4
POC File
ASAN
./bin/gcc/MP4Box -dash 1000 ../d_test_min

[BS] Attempt to overread bitstream
[Core] exp-golomb read failed, not enough bits in bitstream !
[AVC|H264] Error parsing NAL unit type 13
[Dasher] No template assigned, using $File$_dash$FS$$Number$
[Dasher] No bitrate property assigned to PID d_test_min, computing from bitstream
[Dasher] No bitrate property assigned to PID d_test_min, computing from bitstream
[AVC] Wrong param set size 1
AddressSanitizer:DEADLYSIGNAL
=================================================================
==934039==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x7ffff6de6190 bp 0x7fffffff4fb0 sp 0x7ffffffc4ae0 T0)
==934039==The signal is caused by a READ memory access.
==934039==Hint: address points to the zero page.
    #0 0x7ffff6de6190 in dasher_configure_pid /path/to/gpac/src/filters/dasher.c:1418:64
    #1 0x7ffff6cd87d5 in gf_filter_pid_configure /path/to/gpac/src/filter_core/filter_pid.c:860:6
    #2 0x7ffff6d061b3 in filter_pck_check_prop_change /path/to/gpac/src/filter_core/filter_pid.c:6157:9
    #3 0x7ffff6cdd0b8 in gf_filter_pid_get_packet /path/to/gpac/src/filter_core/filter_pid.c:6206:6
    #4 0x7ffff6e1e08a in dasher_switch_period /path/to/gpac/src/filters/dasher.c:6111:3
    #5 0x7ffff6ddf178 in dasher_process /path/to/gpac/src/filters/dasher.c:9490:6
    #6 0x7ffff6d7bae5 in gf_filter_process_task /path/to/gpac/src/filter_core/filter.c:2894:7
    #7 0x7ffff6d4830c in gf_fs_thread_proc /path/to/gpac/src/filter_core/filter_session.c:1962:3
    #8 0x7ffff6d46aff in gf_fs_run /path/to/gpac/src/filter_core/filter_session.c:2264:3
    #9 0x7ffff6607cfa in gf_dasher_process /path/to/gpac/src/media_tools/dash_segmenter.c:1236:6
    #10 0x5555556c161c in do_dash /path/to/gpac/applications/mp4box/mp4box.c:4825:15
    #11 0x5555556b2aae in mp4box_main /path/to/gpac/applications/mp4box/mp4box.c:6236:7
    #12 0x7ffff5846189 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #13 0x7ffff5846244 in __libc_start_main csu/../csu/libc-start.c:381:3
    #14 0x5555555dad50 in _start (/path/to/gpac/bin/gcc/MP4Box+0x86d50) (BuildId: 4f810869b06b5d7b0cb73d166864dfb4b1e900f6)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /path/to/gpac/src/filters/dasher.c:1418:64 in dasher_configure_pid
==934039==ABORTING
Testcase crashes:
https://github.com/gpac/gpac/blob/4b28f33967d63c1039f31efd0bcf04a35894ff67/src/filters/dasher.c#L1417-L1418
Similar code sites:
https://github.com/gpac/gpac/blob/4b28f33967d63c1039f31efd0bcf04a35894ff67/src/filters/mux_isom.c#L2561-L2565
https://github.com/gpac/gpac/blob/4b28f33967d63c1039f31efd0bcf04a35894ff67/src/filters/dec_vtb.c#L1096-L1097
https://github.com/gpac/gpac/blob/4b28f33967d63c1039f31efd0bcf04a35894ff67/src/filters/dec_mediacodec.c#L665-L666
Impact
This can cause this program or programs using this library to crash or experience undefined behavior.

Relevant Links:
https://github.com/gpac/gpac
https://drive.google.com/file/d/1JBLFTJQSPV93FHWfxDhtHPXQfq8ukjY2
https://github.com/gpac/gpac/blob/4b28f33967d63c1039f31efd0bcf04a35894ff67/src/filters/mux_isom.c#L2561-L2565

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./configure --static-build --extra-cflags="${CFLAGS}" --extra-ldflags="${CFLAGS}"
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y build-essential pkg-config libz-dev
RUN git clone https://github.com/gpac/gpac gpac
RUN git -C gpac checkout 53387aa86c1af1228d0fa57c67f9c7330716d5a7
WORKDIR $SRC/gpac
COPY build.sh $SRC/

Additional files: