Project: gpac (gpac/gpac), language: c++
Vulnerability instance: gpac.cve-2020-35982
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/gpac/gpac/issues/1660
## Description:
Issue: gpac/gpac#1660
Title: A NULL pointer dereference in the function gf_hinter_track_finalize in  media_tools/isom_hinter.c:970
State: closed
Created by: Clingto
Created at: 2020-12-15 11:59:14+00:00

Issue Body:
System info:  
Ubuntu 16.04.6 LTS, X64, gcc 5.4.0, gpac (latest master c4f8bc6e and the latest V1.0.1 d8538e8) 

Compile Command:
```
$ CC="gcc -fsanitize=address -g" CXX="g++ -fsanitize=address -g" ./configure --static-mp4box --extra-ldflags="-ldl -g"
$ make
```
Run Command:
```
$ MP4Box -hint $gf_hinter_track_finalize-null-pointer -out /dev/null 
```
POC file:  
https://github.com/Clingto/POC/blob/master/gpac-MP4Box/gpac-c4f8bc6e_poc/gf_hinter_track_finalize-null-pointer

gdb info:
```C
                                               
Program received signal SIGSEGV, Segmentation fault.
0x000000000060eab8 in gf_hinter_track_finalize ()
(gdb) bt
#0  0x000000000060eab8 in gf_hinter_track_finalize ()
#1  0x000000000040ad7c in HintFile ()
#2  0x00000000004172b2 in mp4boxMain ()
#3  0x00007ffff6ec7840 in __libc_start_main (main=0x409dc0 <main>, argc=5, argv=0x7fffffffdf68, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffdf58) at ../csu/libc-start.c:291
#4  0x0000000000409df9 in _start ()

```
ASAN info:
```C
Hinting file with Path-MTU 1450 Bytes
Hinting track ID 1 - Type "avc1:avc1" (H264) - BW 3 kbps
ASAN:SIGSEGV                                   
=================================================================
==20754==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000003 (pc 0x00000092e516 bp 0x7fffe5a7ede0 sp 0x7fffe5a79300 T0)
    #0 0x92e515 in gf_hinter_track_finalize media_tools/isom_hinter.c:970
    #1 0x418f85 in HintFile /opt/data/yyp/fuzzsequence/test/0-day/SRC_asan/applications/mp4box/main.c:1448
    #2 0x42bdc7 in mp4boxMain /opt/data/yyp/fuzzsequence/test/0-day/SRC_asan/applications/mp4box/main.c:6641
    #3 0x7fd6bcc3b83f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)
    #4 0x417638 in _start (/opt/data/yyp/fuzzsequence/test/0-day/SRC_asan/build/bin/MP4Box+0x417638)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV media_tools/isom_hinter.c:970 gf_hinter_track_finalize
==20754==ABORTING

```
Addition: This bug was found with our fuzzer, which is based on AFL. Our fuzzer is developed by Yuanpingyu(cfenicey@gmail.com) 、Xiangkun Jia(xiangkun@iscas.ac.cn) 、Marsman1996(lqliuyuwei@outlook.com) and Yanhao.


Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./configure --static-build --extra-cflags="${CFLAGS}" --extra-ldflags="${CFLAGS}"
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y build-essential pkg-config libz-dev
RUN git clone https://github.com/gpac/gpac gpac
RUN git -C gpac checkout dae9900580a8888969481cd72035408091edb11b
WORKDIR $SRC/gpac
COPY build.sh $SRC/

Additional files:
filename: fuzz_parse.c
content: /* Copyright 2021 Google LLC
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
      http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#include <stdio.h>
#include <unistd.h>

#include <gpac/internal/isomedia_dev.h>
#include <gpac/constants.h>

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
    char filename[256];
    sprintf(filename, "/tmp/libfuzzer.%d", getpid());

    FILE *fp = fopen(filename, "wb");
    if (!fp) {
        return 0;
    }
    fwrite(data, size, 1, fp);
    fclose(fp);

    GF_ISOFile *movie = NULL;
    movie = gf_isom_open_file(filename, GF_ISOM_OPEN_READ_DUMP, NULL);
    if (movie != NULL) {
        gf_isom_close(movie);
    }
    unlink(filename);
    return 0;
}