CVE-2021-32139 (C, published 2021-09-13T20:15Z)
Description: value: The gf_isom_vp_config_get function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/box_code_3gpp.c
src/isomedia/box_funcs.c
src/isomedia/tx3g.c
Commit message: fixed #1768


Vulnerable code:
	ISOM_DECREASE_SIZE(ptr, 51);

	s->size += 51 + 1;
retry_unknown_box:

		if (parent_type==GF_ISOM_BOX_TYPE_STSD) {
			newBox = gf_isom_box_new(GF_ISOM_BOX_TYPE_UNKNOWN);
			if (!newBox) return GF_OUT_OF_MEM;
			((GF_UnknownBox *)newBox)->original_4cc = type;
			newBox->size = size;
			gf_bs_seek(bs, payload_start);
			goto retry_unknown_box;
		}
	Bool is_qt_text = GF_FALSE;
	GF_Tx3gSampleEntryBox *txt;

		is_qt_text = GF_TRUE;
	(*out_desc)->back_color = txt->back_color;
	(*out_desc)->default_pos = txt->default_box;
	(*out_desc)->default_style = txt->default_style;
	(*out_desc)->displayFlags = txt->displayFlags;
	(*out_desc)->vert_justif = txt->vertical_justification;
	(*out_desc)->horiz_justif = txt->horizontal_justification;
	if (is_qt_text) {
		GF_TextSampleEntryBox *qt_txt = (GF_TextSampleEntryBox *) txt;
static void gf_isom_write_tx3g(GF_Tx3gSampleEntryBox *a, GF_BitStream *bs, u32 sidx, u32 sidx_offset)
	Bool is_qt_text = (a->type==GF_ISOM_BOX_TYPE_TEXT) ? GF_TRUE : GF_FALSE;
	if (is_qt_text) {
		GF_TextSampleEntryBox *qt = (GF_TextSampleEntryBox *)a;
		if (qt->textName) {
			qt_fontname = qt->textName;
			fount_count = 1;
		}
	} else {
		if (a->font_table) {
			fount_count = a->font_table->entry_count;
			for (j=0; j<fount_count; j++) {
				size += 3;
				if (a->font_table->fonts[j].fontName) size += (u32) strlen(a->font_table->fonts[j].fontName);
			}
	gf_bs_write_u32(bs, a->type);
	gf_bs_write_data(bs, a->reserved, 6);
	gf_bs_write_u16(bs, a->dataReferenceIndex);
	gf_bs_write_u32(bs, a->displayFlags);
	gf_bs_write_u8(bs, a->horizontal_justification);
	gf_bs_write_u8(bs, a->vertical_justification);
	gpp_write_rgba(bs, a->back_color);
	gpp_write_box(bs, &a->default_box);
	gpp_write_style(bs, &a->default_style);
		if (is_qt_text) {
			gf_bs_write_u16(bs, a->font_table->fonts[j].fontID);
			if (a->font_table->fonts[j].fontName) {
				u32 len = (u32) strlen(a->font_table->fonts[j].fontName);
				gf_bs_write_data(bs, a->font_table->fonts[j].fontName, len);

Fixed code:
	ISOM_DECREASE_SIZE(ptr, 8);
	//some weird text entries are not QT text nor 3gpp, cf issue #1030
	if (!ptr->size) {
		ptr->textJustification = 1;
		return GF_OK;
	}
	ISOM_DECREASE_SIZE(ptr, 43);


	s->size += 8;
	s->size += 43 + 1;
static u32 rgb_48_to_32(char *val)
{
	u32 res = 0x0;
	u32 i;

	for (i=0; i<3; i++) {
		u32 v = val[2*i];
		v<<=8;
		v|=val[2*i + 1];
		v/=0xFF;

		res <<= 8;
		res |= v;
	}
	return res;
}
	GF_Tx3gSampleEntryBox *txt = NULL;
	GF_TextSampleEntryBox *qt_txt = NULL;
		qt_txt = (GF_TextSampleEntryBox *)txt;
		txt = NULL;

	if (qt_txt) {
		(*out_desc)->back_color = rgb_48_to_32(qt_txt->background_color);
		(*out_desc)->default_pos = qt_txt->default_box;
		(*out_desc)->default_style.style_flags = qt_txt->fontFace;
		(*out_desc)->default_style.text_color = rgb_48_to_32(qt_txt->foreground_color);
		(*out_desc)->displayFlags = qt_txt->displayFlags;
		(*out_desc)->vert_justif = -1;
		(*out_desc)->horiz_justif = qt_txt->textJustification;
		(*out_desc)->back_color = txt->back_color;
		(*out_desc)->default_pos = txt->default_box;
		(*out_desc)->default_style = txt->default_style;
		(*out_desc)->displayFlags = txt->displayFlags;
		(*out_desc)->vert_justif = txt->vertical_justification;
		(*out_desc)->horiz_justif = txt->horizontal_justification;
static void gf_isom_write_tx3g(GF_Tx3gSampleEntryBox *_a, GF_BitStream *bs, u32 sidx, u32 sidx_offset)
	GF_TextSampleEntryBox *qt = (_a->type==GF_ISOM_BOX_TYPE_TEXT) ? (GF_TextSampleEntryBox *)_a : NULL;
	GF_Tx3gSampleEntryBox *ttxt = (_a->type!=GF_ISOM_BOX_TYPE_TEXT) ? (GF_Tx3gSampleEntryBox *)_a : NULL;
	if (qt && qt->textName) {
		qt_fontname = qt->textName;
		fount_count = 1;
	} else if (ttxt && ttxt->font_table) {
		fount_count = ttxt->font_table->entry_count;
		for (j=0; j<fount_count; j++) {
			size += 3;
			if (ttxt->font_table->fonts[j].fontName)
				size += (u32) strlen(ttxt->font_table->fonts[j].fontName);
	gf_bs_write_u32(bs, GF_ISOM_BOX_TYPE_TX3G);
	gf_bs_write_data(bs, _a->reserved, 6);
	gf_bs_write_u16(bs, _a->dataReferenceIndex);
	gf_bs_write_u32(bs, _a->displayFlags);
	if (qt) {
		GF_StyleRecord sr;
		memset(&sr, 0, sizeof(GF_StyleRecord));
		gf_bs_write_u8(bs, qt->textJustification);
		gf_bs_write_u8(bs, (u8) -1);
		gpp_write_rgba(bs, rgb_48_to_32(qt->background_color) );
		gpp_write_box(bs, &qt->default_box);
		sr.text_color = rgb_48_to_32(qt->foreground_color);
		sr.style_flags = qt->fontFace;
		gpp_write_style(bs, &sr);
	} else {
		gf_bs_write_u8(bs, ttxt->horizontal_justification);
		gf_bs_write_u8(bs, ttxt->vertical_justification);
		gpp_write_rgba(bs, ttxt->back_color);
		gpp_write_box(bs, &ttxt->default_box);
		gpp_write_style(bs, &ttxt->default_style);
	}
		if (qt) {
			gf_bs_write_u16(bs, ttxt->font_table->fonts[j].fontID);
			if (ttxt->font_table->fonts[j].fontName) {
				u32 len = (u32) strlen(ttxt->font_table->fonts[j].fontName);
				gf_bs_write_data(bs, ttxt->font_table->fonts[j].fontName, len);