CVE-2023-4681 (published 2023-08-31T16:15Z)

NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3-DEV.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2023-08-31 16:44:06+02:00
msg: fixed #2575
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: dasher.c
change_type: ModificationType.MODIFY
diff: @@ -8387,6 +8387,9 @@ static GF_Err dasher_process(GF_Filter *filter)
 		u32 num_ready=0, num_blocked=0;
 		for (i=0; i<count; i++) {
 			GF_DashStream *ds = gf_list_get(ctx->current_period->streams, i);
+			if (ctx->force_period_switch) {
+				break;
+			}
 			GF_FilterPacket *pck = gf_filter_pid_get_packet(ds->ipid);
 			if (!pck) continue;
 			u64 ts = gf_filter_pck_get_cts(pck);
@@ -8406,6 +8409,9 @@ static GF_Err dasher_process(GF_Filter *filter)
 		}
 		ctx->min_cts_period.num = min_ts;
 		ctx->min_cts_period.den = min_timescale;
+
+		if (ctx->force_period_switch)
+			count = gf_list_count(ctx->current_period->streams);
 	}
 
 	nb_init = has_init = nb_reg_done = 0;

programming_language: C
filename: avilib.c
change_type: ModificationType.MODIFY
diff: @@ -1948,8 +1948,11 @@ int avi_parse_input_file(avi_t *AVI, int getIndex)
 
 				header_offset = gf_ftell(AVI->fdes);
 
-				if( avi_read(AVI->fdes,(char *)hdrl_data, (u32) n) != n ) ERR_EXIT(AVI_ERR_READ)
+				if( avi_read(AVI->fdes,(char *)hdrl_data, (u32) n) != n ) {
+					if (hdrl_data) gf_free(hdrl_data);
+					ERR_EXIT(AVI_ERR_READ)
 				}
+			}
 			else if(strnicmp(data,"movi",4) == 0)
 			{
 				AVI->movi_start = gf_ftell(AVI->fdes);
@@ -1964,19 +1967,24 @@ int avi_parse_input_file(avi_t *AVI, int getIndex)
 
 			AVI->n_idx = AVI->max_idx = (u32) (n/16);
 			AVI->idx = (unsigned  char((*)[16]) ) gf_malloc((u32)n);
-			if(AVI->idx==0) ERR_EXIT(AVI_ERR_NO_MEM)
-				if(avi_read(AVI->fdes, (char *) AVI->idx, (u32) n) != n ) {
-					gf_free( AVI->idx);
-					AVI->idx=NULL;
-					AVI->n_idx = 0;
-				}
+			if(AVI->idx==0) {
+				if (hdrl_data) gf_free(hdrl_data);
+				ERR_EXIT(AVI_ERR_NO_MEM)
+			}
+			if(avi_read(AVI->fdes, (char *) AVI->idx, (u32) n) != n ) {
+				gf_free( AVI->idx);
+				AVI->idx=NULL;
+				AVI->n_idx = 0;
+				if (hdrl_data) gf_free(hdrl_data);
+				ERR_EXIT(AVI_ERR_READ)
+			}
 		}
 		else
 			gf_fseek(AVI->fdes,n,SEEK_CUR);
 	}
 
-	if(!hdrl_data      ) ERR_EXIT(AVI_ERR_NO_HDRL)
-		if(!AVI->movi_start) ERR_EXIT(AVI_ERR_NO_MOVI)
+	if(!hdrl_data) ERR_EXIT(AVI_ERR_NO_HDRL)
+	if(!AVI->movi_start) ERR_EXIT(AVI_ERR_NO_MOVI)
 
 			/* Interpret the header list */
 

programming_language: C
filename: mpeg2_ps.c
change_type: ModificationType.MODIFY
diff: @@ -996,6 +996,7 @@ static void get_info_from_frame (mpeg2ps_stream_t *sptr,
 		                       &sptr->par) < 0) {
 			sptr->m_stream_id = 0;
 			sptr->m_fd = FDNULL;
+			return;
 		}
 		sptr->ticks_per_frame = (u64)(90000.0 / sptr->frame_rate);
 		return;
@@ -1202,7 +1203,7 @@ static void get_info_for_all_streams (mpeg2ps_t *ps)
 			}
 			get_info_from_frame(sptr, buffer, buflen);
 			// here - if (sptr->first_pes_has_dts == 0) should be processed
-			if (sptr->first_pes_has_dts == 0) {
+			if ((sptr->first_pes_has_dts == 0) && sptr->m_fd) {
 				u32 frames_from_beg = 0;
 				Bool have_frame;
 				do {

programming_language: C