CVE-2022-2549 (published 2022-07-27T15:15Z)

NULL Pointer Dereference in GitHub repository gpac/gpac prior to v2.1.0-DEV.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2022-07-24 11:30:34+02:00
msg: fixed #2232
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: scene_dump.c
change_type: ModificationType.MODIFY
diff: @@ -785,7 +785,7 @@ static void gf_dump_vrml_simple_field(GF_SceneDumper *sdump, GF_FieldInfo field,
 		} else {
 			StartAttribute(sdump, "value");
 		}
-		for (i=0; i<mffield->count; i++) {
+		for (i=0; mffield && (i<mffield->count); i++) {
 			if (i) gf_fprintf(sdump->trace, " ");
 			gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
 			/*this is to cope with single MFString which shall appear as SF in XMT*/
@@ -938,12 +938,10 @@ static void gf_dump_vrml_field(GF_SceneDumper *sdump, GF_Node *node, GF_FieldInf
 		}
 
 		if (!sdump->XMLDump) gf_fprintf(sdump->trace, "[");
-		if (mffield) {
-			for (i=0; i<mffield->count; i++) {
-				if (i) gf_fprintf(sdump->trace, " ");
-				gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
-				gf_dump_vrml_sffield(sdump, sf_type, slot_ptr, 1, node);
-			}
+		for (i=0; mffield && (i<mffield->count); i++) {
+			if (i) gf_fprintf(sdump->trace, " ");
+			gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
+			gf_dump_vrml_sffield(sdump, sf_type, slot_ptr, 1, node);
 		}
 		if (!sdump->XMLDump) gf_fprintf(sdump->trace, "]");
 
@@ -1150,7 +1148,7 @@ static void gf_dump_vrml_dyn_field(GF_SceneDumper *sdump, GF_Node *node, GF_Fiel
 					sdump->indent--;
 					DUMP_IND(sdump);
 				} else {
-					for (i=0; i<mffield->count; i++) {
+					for (i=0; mffield && (i<mffield->count); i++) {
 						if (i) gf_fprintf(sdump->trace, " ");
 						if (field.fieldType != GF_SG_VRML_MFNODE) {
 							gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
@@ -1191,7 +1189,7 @@ static void gf_dump_vrml_dyn_field(GF_SceneDumper *sdump, GF_Node *node, GF_Fiel
 					} else {
 						gf_fprintf(sdump->trace, " %s=\"", GetXMTFieldTypeValueName(field.fieldType));
 					}
-					for (i=0; i<mffield->count; i++) {
+					for (i=0; mffield && (i<mffield->count); i++) {
 						if (i) gf_fprintf(sdump->trace, " ");
 						if (field.fieldType != GF_SG_VRML_MFNODE) {
 							gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
@@ -1262,13 +1260,11 @@ static void gf_dump_vrml_proto_field(GF_SceneDumper *sdump, GF_Node *node, GF_Fi
 				} else {
 					gf_fprintf(sdump->trace, " %s=\"", GetXMTFieldTypeValueName(field.fieldType));
 				}
-				if (mffield) {
-					for (i=0; i<mffield->count; i++) {
-						if (i) gf_fprintf(sdump->trace, " ");
-						if (field.fieldType != GF_SG_VRML_MFNODE) {
-							gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
-							gf_dump_vrml_sffield(sdump, sf_type, slot_ptr, (mffield->count>1) ? 1 : 0, node);
-						}
+				for (i=0; mffield && (i<mffield->count); i++) {
+					if (i) gf_fprintf(sdump->trace, " ");
+					if (field.fieldType != GF_SG_VRML_MFNODE) {
+						gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
+						gf_dump_vrml_sffield(sdump, sf_type, slot_ptr, (mffield->count>1) ? 1 : 0, node);
 					}
 				}
 				gf_fprintf(sdump->trace, "\"/>\n");

programming_language: C