An issue was discovered in gpac through 20200801. A NULL pointer dereference exists in the function nhmldump_send_header located in write_nhml.c. It allows an attacker to cause Denial of Service.
cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*
CCA1FE1D-17AE-45F9-A7BD-A8316EE859D6
1.0.1
OR
## System info

Ubuntu x86_64, gcc (Ubuntu 5.5.0-12ubuntu1), MP4Box (latest master [2aa266](https://github.com/gpac/gpac/commit/2aa266dfaab6aaad9f9f4f216ad7d1e62adc7fa0))

## Configure

CFLAGS="-g -fsanitize=address" LDFLAGS="-fsanitize=address" ./configure --static-mp4box

## Command line

./bin/gcc/MP4Box -dxml -x3d -diod -latm -keep-utc -out /dev/null @@

## Output

```
Scene loaded - dumping root scene
Exporting MPEG-4 AAC Audio - SampleRate 44100 2 channels 16 bits per sample
Segmentation fault (core dumped)
```

## AddressSanitizer output

```
ASAN:SIGSEGV
=================================================================
==1506==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x557beddb309a bp 0x0c2200000636 sp 0x7fff536d0ac0 T0)
    #0 0x557beddb3099 in nhmldump_send_header filters/write_nhml.c:401
    #1 0x557beddb3099 in nhmldump_process filters/write_nhml.c:864
    #2 0x557bed884315 in gf_filter_process_task filter_core/filter.c:2158
    #3 0x557bed82e4dd in gf_fs_thread_proc filter_core/filter_session.c:1463
    #4 0x557bed8403fe in gf_fs_run filter_core/filter_session.c:1700
    #5 0x557bed4e3171 in gf_media_export_filters media_tools/media_export.c:1391
    #6 0x557beca503df in dump_isom_xml /home/seviezhou/gpac/applications/mp4box/filedump.c:1733
    #7 0x557beca20fa4 in mp4boxMain /home/seviezhou/gpac/applications/mp4box/main.c:5548
    #8 0x7f4b75f6fb96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #9 0x557bec9fef09 in _start (/home/seviezhou/gpac/bin/gcc/MP4Box+0x27ff09)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV filters/write_nhml.c:401 nhmldump_send_header
==1506==ABORTING
```

## POC

[SEGV-nhmldump_send_header-write_nhml-401.zip](https://github.com/gpac/gpac/files/5038990/SEGV-nhmldump_send_header-write_nhml-401.zip)

A Segmentation fault in write_nhml.c:401
This is a GitHub Issue
repo:gpac
owner:gpac
Title : A Segmentation fault in write_nhml.c:401
Issue date:

--- start body ---
## System info

Ubuntu x86_64, gcc (Ubuntu 5.5.0-12ubuntu1), MP4Box (latest master [2aa266](https://github.com/gpac/gpac/commit/2aa266dfaab6aaad9f9f4f216ad7d1e62adc7fa0))

## Configure

CFLAGS="-g -fsanitize=address" LDFLAGS="-fsanitize=address" ./configure --static-mp4box

## Command line

./bin/gcc/MP4Box -dxml -x3d -diod -latm -keep-utc -out /dev/null @@

## Output

```
Scene loaded - dumping root scene
Exporting MPEG-4 AAC Audio - SampleRate 44100 2 channels 16 bits per sample
Segmentation fault (core dumped)
```

## AddressSanitizer output

```
ASAN:SIGSEGV
=================================================================
==1506==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x557beddb309a bp 0x0c2200000636 sp 0x7fff536d0ac0 T0)
    #0 0x557beddb3099 in nhmldump_send_header filters/write_nhml.c:401
    #1 0x557beddb3099 in nhmldump_process filters/write_nhml.c:864
    #2 0x557bed884315 in gf_filter_process_task filter_core/filter.c:2158
    #3 0x557bed82e4dd in gf_fs_thread_proc filter_core/filter_session.c:1463
    #4 0x557bed8403fe in gf_fs_run filter_core/filter_session.c:1700
    #5 0x557bed4e3171 in gf_media_export_filters media_tools/media_export.c:1391
    #6 0x557beca503df in dump_isom_xml /home/seviezhou/gpac/applications/mp4box/filedump.c:1733
    #7 0x557beca20fa4 in mp4boxMain /home/seviezhou/gpac/applications/mp4box/main.c:5548
    #8 0x7f4b75f6fb96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #9 0x557bec9fef09 in _start (/home/seviezhou/gpac/bin/gcc/MP4Box+0x27ff09)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV filters/write_nhml.c:401 nhmldump_send_header
==1506==ABORTING
```

## POC

[SEGV-nhmldump_send_header-write_nhml-401.zip](https://github.com/gpac/gpac/files/5038990/SEGV-nhmldump_send_header-write_nhml-401.zip)

--- end body ---

comments :
--- start comments ---

--- end comments ---