GPAC 2.1-DEV-rev87-g053aae8-master. has a Null Pointer Dereference vulnerability in gf_isom_parse_movie_boxes_internal due to improper return value handling of GF_SKIP_BOX, which causes a Denial of Service. This vulnerability was fixed in commit 37592ad.
cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*
A97931ED-0014-4D2C-969E-5B41DDFF9DD2
2022-04-12
OR
**version info:**
```
root@d8a714203f6e:# ./MP4Box -version
MP4Box - GPAC version 2.1-DEV-rev87-g053aae8-master
(c) 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
        GPAC Filters: https://doi.org/10.1145/3339825.3394929
        GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --prefix=/path_to_gpac/build --enable-debug --enable-sanitizer
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SSL GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_FAAD GPAC_HAS_MAD GPAC_HAS_LIBA52 GPAC_HAS_JPEG GPAC_HAS_PNG GPAC_HAS_FFMPEG GPAC_HAS_JP2 GPAC_HAS_THEORA GPAC_HAS_VORBIS GPAC_HAS_XVID GPAC_HAS_LINUX_DVB
```
**poc:**[poc](https://github.com/dandanxu96/PoC/raw/main/gpac/gpac-gf_isom_parse_movie_boxes-null-pointer-dereference-poc)
**command:** MP4Box -hint -out /dev/null $poc$
**crash:**
```
root@d8a714203f6e:# ./MP4Box -hint -out /dev/null poc
[iso file] Read Box type 00000000 (0x00000000) at position 45 has size 0 but is not at root/file level. Forbidden, skipping end of parent box !
[iso file] Read Box "abst" (start 0) failed (Unknown Error (10)) - skipping
isomedia/isom_intern.c:392:12: runtime error: member access within null pointer of type 'struct GF_Box'
```
When `size=0` and `is_root_box=false`, `gf_isom_box_parse_ex` will return `GF_SKIP_BOX` (i.e., 10) at line 138 of box_funcs.c.

https://github.com/gpac/gpac/blob/7f060bbb72966cae80d6fee338d0b07fa3fc06e1/src/isomedia/box_funcs.c#L129-L142

This will cause `*outBox` to be set to NULL (in box_funcs.c:312) and the return value `GF_SKIP_BOX` will be passed to the upper function ( in box_funcs.c:318).

https://github.com/gpac/gpac/blob/7f060bbb72966cae80d6fee338d0b07fa3fc06e1/src/isomedia/box_funcs.c#L310-L319

The program now executes the empty if block when `e>=0`( in isom_intern.c:375-377), and later dereferences the null pointer in line 392 of isom_intern.c.

https://github.com/gpac/gpac/blob/7f060bbb72966cae80d6fee338d0b07fa3fc06e1/src/isomedia/isom_intern.c#L373-L392

Note that although the crash path is the same as in issue #2155,  their root cause is different.
NULL Pointer Dereference still exists in gf_isom_parse_movie_boxes_internal
This is a GitHub Issue
repo:gpac
owner:gpac
Title : NULL Pointer Dereference still exists in gf_isom_parse_movie_boxes_internal
Issue date:

--- start body ---
**version info:**
```
root@d8a714203f6e:# ./MP4Box -version
MP4Box - GPAC version 2.1-DEV-rev87-g053aae8-master
(c) 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
        GPAC Filters: https://doi.org/10.1145/3339825.3394929
        GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --prefix=/path_to_gpac/build --enable-debug --enable-sanitizer
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SSL GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_FAAD GPAC_HAS_MAD GPAC_HAS_LIBA52 GPAC_HAS_JPEG GPAC_HAS_PNG GPAC_HAS_FFMPEG GPAC_HAS_JP2 GPAC_HAS_THEORA GPAC_HAS_VORBIS GPAC_HAS_XVID GPAC_HAS_LINUX_DVB
```
**poc:**[poc](https://github.com/dandanxu96/PoC/raw/main/gpac/gpac-gf_isom_parse_movie_boxes-null-pointer-dereference-poc)
**command:** MP4Box -hint -out /dev/null $poc$
**crash:**
```
root@d8a714203f6e:# ./MP4Box -hint -out /dev/null poc
[iso file] Read Box type 00000000 (0x00000000) at position 45 has size 0 but is not at root/file level. Forbidden, skipping end of parent box !
[iso file] Read Box "abst" (start 0) failed (Unknown Error (10)) - skipping
isomedia/isom_intern.c:392:12: runtime error: member access within null pointer of type 'struct GF_Box'
```
When `size=0` and `is_root_box=false`, `gf_isom_box_parse_ex` will return `GF_SKIP_BOX` (i.e., 10) at line 138 of box_funcs.c.

https://github.com/gpac/gpac/blob/7f060bbb72966cae80d6fee338d0b07fa3fc06e1/src/isomedia/box_funcs.c#L129-L142

This will cause `*outBox` to be set to NULL (in box_funcs.c:312) and the return value `GF_SKIP_BOX` will be passed to the upper function ( in box_funcs.c:318).

https://github.com/gpac/gpac/blob/7f060bbb72966cae80d6fee338d0b07fa3fc06e1/src/isomedia/box_funcs.c#L310-L319

The program now executes the empty if block when `e>=0`( in isom_intern.c:375-377), and later dereferences the null pointer in line 392 of isom_intern.c.

https://github.com/gpac/gpac/blob/7f060bbb72966cae80d6fee338d0b07fa3fc06e1/src/isomedia/isom_intern.c#L373-L392

Note that although the crash path is the same as in issue #2155,  their root cause is different.
--- end body ---

comments :
--- start comments ---

--- end comments ---