Description

Null pointer dereference caused segmentation fault

Proof of Concept

version

./bin/gcc/MP4Box -version
MP4Box - GPAC version 2.1-DEV-rev65-g718843df4-master
(c) 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
    GPAC Filters: https://doi.org/10.1145/3339825.3394929
    GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --enable-debug
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SSL GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_PNG GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D 

Command: ./bin/gcc/MP4Box -xmt poc

Result: Segmentation fault

poc

bt:

Starting program: /home/ubuntu/fuzz/gpac/bin/gcc/MP4Box -xmt ./poc 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[iso file] Unknown box type url@ in parent dref
[iso file] Unknown box type mp1Dv in parent stsd
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type t0E18 in parent trak
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type 80rak in parent moov
[iso file] Incomplete box mdat - start 11495 size 803701
[iso file] Incomplete file while reading for dump - aborting parsing
[iso file] Unknown box type url@ in parent dref
[iso file] Unknown box type mp1Dv in parent stsd
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type t0E18 in parent trak
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type 80rak in parent moov
[iso file] Incomplete box mdat - start 11495 size 803701
[iso file] Incomplete file while reading for dump - aborting parsing
MPEG-4 BIFS Scene Parsing
[ODF] Reading bifs config: shift in sizes (not supported)

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7240bc7 in BS_ReadByte (bs=0x5555557d29b0) at utils/bitstream.c:362
362         res = bs->original[bs->position++];
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
───────────────────────────────────────────────────────────────────────────────[ REGISTERS ]───────────────────────────────────────────────────────────────────────────────
 RAX  0x0
 RBX  0x0
 RCX  0x1
 RDX  0x5555557d29b0 ◂— 0x0
 RDI  0x5555557d29b0 ◂— 0x0
 RSI  0x0
 R8   0x0
 R9   0x0
 R10  0x9
 R11  0x7ffff72aa158 (gf_node_get_graph) ◂— push   rbp
 R12  0x5555557d4890 —▸ 0x5555557d4460 ◂— 0x0
 R13  0x5555557d4460 ◂— 0x0
 R14  0x1
 R15  0x0
 RBP  0x7fffffff8730 —▸ 0x7fffffff8760 —▸ 0x7fffffff8790 —▸ 0x7fffffff87e0 —▸ 0x7fffffff8850 ◂— ...
 RSP  0x7fffffff8700 ◂— 0x0
 RIP  0x7ffff7240bc7 (BS_ReadByte+166) ◂— movzx  eax, byte ptr [rax]
────────────────────────────────────────────────────────────────────────────────[ DISASM ]─────────────────────────────────────────────────────────────────────────────────
 ► 0x7ffff7240bc7 <BS_ReadByte+166>    movzx  eax, byte ptr [rax]
   0x7ffff7240bca <BS_ReadByte+169>    mov    byte ptr [rbp - 0x13], al
   0x7ffff7240bcd <BS_ReadByte+172>    mov    rax, qword ptr [rbp - 0x28]
   0x7ffff7240bd1 <BS_ReadByte+176>    mov    eax, dword ptr [rax + 0x50]
   0x7ffff7240bd4 <BS_ReadByte+179>    test   eax, eax
   0x7ffff7240bd6 <BS_ReadByte+181>    je     BS_ReadByte+336                <BS_ReadByte+336>
    ↓
   0x7ffff7240c71 <BS_ReadByte+336>    movzx  eax, byte ptr [rbp - 0x13]
   0x7ffff7240c75 <BS_ReadByte+340>    jmp    BS_ReadByte+896                <BS_ReadByte+896>
    ↓
   0x7ffff7240ea1 <BS_ReadByte+896>    mov    rcx, qword ptr [rbp - 8]
   0x7ffff7240ea5 <BS_ReadByte+900>    xor    rcx, qword ptr fs:[0x28]
   0x7ffff7240eae <BS_ReadByte+909>    je     BS_ReadByte+916                <BS_ReadByte+916>
─────────────────────────────────────────────────────────────────────────────[ SOURCE (CODE) ]─────────────────────────────────────────────────────────────────────────────
In file: /home/ubuntu/fuzz/gpac/src/utils/bitstream.c
   357      if (bs->position >= bs->size) {
   358          if (bs->EndOfStream) bs->EndOfStream(bs->par);
   359          if (!bs->overflow_state) bs->overflow_state = 1;
   360          return 0;
   361      }
 ► 362      res = bs->original[bs->position++];
   363 
   364      if (bs->remove_emul_prevention_byte) {
   365          if ((bs->nb_zeros==2) && (res==0x03) && (bs->position<bs->size) && (bs->original[bs->position]<0x04)) {
   366              bs->nb_zeros = 0;
   367              res = bs->original[bs->position++];
─────────────────────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────────────────────
00:0000│ rsp 0x7fffffff8700 ◂— 0x0
01:0008│     0x7fffffff8708 —▸ 0x5555557d29b0 ◂— 0x0
02:0010│     0x7fffffff8710 ◂— 0x0
... ↓        2 skipped
05:0028│     0x7fffffff8728 ◂— 0xe537f499f4c1e900
06:0030│ rbp 0x7fffffff8730 —▸ 0x7fffffff8760 —▸ 0x7fffffff8790 —▸ 0x7fffffff87e0 —▸ 0x7fffffff8850 ◂— ...
07:0038│     0x7fffffff8738 —▸ 0x7ffff7240edb (gf_bs_read_bit+36) ◂— movzx  edx, al
───────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────────────────────
 ► f 0   0x7ffff7240bc7 BS_ReadByte+166
   f 1   0x7ffff7240edb gf_bs_read_bit+36
   f 2   0x7ffff7240f67 gf_bs_read_int+64
   f 3   0x7ffff73d9f47 BM_ParseCommand+87
   f 4   0x7ffff73da181 gf_bifs_flush_command_list+296
   f 5   0x7ffff73da561 gf_bifs_decode_command_list+339
   f 6   0x7ffff75c1189 gf_sm_load_run_isom+1987
   f 7   0x7ffff75a3123 gf_sm_load_run+42
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> where
#0  0x00007ffff7240bc7 in BS_ReadByte (bs=0x5555557d29b0) at utils/bitstream.c:362
#1  0x00007ffff7240edb in gf_bs_read_bit (bs=0x5555557d29b0) at utils/bitstream.c:428
#2  0x00007ffff7240f67 in gf_bs_read_int (bs=0x5555557d29b0, nBits=1) at utils/bitstream.c:461
#3  0x00007ffff73d9f47 in BM_ParseCommand (codec=0x5555557def00, bs=0x5555557d29b0, com_list=0x5555557f3960) at bifs/memory_decoder.c:898
#4  0x00007ffff73da181 in gf_bifs_flush_command_list (codec=0x5555557def00) at bifs/memory_decoder.c:956
#5  0x00007ffff73da561 in gf_bifs_decode_command_list (codec=0x5555557def00, ESID=8, data=0x5555557df340 '\314' <repeats 102 times>, "̔\224\224\224\224\224\224\224", <incomplete sequence \341>, data_length=8208, com_list=0x5555557df2c0) at bifs/memory_decoder.c:1036
#6  0x00007ffff75c1189 in gf_sm_load_run_isom (load=0x7fffffff89c0) at scene_manager/loader_isom.c:303
#7  0x00007ffff75a3123 in gf_sm_load_run (load=0x7fffffff89c0) at scene_manager/scene_manager.c:719
#8  0x0000555555582280 in dump_isom_scene ()
#9  0x00005555555789de in mp4boxMain ()
#10 0x00007ffff6dcdbf7 in __libc_start_main (main=0x55555556c140 <main>, argc=3, argv=0x7fffffffe458, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe448) at ../csu/libc-start.c:310
#11 0x000055555556c17a in _start ()

After Debugging,I found

src/bifs/memory_decoder.c:953

GF_Err gf_bifs_flush_command_list(GF_BifsDecoder *codec)

            if (cbi->cb->bufferSize) {
                bs = gf_bs_new((char*)cbi->cb->buffer, cbi->cb->bufferSize, GF_BITSTREAM_READ);
                gf_bs_set_eos_callback(bs, BM_EndOfStream, codec);
                e = BM_ParseCommand(codec, bs, cbi->cb->commandList);
                gf_bs_del(bs);
            }

after called gf_bs_new, sets bs->origin to null

then using BM_ParseCommand function

src/bifs/memory_decoder.c:887

GF_Err BM_ParseCommand(GF_BifsDecoder *codec, GF_BitStream *bs, GF_List *com_list)
{
    u8 go, type;
    GF_Err e;
    go = 1;
    e = GF_OK;
    GF_SceneGraph *cur_graph = codec->current_graph;
    GF_Proto *cur_proto = codec->pCurrentProto;

    codec->LastError = GF_OK;
    while (go) {
        type = gf_bs_read_int(bs, 2);
        switch (type) {
        case 0:
            e = BM_ParseInsert(codec, bs, com_list);
            break;
        case 1:
            e = BM_ParseDelete(codec, bs, com_list);
            break;
        case 2:
            e = BM_ParseReplace(codec, bs, com_list);
            break;
        case 3:
            e = BM_SceneReplace(codec, bs, com_list);
            break;
        }
        if (e) break;
        go = gf_bs_read_int(bs, 1);
    }
    while (gf_list_count(codec->QPs)) {
        gf_bifs_dec_qp_remove(codec, GF_TRUE);
    }

    codec->current_graph = cur_graph;
    codec->pCurrentProto = cur_proto;
    return e;
}

in type = gf_bs_read_int(bs, 2);

src/utils/bitstream.c

GF_EXPORT
u32 gf_bs_read_int(GF_BitStream *bs, u32 nBits)
{
    u32 ret;
    bs->total_bits_read+= nBits;

#ifndef NO_OPTS
    if (nBits + bs->nbBits <= 8) {
        bs->nbBits += nBits;
        ret = (bs->current >> (8 - bs->nbBits) ) & bits_mask[nBits];
        return ret;
    }
#endif
    ret = 0;
    while (nBits-- > 0) {
        ret <<= 1;
        ret |= gf_bs_read_bit(bs);
    }
    return ret;
}

In gf_bs_read_bit using BS_ReadByte function

GF_EXPORT
u8 gf_bs_read_bit(GF_BitStream *bs)
{
    if (bs->nbBits == 8) {
        bs->current = BS_ReadByte(bs);
        bs->nbBits = 0;
    }
#ifdef NO_OPTS
    {
        s32 ret;
        bs->current <<= 1;
        bs->nbBits++;
        ret = (bs->current & 0x100) >> 8;
        return (u8) ret;
    }
#else
    return (u8) (bs->current & bit_mask[bs->nbBits++]) ? 1 : 0;
#endif

}

In src/utils/bitstream.c BS_ReadByte

/*fetch a new byte in the bitstream switch between packets*/
static u8 BS_ReadByte(GF_BitStream *bs)
{
    Bool is_eos;
    if (bs->bsmode == GF_BITSTREAM_READ) {
        u8 res;
        if (bs->position >= bs->size) {
            if (bs->EndOfStream) bs->EndOfStream(bs->par);
            if (!bs->overflow_state) bs->overflow_state = 1;
            return 0;
        }
        res = bs->original[bs->position++];

        if (bs->remove_emul_prevention_byte) {
            if ((bs->nb_zeros==2) && (res==0x03) && (bs->position<bs->size) && (bs->original[bs->position]<0x04)) {
                bs->nb_zeros = 0;
                res = bs->original[bs->position++];
            }
            if (!res) bs->nb_zeros++;
            else bs->nb_zeros = 0;
        }
        return res;
    }
    if (bs->cache_write)
        bs_flush_write_cache(bs);

    is_eos = gf_feof(bs->stream);

    /*we are in FILE mode, test for end of file*/
    if (!is_eos || bs->cache_read) {
        u8 res;
        Bool loc_eos=GF_FALSE;
        assert(bs->position<=bs->size);
        bs->position++;

        res = gf_bs_load_byte(bs, &loc_eos);
        if (loc_eos) goto bs_eof;

        if (bs->remove_emul_prevention_byte) {
            if ((bs->nb_zeros==2) && (res==0x03) && (bs->position<bs->size)) {
                u8 next = gf_bs_load_byte(bs, &loc_eos);
                if (next < 0x04) {
                    bs->nb_zeros = 0;
                    res = next;
                    bs->position++;
                } else {
                    gf_bs_seek(bs, bs->position);
                }
            }
            if (!res) bs->nb_zeros++;
            else bs->nb_zeros = 0;
        }
        return res;
    }

bs_eof:
    if (bs->EndOfStream) {
        bs->EndOfStream(bs->par);
        if (!bs->overflow_state) bs->overflow_state = 1;
    } else {
        GF_LOG(GF_LOG_ERROR, GF_LOG_CORE, ("[BS] Attempt to overread bitstream\n"));
    }
    assert(bs->position <= 1+bs->size);
    return 0;
}

res = bs->original[bs->position++]; Here using bs->original which is a null pointer, dereference this null pointer caused segmentation fault

it's very similar to https://huntr.dev/bounties/851942a4-1d64-4553-8fdc-9fccd167864b/