[POC](https://cdn.discordapp.com/attachments/1002845697801977896/1004011628288802887/null_dereference)

```
Version

06:02:21 root@ubuntu gcc ±|master ✗|→ ./MP4Box -version
MP4Box - GPAC version 2.1-DEV-rev259-gfc4749f9c-master
(c) 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
        GPAC Filters: https://doi.org/10.1145/3339825.3394929
        GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration:
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SSL GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_FAAD GPAC_HAS_JPEG GPAC_HAS_PNG GPAC_HAS_LINUX_DVB

Proof of Conect
./MP4Box -info ./null_dereference
ASAN Log

[iso file] extra box udta found in moov, deleting
[iso file] extra box udta found in moov, deleting
[iso file] extra box udta found in moov, deleting
[iso file] extra box udta found in moov, deleting
[iso file] Unknown box type 0000 in parent minf
[iso file] Unknown box type s0000s in parent stbl
[ISO file] dataReferenceIndex set to 0 in sample entry, overriding to 1
[iso file] Read Box type FFFFFFEA (0xFFFFFFEA) at position 764 has size 0 but is not at root/file level. Forbidden, skipping end of parent box !
[iso file] Box "dims" (start 748) has 10 extra bytes
[iso file] Read Box type 00000000 (0x00000000) at position 782 has size 0 but is not at root/file level. Forbidden, skipping end of parent box !
[iso file] Box "stsd" (start 732) has 48 extra bytes
[iso file] Missing DataInformationBox
[iso file] Unknown box type 00000000 in parent stbl
[iso file] Unknown box type url  in parent dinf
[iso file] Missing dref box in dinf
[iso file] Unknown top-level box type 000000
[iso file] Unknown top-level box type 00000008
[iso file] Incomplete box 00000000 - start 1574 size 808465447
[iso file] Incomplete file while reading for dump - aborting parsing
# Movie Info - 2 tracks - TimeScale 3158064
Duration 00:04:16.000 (recomputed 00:00:09.000)
Fragmented: no
Progressive (moov before mdat)
Major Brand 0000 - version 808464432 - compatible brands: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
Created: GMT Sat Sep 19 11:55:28 2065
Modified: GMT Sat Sep 19 11:54:46 2065


Copyrights:
        (lap) 000000000
1 UDTA types:
        cprt:

# Track 1 Info - ID 12336 - TimeScale 16
Media Duration 00:12:51.000  (recomputed 00:00:09.000)
Track flags: Disabled In Movie Size is AspectRatio
Media Info: Language "``o (``o)" - Type "soun:dims" - 15 samples
Alternate Group ID 12336
        3GPP DIMS stream - size 0 x 0 - Profile 0 - Level 0
        pathComponents: 0 - useFullRequestHost: no
        stream type: secondary - redundant: main+redundant
AddressSanitizer:DEADLYSIGNAL
=================================================================
==8678==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000569547 bp 0x000000000001 sp 0x7fff81bca2d0 T0)
==8678==The signal is caused by a READ memory access.
==8678==Hint: address points to the zero page.
    #0 0x569546 in DumpTrackInfo /root/gpac_stable_asan/applications/mp4box/filedump.c:3361:12
    #1 0x57267f in DumpMovieInfo /root/gpac_stable_asan/applications/mp4box/filedump.c:3994:3
    #2 0x545302 in mp4box_main /root/gpac_stable_asan/applications/mp4box/mp4box.c:6367:9
    #3 0x7f7368cafc86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
    #4 0x428b79 in _start (/root/gpac_stable_asan/bin/gcc/MP4Box+0x428b79)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/gpac_stable_asan/applications/mp4box/filedump.c:3361:12 in DumpTrackInfo
==8678==ABORTING

Root Cause

gf_isom_get_dims_description@plt returns NULL data.  
Therefore, an error occurs when referring to the corresponding part.

gf_isom_get_dims_description(file, trackNum, 1, &dims);
fprintf(stderr, "\t3GPP DIMS stream - size %d x %d - Profile %d - Level %d\n", w, h, dims.profile, dims.level);
fprintf(stderr, "\tpathComponents: %d - useFullRequestHost: %s\n", dims.pathComponents, dims.fullRequestHost ? "yes" : "no");
fprintf(stderr, "\tstream type: %s - redundant: %s\n", dims.streamType ? "primary" : "secondary", (dims.containsRedundant==1) ? "main" : ((dims.containsRedundant==2) ? "redundant" : "main+redundant") );
if (dims.textEncoding[0]) fprintf(stderr, "\ttext encoding %s\n", dims.textEncoding);

=> 0x4589f6 <DumpTrackInfo+13174>:      call   0x40f500 <gf_isom_get_dims_description@plt>
Guessed arguments:
arg[0]: 0x8c8990 --> 0x0
arg[1]: 0x1
arg[2]: 0x1
arg[3]: 0x7ffffffd2ee0 --> 0x0

typedef struct
{
    /*! profile*/
    u8 profile;
    /*! level*/
    u8 level;
    /*! number of components in path*/
    u8 pathComponents;
    /*! full request*/
    Bool fullRequestHost;
    /*! stream type*/
    Bool streamType;
    /*! has redundant sample (carousel)*/
    u8 containsRedundant;
    /*! text encoding string*/
    const char *textEncoding;
    /*! content encoding string*/
    const char *contentEncoding;
    /*! script string*/
    const char *content_script_types;
    /*! mime type string*/
    const char *mime_type;
    /*! xml schema location string*/
    const char *xml_schema_loc;
} GF_DIMSDescription;

Impact

Deinal of Service
Occurrences

isomedia.h L3680

filedump.c L3361
```
Null Pointer Dereference Caused Segmentation Fault
This is a GitHub Issue
repo:gpac
owner:gpac
Title : Null Pointer Dereference Caused Segmentation Fault
Issue date:

--- start body ---
[POC](https://cdn.discordapp.com/attachments/1002845697801977896/1004011628288802887/null_dereference)

```
Version

06:02:21 root@ubuntu gcc ±|master ✗|→ ./MP4Box -version
MP4Box - GPAC version 2.1-DEV-rev259-gfc4749f9c-master
(c) 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
        GPAC Filters: https://doi.org/10.1145/3339825.3394929
        GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration:
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SSL GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_FAAD GPAC_HAS_JPEG GPAC_HAS_PNG GPAC_HAS_LINUX_DVB

Proof of Conect
./MP4Box -info ./null_dereference
ASAN Log

[iso file] extra box udta found in moov, deleting
[iso file] extra box udta found in moov, deleting
[iso file] extra box udta found in moov, deleting
[iso file] extra box udta found in moov, deleting
[iso file] Unknown box type 0000 in parent minf
[iso file] Unknown box type s0000s in parent stbl
[ISO file] dataReferenceIndex set to 0 in sample entry, overriding to 1
[iso file] Read Box type FFFFFFEA (0xFFFFFFEA) at position 764 has size 0 but is not at root/file level. Forbidden, skipping end of parent box !
[iso file] Box "dims" (start 748) has 10 extra bytes
[iso file] Read Box type 00000000 (0x00000000) at position 782 has size 0 but is not at root/file level. Forbidden, skipping end of parent box !
[iso file] Box "stsd" (start 732) has 48 extra bytes
[iso file] Missing DataInformationBox
[iso file] Unknown box type 00000000 in parent stbl
[iso file] Unknown box type url  in parent dinf
[iso file] Missing dref box in dinf
[iso file] Unknown top-level box type 000000
[iso file] Unknown top-level box type 00000008
[iso file] Incomplete box 00000000 - start 1574 size 808465447
[iso file] Incomplete file while reading for dump - aborting parsing
# Movie Info - 2 tracks - TimeScale 3158064
Duration 00:04:16.000 (recomputed 00:00:09.000)
Fragmented: no
Progressive (moov before mdat)
Major Brand 0000 - version 808464432 - compatible brands: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
Created: GMT Sat Sep 19 11:55:28 2065
Modified: GMT Sat Sep 19 11:54:46 2065


Copyrights:
        (lap) 000000000
1 UDTA types:
        cprt:

# Track 1 Info - ID 12336 - TimeScale 16
Media Duration 00:12:51.000  (recomputed 00:00:09.000)
Track flags: Disabled In Movie Size is AspectRatio
Media Info: Language "``o (``o)" - Type "soun:dims" - 15 samples
Alternate Group ID 12336
        3GPP DIMS stream - size 0 x 0 - Profile 0 - Level 0
        pathComponents: 0 - useFullRequestHost: no
        stream type: secondary - redundant: main+redundant
AddressSanitizer:DEADLYSIGNAL
=================================================================
==8678==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000569547 bp 0x000000000001 sp 0x7fff81bca2d0 T0)
==8678==The signal is caused by a READ memory access.
==8678==Hint: address points to the zero page.
    #0 0x569546 in DumpTrackInfo /root/gpac_stable_asan/applications/mp4box/filedump.c:3361:12
    #1 0x57267f in DumpMovieInfo /root/gpac_stable_asan/applications/mp4box/filedump.c:3994:3
    #2 0x545302 in mp4box_main /root/gpac_stable_asan/applications/mp4box/mp4box.c:6367:9
    #3 0x7f7368cafc86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
    #4 0x428b79 in _start (/root/gpac_stable_asan/bin/gcc/MP4Box+0x428b79)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/gpac_stable_asan/applications/mp4box/filedump.c:3361:12 in DumpTrackInfo
==8678==ABORTING

Root Cause

gf_isom_get_dims_description@plt returns NULL data.  
Therefore, an error occurs when referring to the corresponding part.

gf_isom_get_dims_description(file, trackNum, 1, &dims);
fprintf(stderr, "\t3GPP DIMS stream - size %d x %d - Profile %d - Level %d\n", w, h, dims.profile, dims.level);
fprintf(stderr, "\tpathComponents: %d - useFullRequestHost: %s\n", dims.pathComponents, dims.fullRequestHost ? "yes" : "no");
fprintf(stderr, "\tstream type: %s - redundant: %s\n", dims.streamType ? "primary" : "secondary", (dims.containsRedundant==1) ? "main" : ((dims.containsRedundant==2) ? "redundant" : "main+redundant") );
if (dims.textEncoding[0]) fprintf(stderr, "\ttext encoding %s\n", dims.textEncoding);

=> 0x4589f6 <DumpTrackInfo+13174>:      call   0x40f500 <gf_isom_get_dims_description@plt>
Guessed arguments:
arg[0]: 0x8c8990 --> 0x0
arg[1]: 0x1
arg[2]: 0x1
arg[3]: 0x7ffffffd2ee0 --> 0x0

typedef struct
{
    /*! profile*/
    u8 profile;
    /*! level*/
    u8 level;
    /*! number of components in path*/
    u8 pathComponents;
    /*! full request*/
    Bool fullRequestHost;
    /*! stream type*/
    Bool streamType;
    /*! has redundant sample (carousel)*/
    u8 containsRedundant;
    /*! text encoding string*/
    const char *textEncoding;
    /*! content encoding string*/
    const char *contentEncoding;
    /*! script string*/
    const char *content_script_types;
    /*! mime type string*/
    const char *mime_type;
    /*! xml schema location string*/
    const char *xml_schema_loc;
} GF_DIMSDescription;

Impact

Deinal of Service
Occurrences

isomedia.h L3680

filedump.c L3361
```
--- end body ---

A null pointer dereference in the GPAC MP4Box application (version 2.1-DEV) can lead to a segmentation fault, causing a Denial of Service (DoS). The issue arises when the function `gf_isom_get_dims_description` returns NULL, leading to an attempt to access members of a NULL pointer in the `DumpTrackInfo` function. This vulnerability can be exploited by providing a specially crafted MP4 file that triggers the null dereference, resulting in a crash of the application.