Reproduce

./MP4Box -dash 10000 poc

POC File

https://github.com/gandalf4a/crash_report/blob/main/gpac/MP4Box/poc2/huaf_1658


```
Description

heap-use-after-free in MP4Box
Version

$ ./MP4Box -version
MP4Box - GPAC version 2.3-DEV-rev566-g50c2ab06f-master

Platform

$ uname -a
Linux user-GE40-2PC-Dragon-Eyes 6.2.0-33-generic #33~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep  7 10:33:52 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

Asan

[33m[TTML EBU-TTD] time indicates frames but no frame rate set, assuming 25 FPS
[0m[31m[TTML EBU-TTD] invalid timings: "begin"=24680 , "end"=23320. Abort.
[0m[32m[Dasher] No template assigned, using $File$_dash$FS$$Number$
[0m[32m[Dasher] No bitrate property assigned to PID id000310sig06src000702time203216797execs1924021ophavocrep2, computing from bitstream
[0m[31m[TTML EBU-TTD] duplicated "begin" attribute. Abort.
[0m=================================================================
==734465==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000000868 at pc 0x7fa699af74f8 bp 0x7ffe98c75570 sp 0x7ffe98c75568
READ of size 8 at 0x604000000868 thread T0
    #0 0x7fa699af74f7 in gf_xml_dom_node_reset /home/user/fuzzing_gpac/gpac/src/utils/xml_parser.c:1658:12
    #1 0x7fa699af7547 in gf_xml_dom_node_del /home/user/fuzzing_gpac/gpac/src/utils/xml_parser.c:1681:2
    #2 0x7fa699af7410 in gf_xml_dom_node_reset /home/user/fuzzing_gpac/gpac/src/utils/xml_parser.c:1672:4
    #3 0x7fa699af7547 in gf_xml_dom_node_del /home/user/fuzzing_gpac/gpac/src/utils/xml_parser.c:1681:2
    #4 0x7fa699af7410 in gf_xml_dom_node_reset /home/user/fuzzing_gpac/gpac/src/utils/xml_parser.c:1672:4
    #5 0x7fa699af7547 in gf_xml_dom_node_del /home/user/fuzzing_gpac/gpac/src/utils/xml_parser.c:1681:2
    #6 0x7fa699af7410 in gf_xml_dom_node_reset /home/user/fuzzing_gpac/gpac/src/utils/xml_parser.c:1672:4
    #7 0x7fa699af7547 in gf_xml_dom_node_del /home/user/fuzzing_gpac/gpac/src/utils/xml_parser.c:1681:2
    #8 0x7fa699af7b20 in gf_xml_dom_reset /home/user/fuzzing_gpac/gpac/src/utils/xml_parser.c:1814:4
    #9 0x7fa699af77d3 in gf_xml_dom_del /home/user/fuzzing_gpac/gpac/src/utils/xml_parser.c:1826:2
    #10 0x7fa69ac9ffad in ttxtin_reset /home/user/fuzzing_gpac/gpac/src/filters/load_text.c:4044:32
    #11 0x7fa69ac9ffad in txtin_finalize /home/user/fuzzing_gpac/gpac/src/filters/load_text.c:4293:2
    #12 0x7fa69a96eb6c in gf_fs_del /home/user/fuzzing_gpac/gpac/src/filter_core/filter_session.c:773:6
    #13 0x7fa69a2283f6 in gf_dasher_clean_inputs /home/user/fuzzing_gpac/gpac/src/media_tools/dash_segmenter.c:164:3
    #14 0x7fa69a2283f6 in gf_dasher_del /home/user/fuzzing_gpac/gpac/src/media_tools/dash_segmenter.c:173:2
    #15 0x563912e69d2d in do_dash /home/user/fuzzing_gpac/gpac/applications/mp4box/mp4box.c:4894:2
    #16 0x563912e5ab6e in mp4box_main /home/user/fuzzing_gpac/gpac/applications/mp4box/mp4box.c:6245:7
    #17 0x7fa699229d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #18 0x7fa699229e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #19 0x563912d82dd4 in _start (/home/user/fuzzing_gpac/gpac/bin/gcc/MP4Box+0x82dd4) (BuildId: 53333ca7bff59dd9a3d1b2821e7c5f3a9aac76b9)

0x604000000868 is located 24 bytes inside of 48-byte region [0x604000000850,0x604000000880)
freed by thread T0 here:
    #0 0x563912e05972 in free (/home/user/fuzzing_gpac/gpac/bin/gcc/MP4Box+0x105972) (BuildId: 53333ca7bff59dd9a3d1b2821e7c5f3a9aac76b9)
    #1 0x7fa699af7410 in gf_xml_dom_node_reset /home/user/fuzzing_gpac/gpac/src/utils/xml_parser.c:1672:4

previously allocated by thread T0 here:
    #0 0x563912e05c1e in malloc (/home/user/fuzzing_gpac/gpac/bin/gcc/MP4Box+0x105c1e) (BuildId: 53333ca7bff59dd9a3d1b2821e7c5f3a9aac76b9)
    #1 0x7fa699af80fc in on_dom_node_start /home/user/fuzzing_gpac/gpac/src/utils/xml_parser.c:1702:2

SUMMARY: AddressSanitizer: heap-use-after-free /home/user/fuzzing_gpac/gpac/src/utils/xml_parser.c:1658:12 in gf_xml_dom_node_reset
Shadow bytes around the buggy address:
  0x0c087fff80b0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c087fff80c0: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x0c087fff80d0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd
  0x0c087fff80e0: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x0c087fff80f0: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
=>0x0c087fff8100: fa fa fd fd fd fd fd fd fa fa fd fd fd[fd]fd fd
  0x0c087fff8110: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x0c087fff8120: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x0c087fff8130: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x0c087fff8140: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x0c087fff8150: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==734465==ABORTING

Reproduce

./MP4Box -dash 10000 poc

POC File

https://github.com/gandalf4a/crash_report/blob/main/gpac/MP4Box/poc2/huaf_1658
Credit

Gandalf4a

Impact

This vulnerability allows a remote attacker to cause a denial of service or even arbitrary code execution on an affected gpac MP4Box. Exploiting this vulnerability requires user interaction, as the target must access a malicious page or open a malicious file.
Occurrences

xml_parser.c L1658

```

heap-use-after-free
This is a GitHub Issue
repo:gpac
owner:gpac
Title : heap-use-after-free
Issue date:

--- start body ---
Reproduce

./MP4Box -dash 10000 poc

POC File

https://github.com/gandalf4a/crash_report/blob/main/gpac/MP4Box/poc2/huaf_1658


```
Description

heap-use-after-free in MP4Box
Version

$ ./MP4Box -version
MP4Box - GPAC version 2.3-DEV-rev566-g50c2ab06f-master

Platform

$ uname -a
Linux user-GE40-2PC-Dragon-Eyes 6.2.0-33-generic #33~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep  7 10:33:52 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

Asan

[33m[TTML EBU-TTD] time indicates frames but no frame rate set, assuming 25 FPS
[0m[31m[TTML EBU-TTD] invalid timings: "begin"=24680 , "end"=23320. Abort.
[0m[32m[Dasher] No template assigned, using $File$_dash$FS$$Number$
[0m[32m[Dasher] No bitrate property assigned to PID id000310sig06src000702time203216797execs1924021ophavocrep2, computing from bitstream
[0m[31m[TTML EBU-TTD] duplicated "begin" attribute. Abort.
[0m=================================================================
==734465==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000000868 at pc 0x7fa699af74f8 bp 0x7ffe98c75570 sp 0x7ffe98c75568
READ of size 8 at 0x604000000868 thread T0
    #0 0x7fa699af74f7 in gf_xml_dom_node_reset /home/user/fuzzing_gpac/gpac/src/utils/xml_parser.c:1658:12
    #1 0x7fa699af7547 in gf_xml_dom_node_del /home/user/fuzzing_gpac/gpac/src/utils/xml_parser.c:1681:2
    #2 0x7fa699af7410 in gf_xml_dom_node_reset /home/user/fuzzing_gpac/gpac/src/utils/xml_parser.c:1672:4
    #3 0x7fa699af7547 in gf_xml_dom_node_del /home/user/fuzzing_gpac/gpac/src/utils/xml_parser.c:1681:2
    #4 0x7fa699af7410 in gf_xml_dom_node_reset /home/user/fuzzing_gpac/gpac/src/utils/xml_parser.c:1672:4
    #5 0x7fa699af7547 in gf_xml_dom_node_del /home/user/fuzzing_gpac/gpac/src/utils/xml_parser.c:1681:2
    #6 0x7fa699af7410 in gf_xml_dom_node_reset /home/user/fuzzing_gpac/gpac/src/utils/xml_parser.c:1672:4
    #7 0x7fa699af7547 in gf_xml_dom_node_del /home/user/fuzzing_gpac/gpac/src/utils/xml_parser.c:1681:2
    #8 0x7fa699af7b20 in gf_xml_dom_reset /home/user/fuzzing_gpac/gpac/src/utils/xml_parser.c:1814:4
    #9 0x7fa699af77d3 in gf_xml_dom_del /home/user/fuzzing_gpac/gpac/src/utils/xml_parser.c:1826:2
    #10 0x7fa69ac9ffad in ttxtin_reset /home/user/fuzzing_gpac/gpac/src/filters/load_text.c:4044:32
    #11 0x7fa69ac9ffad in txtin_finalize /home/user/fuzzing_gpac/gpac/src/filters/load_text.c:4293:2
    #12 0x7fa69a96eb6c in gf_fs_del /home/user/fuzzing_gpac/gpac/src/filter_core/filter_session.c:773:6
    #13 0x7fa69a2283f6 in gf_dasher_clean_inputs /home/user/fuzzing_gpac/gpac/src/media_tools/dash_segmenter.c:164:3
    #14 0x7fa69a2283f6 in gf_dasher_del /home/user/fuzzing_gpac/gpac/src/media_tools/dash_segmenter.c:173:2
    #15 0x563912e69d2d in do_dash /home/user/fuzzing_gpac/gpac/applications/mp4box/mp4box.c:4894:2
    #16 0x563912e5ab6e in mp4box_main /home/user/fuzzing_gpac/gpac/applications/mp4box/mp4box.c:6245:7
    #17 0x7fa699229d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #18 0x7fa699229e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #19 0x563912d82dd4 in _start (/home/user/fuzzing_gpac/gpac/bin/gcc/MP4Box+0x82dd4) (BuildId: 53333ca7bff59dd9a3d1b2821e7c5f3a9aac76b9)

0x604000000868 is located 24 bytes inside of 48-byte region [0x604000000850,0x604000000880)
freed by thread T0 here:
    #0 0x563912e05972 in free (/home/user/fuzzing_gpac/gpac/bin/gcc/MP4Box+0x105972) (BuildId: 53333ca7bff59dd9a3d1b2821e7c5f3a9aac76b9)
    #1 0x7fa699af7410 in gf_xml_dom_node_reset /home/user/fuzzing_gpac/gpac/src/utils/xml_parser.c:1672:4

previously allocated by thread T0 here:
    #0 0x563912e05c1e in malloc (/home/user/fuzzing_gpac/gpac/bin/gcc/MP4Box+0x105c1e) (BuildId: 53333ca7bff59dd9a3d1b2821e7c5f3a9aac76b9)
    #1 0x7fa699af80fc in on_dom_node_start /home/user/fuzzing_gpac/gpac/src/utils/xml_parser.c:1702:2

SUMMARY: AddressSanitizer: heap-use-after-free /home/user/fuzzing_gpac/gpac/src/utils/xml_parser.c:1658:12 in gf_xml_dom_node_reset
Shadow bytes around the buggy address:
  0x0c087fff80b0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c087fff80c0: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x0c087fff80d0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd
  0x0c087fff80e0: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x0c087fff80f0: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
=>0x0c087fff8100: fa fa fd fd fd fd fd fd fa fa fd fd fd[fd]fd fd
  0x0c087fff8110: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x0c087fff8120: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x0c087fff8130: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x0c087fff8140: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x0c087fff8150: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==734465==ABORTING

Reproduce

./MP4Box -dash 10000 poc

POC File

https://github.com/gandalf4a/crash_report/blob/main/gpac/MP4Box/poc2/huaf_1658
Credit

Gandalf4a

Impact

This vulnerability allows a remote attacker to cause a denial of service or even arbitrary code execution on an affected gpac MP4Box. Exploiting this vulnerability requires user interaction, as the target must access a malicious page or open a malicious file.
Occurrences

xml_parser.c L1658

```

--- end body ---

A heap-use-after-free vulnerability in MP4Box (GPAC version 2.3-DEV-rev566-g50c2ab06f-master) allows attackers to cause a Denial of Service (DoS) or potentially execute arbitrary code. This occurs when the application attempts to access memory that has already been freed, leading to unpredictable behavior. The issue can be triggered by processing a specially crafted MP4 file, as demonstrated in the provided proof of concept (PoC).