# Version
```
$ ./MP4Box -version
MP4Box - GPAC version 2.3-DEV-rev566-g50c2ab06f-master
```

# Platform
```
$ uname -a
Linux user-GE40-2PC-Dragon-Eyes 6.2.0-33-generic #33~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep  7 10:33:52 UTC 2 x86_64 x86_64 x86_64 GNU/Linux
```

# Asan
```
/home/user/vul/MP4Box_crash/id000042sig11src000947time28982876execs269374ophavocrep2
[32m[DASH] Updated manifest:
[0m[32m        P#1: start 0 - duration 0 - xlink none
[0m[32m[DASH] Manifest after update:
[0m[32m        P#1: start 0 - duration 0 - xlink none
[0m[32m[DASH] Setting up period start 0 duration 0 xlink none ID DID1
[0m[32m[DASH] AS#1 changed quality to bitrate 10 kbps - Width 1280 Height 720 FPS 30/1 (playback speed 1)
[0m[32m[DASH] AS#2 changed quality to bitrate 120 kbps - Width 384 Height 256 FPS 30/1 (playback speed 1)
[0m[32m[DASH] AS#3 changed quality to bitrate 120 kbps - Width 448 Height 256 FPS 30/1 (playback speed 1)
[0m[32m[DASH] AS#4 changed quality to bitrate 120 kbps - Width 448 Height 256 FPS 30/1 (playback speed 1)
[0m[32m[DASH] AS#5 changed quality to bitrate 120 kbps - Width 384 Height 256 FPS 30/1 (playback speed 1)
[0m[32m[DASH] AS#6 changed quality to bitrate 120 kbps - Width 448 Height 256 FPS 30/1 (playback speed 1)
[0m[32m[DASH] AS#7 changed quality to bitrate 120 kbps - Width 448 Height 256 FPS 30/1 (playback speed 1)
[0m[32m[DASH] AS#8 changed quality to bitrate 120 kbps - Width 384 Height 208 FPS 30/1 (playback speed 1)
[0mAddressSanitizer:DEADLYSIGNAL
=================================================================
==827840==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x5592577198f0 bp 0x7fff973c98f0 sp 0x7fff973c90a0 T0)
==827840==The signal is caused by a READ memory access.
==827840==Hint: address points to the zero page.
    #0 0x5592577198f0 in strcmp (/home/user/fuzzing_gpac/gpac/bin/gcc/MP4Box+0x998f0) (BuildId: 53333ca7bff59dd9a3d1b2821e7c5f3a9aac76b9)
    #1 0x7fc88d7a4fec in gf_dash_setup_period /home/user/fuzzing_gpac/gpac/src/media_tools/dash_client.c:6384:9
    #2 0x7fc88d75886f in dash_setup_period_and_groups /home/user/fuzzing_gpac/gpac/src/media_tools/dash_client.c:7686:7
    #3 0x7fc88d75886f in gf_dash_process_internal /home/user/fuzzing_gpac/gpac/src/media_tools/dash_client.c:8018:7
    #4 0x7fc88d75886f in gf_dash_process /home/user/fuzzing_gpac/gpac/src/media_tools/dash_client.c:8089:9
    #5 0x7fc88dee2e03 in dashdmx_process /home/user/fuzzing_gpac/gpac/src/filters/dmx_dash.c:3192:6
    #6 0x7fc88ddafa33 in gf_filter_process_task /home/user/fuzzing_gpac/gpac/src/filter_core/filter.c:2971:7
    #7 0x7fc88dd7d47b in gf_fs_thread_proc /home/user/fuzzing_gpac/gpac/src/filter_core/filter_session.c:2105:3
    #8 0x7fc88dd7b5cf in gf_fs_run /home/user/fuzzing_gpac/gpac/src/filter_core/filter_session.c:2405:3
    #9 0x7fc88d62ac6a in gf_dasher_process /home/user/fuzzing_gpac/gpac/src/media_tools/dash_segmenter.c:1236:6
    #10 0x5592577e96dc in do_dash /home/user/fuzzing_gpac/gpac/applications/mp4box/mp4box.c:4831:15
    #11 0x5592577dab6e in mp4box_main /home/user/fuzzing_gpac/gpac/applications/mp4box/mp4box.c:6245:7
    #12 0x7fc88c629d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #13 0x7fc88c629e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #14 0x559257702dd4 in _start (/home/user/fuzzing_gpac/gpac/bin/gcc/MP4Box+0x82dd4) (BuildId: 53333ca7bff59dd9a3d1b2821e7c5f3a9aac76b9)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/home/user/fuzzing_gpac/gpac/bin/gcc/MP4Box+0x998f0) (BuildId: 53333ca7bff59dd9a3d1b2821e7c5f3a9aac76b9) in strcmp
==827840==ABORTING
```

# Reproduce
```
./MP4Box -dash 10000 poc
```
 
# POC File
https://github.com/gandalf4a/crash_report/blob/main/gpac/MP4Box/segv_998f0

# Credit
```
Gandalf4a
```
SEGV in gf_dash_setup_period /gpac/src/media_tools/dash_client.c:6384:9
This is a GitHub Issue
repo:gpac
owner:gpac
Title : SEGV in gf_dash_setup_period /gpac/src/media_tools/dash_client.c:6384:9
Issue date:

--- start body ---
# Version
```
$ ./MP4Box -version
MP4Box - GPAC version 2.3-DEV-rev566-g50c2ab06f-master
```

# Platform
```
$ uname -a
Linux user-GE40-2PC-Dragon-Eyes 6.2.0-33-generic #33~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep  7 10:33:52 UTC 2 x86_64 x86_64 x86_64 GNU/Linux
```

# Asan
```
/home/user/vul/MP4Box_crash/id000042sig11src000947time28982876execs269374ophavocrep2
[32m[DASH] Updated manifest:
[0m[32m        P#1: start 0 - duration 0 - xlink none
[0m[32m[DASH] Manifest after update:
[0m[32m        P#1: start 0 - duration 0 - xlink none
[0m[32m[DASH] Setting up period start 0 duration 0 xlink none ID DID1
[0m[32m[DASH] AS#1 changed quality to bitrate 10 kbps - Width 1280 Height 720 FPS 30/1 (playback speed 1)
[0m[32m[DASH] AS#2 changed quality to bitrate 120 kbps - Width 384 Height 256 FPS 30/1 (playback speed 1)
[0m[32m[DASH] AS#3 changed quality to bitrate 120 kbps - Width 448 Height 256 FPS 30/1 (playback speed 1)
[0m[32m[DASH] AS#4 changed quality to bitrate 120 kbps - Width 448 Height 256 FPS 30/1 (playback speed 1)
[0m[32m[DASH] AS#5 changed quality to bitrate 120 kbps - Width 384 Height 256 FPS 30/1 (playback speed 1)
[0m[32m[DASH] AS#6 changed quality to bitrate 120 kbps - Width 448 Height 256 FPS 30/1 (playback speed 1)
[0m[32m[DASH] AS#7 changed quality to bitrate 120 kbps - Width 448 Height 256 FPS 30/1 (playback speed 1)
[0m[32m[DASH] AS#8 changed quality to bitrate 120 kbps - Width 384 Height 208 FPS 30/1 (playback speed 1)
[0mAddressSanitizer:DEADLYSIGNAL
=================================================================
==827840==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x5592577198f0 bp 0x7fff973c98f0 sp 0x7fff973c90a0 T0)
==827840==The signal is caused by a READ memory access.
==827840==Hint: address points to the zero page.
    #0 0x5592577198f0 in strcmp (/home/user/fuzzing_gpac/gpac/bin/gcc/MP4Box+0x998f0) (BuildId: 53333ca7bff59dd9a3d1b2821e7c5f3a9aac76b9)
    #1 0x7fc88d7a4fec in gf_dash_setup_period /home/user/fuzzing_gpac/gpac/src/media_tools/dash_client.c:6384:9
    #2 0x7fc88d75886f in dash_setup_period_and_groups /home/user/fuzzing_gpac/gpac/src/media_tools/dash_client.c:7686:7
    #3 0x7fc88d75886f in gf_dash_process_internal /home/user/fuzzing_gpac/gpac/src/media_tools/dash_client.c:8018:7
    #4 0x7fc88d75886f in gf_dash_process /home/user/fuzzing_gpac/gpac/src/media_tools/dash_client.c:8089:9
    #5 0x7fc88dee2e03 in dashdmx_process /home/user/fuzzing_gpac/gpac/src/filters/dmx_dash.c:3192:6
    #6 0x7fc88ddafa33 in gf_filter_process_task /home/user/fuzzing_gpac/gpac/src/filter_core/filter.c:2971:7
    #7 0x7fc88dd7d47b in gf_fs_thread_proc /home/user/fuzzing_gpac/gpac/src/filter_core/filter_session.c:2105:3
    #8 0x7fc88dd7b5cf in gf_fs_run /home/user/fuzzing_gpac/gpac/src/filter_core/filter_session.c:2405:3
    #9 0x7fc88d62ac6a in gf_dasher_process /home/user/fuzzing_gpac/gpac/src/media_tools/dash_segmenter.c:1236:6
    #10 0x5592577e96dc in do_dash /home/user/fuzzing_gpac/gpac/applications/mp4box/mp4box.c:4831:15
    #11 0x5592577dab6e in mp4box_main /home/user/fuzzing_gpac/gpac/applications/mp4box/mp4box.c:6245:7
    #12 0x7fc88c629d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #13 0x7fc88c629e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #14 0x559257702dd4 in _start (/home/user/fuzzing_gpac/gpac/bin/gcc/MP4Box+0x82dd4) (BuildId: 53333ca7bff59dd9a3d1b2821e7c5f3a9aac76b9)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/home/user/fuzzing_gpac/gpac/bin/gcc/MP4Box+0x998f0) (BuildId: 53333ca7bff59dd9a3d1b2821e7c5f3a9aac76b9) in strcmp
==827840==ABORTING
```

# Reproduce
```
./MP4Box -dash 10000 poc
```
 
# POC File
https://github.com/gandalf4a/crash_report/blob/main/gpac/MP4Box/segv_998f0

# Credit
```
Gandalf4a
```
--- end body ---

A segmentation fault (SEGV) in the gf_dash_setup_period function of GPAC version 2.3-DEV can be exploited by providing a specially crafted DASH manifest file, leading to a potential Denial of Service (DoS). The crash occurs due to a null pointer dereference when the function attempts to read memory, which can be triggered by malformed input.