**Description**

A NULL pointer dereference vulnerability  in `gf_isom_parse_movie_boxes_internal` function (`isomedia/isom_intern.c:392`) due to a missing check before using the pointer.

**Version**

```bash
MP4Box -version      

MP4Box - GPAC version 2.1-DEV-rev79-gdf29bc8a0-master
(c) 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
        GPAC Filters: https://doi.org/10.1145/3339825.3394929
        GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --enable-sanitizer
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SSL GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D
```
**POC**

```bash
MP4Box -zmov poc 
```

**URL:** https://www.mediafire.com/file/z6v36ozs8lvtzll/poc/file



**ASAN**

```bash
$ MP4Box -zmov ../poc
[iso file] Box 0000 size 808464432 is larger than remaining parent size 11439
[iso file] Read Box type esds (0x65736473) at position 0 has size 0 but is not at root/file level. Forbidden, skipping end of parent box !
[iso file] Read Box "mp4a" (start 20) failed (Unknown Error (10)) - skipping
AddressSanitizer:DEADLYSIGNAL
=================================================================
==19277==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fcb9e84f09c bp 0x7fff1524d410 sp 0x7fff1524d360 T0)
==19277==The signal is caused by a READ memory access.
==19277==Hint: address points to the zero page.
    #0 0x7fcb9e84f09c in gf_isom_parse_movie_boxes_internal isomedia/isom_intern.c:392
    #1 0x7fcb9e850ad5 in gf_isom_parse_movie_boxes isomedia/isom_intern.c:859
    #2 0x7fcb9e850e54 in gf_isom_open_file isomedia/isom_intern.c:979
    #3 0x7fcb9e853b77 in gf_isom_open isomedia/isom_read.c:520
    #4 0x55e0f156ddb7 in mp4boxMain /home/kali/temp/gpac/applications/mp4box/main.c:5970
    #5 0x55e0f15704dc in main /home/kali/temp/gpac/applications/mp4box/main.c:6587
    #6 0x7fcb9e3fb7ec in __libc_start_main ../csu/libc-start.c:332
    #7 0x55e0f155bab9 in _start (/home/kali/temp/gpac/bin/gcc/MP4Box+0x16ab9)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV isomedia/isom_intern.c:392 in gf_isom_parse_movie_boxes_internal
==19277==ABORTING
```
**Analysis**

```bash
────────────────────────────────────────────────────────────────────────[ REGISTERS ]────────────────────────────────────────────────────────────────────────
 RAX  0x0             
 RBX  0x5555555a5c90 (__libc_csu_init) ◂— push   r15 
 RCX  0xc00
 RDX  0x0
 RIP  0x7ffff78639cd (gf_isom_parse_movie_boxes_internal+653) ◂— mov    eax, dword ptr [rax]

─────────────────────────────────────────────────────────────────────────[ DISASM ]──────────────────────────────────────────────────────────────────────────
 ► 0x7ffff78639cd <gf_isom_parse_movie_boxes_internal+653>     mov    eax, dword ptr [rax]    
   0x7ffff78639cf <gf_isom_parse_movie_boxes_internal+655>     cmp    eax, 0x73747970
   0x7ffff78639d4 <gf_isom_parse_movie_boxes_internal+660>     je     gf_isom_parse_movie_boxes_internal+3452                <gf_isom_parse_movie_boxes_internal+3452>                                                                                                                                                                                              
 ──────────────────────────────────────────────────────────────────────[ SOURCE (CODE) ]──────────────────────────────────────────────────────────────────────
In file: /root/fuzzing/gpac/src/isomedia/isom_intern.c
   387                  return e;
   388          } else {
   389                  return e;
   390          }
   391 
 ► 392          switch (a->type) {
   393          /*MOOV box*/
   394          case GF_ISOM_BOX_TYPE_MOOV:
   395                  if (mov->moov) {
   396                          GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[iso file] Duplicate MOOV detected!\n"));
   397                          gf_isom_box_del(a);
```

It tries to read the `type` member from `a` struct while `a` struct is equall `NULL`.

**Backtrace**

```bash
pwndbg> bt
#0  0x00007ffff78639cd in gf_isom_parse_movie_boxes_internal (mov=0x5555555cd2a0, boxType=0x0, bytesMissing=0x7fffffffa6c8, progressive_mode=GF_FALSE) at isomedia/isom_intern.c:392                                                                                                                                      
#1  0x00007ffff7865407 in gf_isom_parse_movie_boxes (mov=0x5555555cd2a0, boxType=0x0, bytesMissing=0x7fffffffa6c8, progressive_mode=GF_FALSE) at isomedia/isom_intern.c:859                                                                                                                                               
#2  0x00007ffff7865786 in gf_isom_open_file (fileName=0x7fffffffe408 "./gpac_fuzzing/afl_out/master/crashes/id:000000,sig:11,src:000568,time:4829100,execs:923919,op:havoc,rep:4", OpenMode=GF_ISOM_OPEN_EDIT, tmp_dir=0x0) at isomedia/isom_intern.c:979
#3  0x00007ffff78684a9 in gf_isom_open (fileName=0x7fffffffe408 "./gpac_fuzzing/afl_out/master/crashes/id:000000,sig:11,src:000568,time:4829100,execs:923919,op:havoc,rep:4", OpenMode=GF_ISOM_OPEN_EDIT, tmp_dir=0x0) at isomedia/isom_read.c:520
#4  0x000055555557cdb8 in mp4boxMain (argc=3, argv=0x7fffffffe0a8) at main.c:5970
#5  0x000055555557f4dd in main (argc=3, argv=0x7fffffffe0a8) at main.c:6587
#6  0x00007ffff73e47fd in __libc_start_main (main=0x55555557f4bd <main>, argc=3, argv=0x7fffffffe0a8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe098) at ../csu/libc-start.c:332
#7  0x000055555556aaba in _start ()
```
**Mitigation**

Check if `a` struct is not equall to `NULL` before the switch statment.




NULL Pointer Dereference in gf_isom_parse_movie_boxes_internal
This is a GitHub Issue
repo:gpac
owner:gpac
Title : NULL Pointer Dereference in gf_isom_parse_movie_boxes_internal
Issue date:

--- start body ---
**Description**

A NULL pointer dereference vulnerability  in `gf_isom_parse_movie_boxes_internal` function (`isomedia/isom_intern.c:392`) due to a missing check before using the pointer.

**Version**

```bash
MP4Box -version      

MP4Box - GPAC version 2.1-DEV-rev79-gdf29bc8a0-master
(c) 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
        GPAC Filters: https://doi.org/10.1145/3339825.3394929
        GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --enable-sanitizer
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SSL GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D
```
**POC**

```bash
MP4Box -zmov poc 
```

**URL:** https://www.mediafire.com/file/z6v36ozs8lvtzll/poc/file



**ASAN**

```bash
$ MP4Box -zmov ../poc
[iso file] Box 0000 size 808464432 is larger than remaining parent size 11439
[iso file] Read Box type esds (0x65736473) at position 0 has size 0 but is not at root/file level. Forbidden, skipping end of parent box !
[iso file] Read Box "mp4a" (start 20) failed (Unknown Error (10)) - skipping
AddressSanitizer:DEADLYSIGNAL
=================================================================
==19277==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fcb9e84f09c bp 0x7fff1524d410 sp 0x7fff1524d360 T0)
==19277==The signal is caused by a READ memory access.
==19277==Hint: address points to the zero page.
    #0 0x7fcb9e84f09c in gf_isom_parse_movie_boxes_internal isomedia/isom_intern.c:392
    #1 0x7fcb9e850ad5 in gf_isom_parse_movie_boxes isomedia/isom_intern.c:859
    #2 0x7fcb9e850e54 in gf_isom_open_file isomedia/isom_intern.c:979
    #3 0x7fcb9e853b77 in gf_isom_open isomedia/isom_read.c:520
    #4 0x55e0f156ddb7 in mp4boxMain /home/kali/temp/gpac/applications/mp4box/main.c:5970
    #5 0x55e0f15704dc in main /home/kali/temp/gpac/applications/mp4box/main.c:6587
    #6 0x7fcb9e3fb7ec in __libc_start_main ../csu/libc-start.c:332
    #7 0x55e0f155bab9 in _start (/home/kali/temp/gpac/bin/gcc/MP4Box+0x16ab9)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV isomedia/isom_intern.c:392 in gf_isom_parse_movie_boxes_internal
==19277==ABORTING
```
**Analysis**

```bash
────────────────────────────────────────────────────────────────────────[ REGISTERS ]────────────────────────────────────────────────────────────────────────
 RAX  0x0             
 RBX  0x5555555a5c90 (__libc_csu_init) ◂— push   r15 
 RCX  0xc00
 RDX  0x0
 RIP  0x7ffff78639cd (gf_isom_parse_movie_boxes_internal+653) ◂— mov    eax, dword ptr [rax]

─────────────────────────────────────────────────────────────────────────[ DISASM ]──────────────────────────────────────────────────────────────────────────
 ► 0x7ffff78639cd <gf_isom_parse_movie_boxes_internal+653>     mov    eax, dword ptr [rax]    
   0x7ffff78639cf <gf_isom_parse_movie_boxes_internal+655>     cmp    eax, 0x73747970
   0x7ffff78639d4 <gf_isom_parse_movie_boxes_internal+660>     je     gf_isom_parse_movie_boxes_internal+3452                <gf_isom_parse_movie_boxes_internal+3452>                                                                                                                                                                                              
 ──────────────────────────────────────────────────────────────────────[ SOURCE (CODE) ]──────────────────────────────────────────────────────────────────────
In file: /root/fuzzing/gpac/src/isomedia/isom_intern.c
   387                  return e;
   388          } else {
   389                  return e;
   390          }
   391 
 ► 392          switch (a->type) {
   393          /*MOOV box*/
   394          case GF_ISOM_BOX_TYPE_MOOV:
   395                  if (mov->moov) {
   396                          GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[iso file] Duplicate MOOV detected!\n"));
   397                          gf_isom_box_del(a);
```

It tries to read the `type` member from `a` struct while `a` struct is equall `NULL`.

**Backtrace**

```bash
pwndbg> bt
#0  0x00007ffff78639cd in gf_isom_parse_movie_boxes_internal (mov=0x5555555cd2a0, boxType=0x0, bytesMissing=0x7fffffffa6c8, progressive_mode=GF_FALSE) at isomedia/isom_intern.c:392                                                                                                                                      
#1  0x00007ffff7865407 in gf_isom_parse_movie_boxes (mov=0x5555555cd2a0, boxType=0x0, bytesMissing=0x7fffffffa6c8, progressive_mode=GF_FALSE) at isomedia/isom_intern.c:859                                                                                                                                               
#2  0x00007ffff7865786 in gf_isom_open_file (fileName=0x7fffffffe408 "./gpac_fuzzing/afl_out/master/crashes/id:000000,sig:11,src:000568,time:4829100,execs:923919,op:havoc,rep:4", OpenMode=GF_ISOM_OPEN_EDIT, tmp_dir=0x0) at isomedia/isom_intern.c:979
#3  0x00007ffff78684a9 in gf_isom_open (fileName=0x7fffffffe408 "./gpac_fuzzing/afl_out/master/crashes/id:000000,sig:11,src:000568,time:4829100,execs:923919,op:havoc,rep:4", OpenMode=GF_ISOM_OPEN_EDIT, tmp_dir=0x0) at isomedia/isom_read.c:520
#4  0x000055555557cdb8 in mp4boxMain (argc=3, argv=0x7fffffffe0a8) at main.c:5970
#5  0x000055555557f4dd in main (argc=3, argv=0x7fffffffe0a8) at main.c:6587
#6  0x00007ffff73e47fd in __libc_start_main (main=0x55555557f4bd <main>, argc=3, argv=0x7fffffffe0a8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe098) at ../csu/libc-start.c:332
#7  0x000055555556aaba in _start ()
```
**Mitigation**

Check if `a` struct is not equall to `NULL` before the switch statment.




--- end body ---

A NULL pointer dereference vulnerability in the `gf_isom_parse_movie_boxes_internal` function of GPAC version 2.1-DEV allows attackers to cause a crash by providing a specially crafted input file. The vulnerability occurs due to a missing check for a NULL pointer before accessing its members, leading to a segmentation fault when the function attempts to read the `type` member from a NULL struct.