Product: GPAC (MP4Box)
Affected: gpac/gpac prior to fix commit
(4bbb6e5f7cb827e56f32b2f7a5918b0b8e395eb8)
CVE: CVE-2025-55653
CWE: CWE-369 (Divide by Zero)
CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Reporter: @sigdevel (Alexander Shvedov) <https://infosec.exchange/@sigdevel>
Description:
When MP4Box imports a crafted MP4 file containing an invalid fractional
value with a zero denominator in its metadata, the gf_parse_lfrac()
function in utils/error.c performs division at line 2290 without
validating that the divisor is non-zero. The zero denominator is
supplied to gf_parse_lfrac() via filelist_next_url() during file list
processing, triggering a SIGFPE (floating-point exception) that
immediately terminates the process with no possibility of recovery.
AddressSanitizer reports an FPE on unknown address at
utils/error.c:2290, reached via filelist_next_url() /
filelist_load_next() / filelist_process() while MP4Box imports the
crafted track.
Crash is reproducible on the current master branch at the time of
discovery. No authentication or special privileges required beyond
ability to provide a crafted file.
Reproduction:
-Build-opts: CC="gcc -fsanitize=address -g" CXX="g++ -fsanitize=address -g" ;
-Command: ./MP4Box -add 21_poc.mp4 -new /dev/null
Asan-log:
AddressSanitizer:DEADLYSIGNAL
==2271001==ERROR: AddressSanitizer: FPE on unknown address 0x7fda0295e0a9 (pc
0x7fda0295e0a9 bp 0x7fd9ffb06e40 sp 0x7ffde8bd1ce0 T0)
#0 0x7fda0295e0a9 in gf_parse_lfrac utils/error.c:2290
#1 0x7fda03674ce1 in filelist_next_url filters/filelist.c:1029
#2 0x7fda03675521 in filelist_load_next filters/filelist.c:1225
#3 0x7fda03684257 in filelist_process filters/filelist.c:2011
#4 0x7fda034ed4b1 in gf_filter_process_task filter_core/filter.c:3179
#5 0x7fda034c0a05 in gf_fs_thread_proc filter_core/filter_session.c:2420
#6 0x7fda034c5c64 in gf_fs_run filter_core/filter_session.c:2727
#7 0x7fda02fa8e1d in gf_media_import media_tools/media_import.c:1601
#8 0x55f8f6205be6 in import_file applications/mp4box/fileimport.c:1693
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE utils/error.c:2290 in gf_parse_lfrac
PoC:
https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/21/21_poc.mp4
References:
https://github.com/gpac/gpac/issues/3247
https://www.cve.org/CVERecord?id=CVE-2025-55653
https://infosec.exchange/@sigdevel/116769079013422405
——
Best regards, Alexander A. Shvedov
@sigdevel
