Product: GPAC (MP4Box)
Affected: gpac/gpac prior to fix commit (see References)
CVE: CVE-2025-60477
CWE: CWE-476 (NULL Pointer Dereference)
CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Reporter: sigdevel <https://infosec.exchange/@sigdevel>
Description:
The gf_filter_pid_resolve_file_template_ex function in
filter_core/filter_pid.c
is responsible for resolving output file name templates during DASH
segmentation
in MP4Box. When input file metadata contains excessively long URLs or
HTML-like
special characters, the function reaches a strncmp() call at line 9045 without
first verifying that one of its pointer arguments is non-NULL.
The NULL pointer is passed directly to strncmp(), causing a READ dereference
at
address 0x000000000000, which terminates the process immediately. No arbitrary
code execution was observed; the impact is limited to Denial of Service.
Crash is reproducible on the current master branch at the time of
discovery. No authentication or special privileges required beyond
ability to provide a crafted file.
Reproduction:
-Build-opts: --static-build --static-bin --static-modules --enable-debug
--extra-cflags="-g -O0" ;
-Command: ./MP4Box -dash 100
48_gf_filter_pid_resolve_file_template_ex_filter_core_filter_pid_c_9045
Asan-log:
==55159==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc
0x7f665c8c1cf0 bp 0x7fff48a84ca0 sp 0x7fff48a84430 T0)
==55159==The signal is caused by a READ memory access.
#0 0x7f665c8c1cf0 in strncmp
../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:491
#1 0x7f665b891e64 in gf_filter_pid_resolve_file_template_ex
filter_core/filter_pid.c:9045
#2 0x7f665b965c1e in dasher_setup_sources filters/dasher.c:4234
Fix:
Update to a GPAC v26.07.0:
https://github.com/gpac/gpac/releases/tag/v26.07.0
PoC:
https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/48/48_gf_filter_pid_resolve_file_template_ex_filter_core_filter_pid_c_9045
References:
https://github.com/gpac/gpac/issues/3301
https://nvd.nist.gov/vuln/detail/CVE-2025-60477
https://infosec.exchange/@sigdevel/116658486442433074
——
Best regards, Alexander A. Shvedov
@sigdevel
