Product: GPAC (MP4Box)
Affected: gpac/gpac prior to fix commit (see References)
CVE: CVE-2025-60483
CWE: CWE-476 (NULL Pointer Dereference)
CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Reporter: sigdevel <https://infosec.exchange/@sigdevel>
Description:
The gf_ac4_pres_b_4_back_channels_present function in media_tools/av_parsers.c
accesses presentation substream group data using an index derived from the
AC-4
stream. When a crafted AC-4 file specifies an invalid substream group index
(e.g., group 4 that does not exist for presentation 0), the parser reaches
line 15703 without first validating the index against the available group
count.
The invalid index causes a dereference of pres->substream_groups at a 72-byte
offset from a NULL or uninitialized base pointer (READ at address
0x000000000048),
terminating the process with SIGSEGV. No evidence of arbitrary code execution
was observed; the impact is limited to Denial of Service.
Crash is reproducible on the current master branch at the time of
discovery. No authentication or special privileges required beyond
ability to provide a crafted file.
Reproduction:
-Build-opts: `--static-build --static-bin --static-modules --enable-debug
--extra-cflags="-g -O0"` ;
-Command: ./MP4Box -dash 100
49_gf_ac4_pres_b_4_back_channels_present_media_tools_av_parsers_c_15703
Asan-log:
==56315==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000048 (pc
0x7f3ff4b7f8d1 bp 0x0a100000018e sp 0x7ffcf2d7c730 T0)
==56315==The signal is caused by a READ memory access.
#0 0x7f3ff4b7f8d1 in gf_ac4_pres_b_4_back_channels_present
media_tools/av_parsers.c:15703
#1 0x7f3ff4b7f8d1 in gf_ac4_raw_frame media_tools/av_parsers.c:15999
#2 0x7f3ff4b7f8d1 in gf_ac4_parser_bs media_tools/av_parsers.c:16141
PoC:
https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/49/49_gf_ac4_pres_b_4_back_channels_present_media_tools_av_parsers_c_15703
References:
https://github.com/gpac/gpac/issues/3302
https://nvd.nist.gov/vuln/detail/CVE-2025-60483
https://www.cve.org/CVERecord?id=CVE-2025-60483
---
Best regards,
Alexander A. Shvedov
https://github.com/sigdevel
