제출 #941003: GPAC GPAC MP4Box GPAC 26.08-DEV / master commit 49dee5cad329cfed310c1682703df7daa47df31a: Heap Use-After-Free via Uncontrolled Recursion

Affected Versions
GPAC 26.08-DEV / master commit 49dee5cad329cfed310c1682703df7daa47df31a: reproduced with AddressSanitizer.
No formal release binary was rerun as part of this submission material.
The issue was fixed by commit e34f4ba349d55cd1849f0bcf4cf46552732e2db7. No later formal release is identified as the fixed release without separate verification.
Classification
Attack type: Local
Attack complexity: Low
Privileges required: None
User interaction: Required
Exploit availability: Public proof-of-concept
Proven impact: Application crash and loss of availability
Suggested severity: Medium
CVSS 3.1 score: 5.5
CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Technical Description
GPAC MP4Box is affected by recursive deactivation of an untrusted embedded scene graph when run with -nstatx. The call chain is:

dump_isom_scene_stats
-> gf_sg_command_apply
-> gf_node_unregister_children_deactivate
-> gf_node_deactivate
-> gf_node_deactivate_ex

After several recursive invocations, gf_node_deactivate_ex at src/scenegraph/base_scenegraph.c:2260 dereferences an invalid node pointer. The public ASan log shows a zero-page address (0x28c, 0x284, etc.) resulting in SEGV. A supplemental gcc ASan reproduction on the same revision reports a heap-use-after-free at the same recursive frame. The vulnerable implementation continues into child traversal after a node is already deactivated.

No confidentiality loss, integrity impact, or code execution has been demonstrated.

Proof of Concept
PoC archive: poc_12.zip
PoC URL: https://github.com/user-attachments/files/30635912/poc_12.zip

Command:

MP4Box -nstatx poc_12

Observed sanitizer result:

AddressSanitizer:DEADLYSIGNAL
ERROR: AddressSanitizer: SEGV on unknown address 0x00000000028c
#0 gf_node_deactivate_ex src/scenegraph/base_scenegraph.c:2260:31
#1 gf_node_deactivate_ex src/scenegraph/base_scenegraph.c:2260:3
#2 gf_node_deactivate_ex src/scenegraph/base_scenegraph.c:2260:3
#3 gf_node_deactivate_ex src/scenegraph/base_scenegraph.c:2260:3
SUMMARY: AddressSanitizer: SEGV src/scenegraph/base_scenegraph.c:2260:31 in gf_node_deactivate_ex

Supplemental gcc ASan result on 49dee5ca:

ERROR: AddressSanitizer: heap-use-after-free
READ of size 8
#0 gf_node_deactivate_ex src/scenegraph/base_scenegraph.c:2260
#1 gf_node_deactivate_ex src/scenegraph/base_scenegraph.c:2260
SUMMARY: AddressSanitizer: heap-use-after-free scenegraph/base_scenegraph.c:2260 in gf_node_deactivate_ex

Root Cause
gf_node_deactivate_ex does not return after deactivating a node that is already marked deactivated. It continues to traverse children, so cyclic or malformed scene graphs can drive repeated recursion into child nodes that have already been released, producing either a heap-use-after-free or a zero-page dereference.

Countermeasure
Upgrade to a GPAC build containing commit e34f4ba349d55cd1849f0bcf4cf46552732e2db7:

https://github.com/gpac/gpac/commit/e34f4ba349d55cd1849f0bcf4cf46552732e2db7

The patch records whether the node was already deactivated and returns before child traversal in that case. It also detaches old children before unregistering them in command replacement paths. Environments that cannot upgrade should avoid running -nstatx on untrusted MP4 files and should run MP4Box in a sandbox with timeouts and crash isolation.

References
Advisory/report: https://github.com/gpac/gpac/issues/3831
Fix: https://github.com/gpac/gpac/commit/e34f4ba349d55cd1849f0bcf4cf46552732e2db7
PoC: https://github.com/user-attachments/files/30635912/poc_12.zip
Similar report: https://github.com/gpac/gpac/issues/3813

• 원천: ⚠️ https://github.com/gpac/gpac/issues/3831
• 사용자: fczhang (UID 97720)
• 제출: 2026. 08. 20. PM 06:24 (27 날 ago)
• 모더레이션: 2026. 09. 16. PM 02:15 (27 days later)
• 상태: 수락
• VulDB 항목: 405731 [GPAC 26.08-DEV MP4Box base_scenegraph.c gf_node_deactivate_ex 메모리 손상]
• 포인트들: 20