Gửi #941004: GPAC GPAC MP4Box GPAC 26.08-DEV / master commit 49dee5cad329cfed310c1682703df7daa47df31a: Heap Use-After-Free / Invalid Pointer Dereference

Affected Versions
GPAC 26.08-DEV / master commit 49dee5cad329cfed310c1682703df7daa47df31a: reproduced with AddressSanitizer.
No formal release binary was rerun as part of this submission material.
The issue was fixed by commit e34f4ba349d55cd1849f0bcf4cf46552732e2db7. No later formal release is identified as the fixed release without separate verification.
Classification
Attack type: Local
Attack complexity: Low
Privileges required: None
User interaction: Required
Exploit availability: Public proof-of-concept
Proven impact: Application crash and loss of availability
Suggested severity: Medium
CVSS 3.1 score: 5.5
CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Technical Description
GPAC MP4Box is affected by an invalid command-node reference while destroying an input containing a malicious BIFS/LASeR scene. gf_sg_command_del at src/scenegraph/commands.c:66 accesses a node referenced by a command during scene graph teardown. The public ASan trace shows a READ access to a zero-page address such as 0x455, causing SEGV.

In a supplemental gcc ASan reproduction on the same 49dee5ca revision, the same gf_sg_command_del frame is reported as a heap-use-after-free: the command node was already released before gf_sg_command_del read it.

The teardown path is:

gf_svg_node_del / gf_sg_mpeg4_node_del
-> gf_node_del
-> gf_node_unregister
-> gf_node_unregister_children
-> gf_sg_parent_reset
-> gf_sg_command_del

No confidentiality loss, integrity impact, or code execution has been demonstrated.

Proof of Concept
PoC archive: poc_10.zip
PoC URL: https://github.com/user-attachments/files/30635904/poc_10.zip

Command:

MP4Box -bt poc_10

Observed sanitizer result:

AddressSanitizer:DEADLYSIGNAL
ERROR: AddressSanitizer: SEGV on unknown address 0x000000000455
The signal is caused by a READ memory access.
Hint: address points to the zero page.
#0 gf_sg_command_del src/scenegraph/commands.c:66:43
SUMMARY: AddressSanitizer: SEGV src/scenegraph/commands.c:66:43 in gf_sg_command_del

Supplemental gcc ASan result on 49dee5ca:

ERROR: AddressSanitizer: heap-use-after-free
READ of size 8
#0 gf_sg_command_del src/scenegraph/commands.c:66
SUMMARY: AddressSanitizer: heap-use-after-free scenegraph/commands.c:66 in gf_sg_command_del

Root Cause
The LASeR/BIFS command handling path can retain a command node reference that is released before scene graph teardown. gf_sg_command_del later dereferences the stale node pointer while walking command destruction, producing either a zero-page SEGV or an ASan-detected use-after-free depending on sanitizer behavior.

Countermeasure
Upgrade to a GPAC build containing commit e34f4ba349d55cd1849f0bcf4cf46552732e2db7:

https://github.com/gpac/gpac/commit/e34f4ba349d55cd1849f0bcf4cf46552732e2db7

The patch replaces direct com->node assignments in LASeR decoding with gf_sg_command_set_node() and adjusts related command cleanup ordering. Environments that cannot upgrade should avoid processing untrusted BIFS/LASeR scenes, run MP4Box in a sandbox, and isolate crashes with timeouts.

References
Advisory/report: https://github.com/gpac/gpac/issues/3830
Fix: https://github.com/gpac/gpac/commit/e34f4ba349d55cd1849f0bcf4cf46552732e2db7
PoC: https://github.com/user-attachments/files/30635904/poc_10.zip

• Nguồn: ⚠️ https://github.com/gpac/gpac/issues/3830
• Người dùng: fczhang (UID 97720)
• Đệ trình: 20/08/2026 18:25 (cách đây 27 ngày)
• Kiểm duyệt: 16/09/2026 14:15 (27 days later)
• Trạng thái: được chấp nhận
• Mục VulDB: 405732 [GPAC 26.08-DEV BIFS commands.c gf_sg_command_del tràn bộ đệm]
• điểm: 20