| tiêu đề | GPAC GPAC MP4Box GPAC 26.08-DEV / master commit 49dee5cad329cfed310c1682703df7daa47df31a: Heap Use-After-Free |
|---|
| Mô tả | Affected Versions
GPAC 26.08-DEV / master commit 49dee5cad329cfed310c1682703df7daa47df31a: reproduced with AddressSanitizer.
No formal release binary was rerun as part of this submission material.
The issue was fixed by commit e34f4ba349d55cd1849f0bcf4cf46552732e2db7. No later formal release is identified as the fixed release without separate verification.
Classification
Attack type: Local
Attack complexity: Low
Privileges required: None
User interaction: Required
Exploit availability: Public proof-of-concept
Proven impact: Application crash and loss of availability
Suggested severity: Medium
CVSS 3.1 score: 5.5
CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Technical Description
GPAC MP4Box is affected by a heap use-after-free while importing or inspecting a crafted XMT scene. During proto deletion, gf_sg_command_apply reaches gf_sg_proto_del, and the MFURL field is freed through gf_sg_mfurl_del -> gf_sg_sfurl_del -> gf_free. A subsequent proto instantiation path calls gf_sg_proto_instantiate -> gf_inline_get_proto_lib, which performs strcasecmp on the freed URL string at src/compositor/mpeg4_inline.c:458.
The public ASan trace demonstrates a read of freed memory and process abort. No confidentiality loss, integrity impact, or code execution has been demonstrated.
Proof of Concept
PoC archive: poc_01.zip
PoC URL: https://github.com/user-attachments/files/30635900/poc_01.zip
Commands:
MP4Box -add poc_01 -new /tmp/o.mp4
MP4Box -info poc_01
Observed sanitizer result:
ERROR: AddressSanitizer: heap-use-after-free
READ of size 1
#0 strcasecmp
#1 gf_inline_get_proto_lib src/compositor/mpeg4_inline.c:458:56
#2 gf_sg_proto_instantiate src/scenegraph/vrml_proto.c:608:16
freed by:
#4 gf_sg_proto_del src/scenegraph/vrml_proto.c:159:2
#5 gf_sg_command_apply src/scenegraph/commands.c:221:5
SUMMARY: AddressSanitizer: heap-use-after-free in strcasecmp
Supplemental gcc ASan result on 49dee5ca:
ERROR: AddressSanitizer: heap-use-after-free
READ of size 4
#0 gf_mo_get_od_id src/compositor/media_object.c:1196
#1 gf_inline_get_proto_lib src/compositor/mpeg4_inline.c:409
SUMMARY: AddressSanitizer: heap-use-after-free compositor/media_object.c:1196 in gf_mo_get_od_id
Root Cause
The extern-proto link path retains a pointer to a URL string owned by a proto field. When gf_sg_command_apply deletes the proto, that string is released. Later proto instantiation still consults the stale link and dereferences the freed URL.
Countermeasure
Upgrade to a GPAC build containing commit e34f4ba349d55cd1849f0bcf4cf46552732e2db7:
https://github.com/gpac/gpac/commit/e34f4ba349d55cd1849f0bcf4cf46552732e2db7
The patch flushes extern-proto links before freeing protos. Environments that cannot upgrade should avoid processing untrusted XMT/BT scene files, run MP4Box in a sandbox with low privileges, and isolate crashes with timeouts and quarantine.
References
Advisory/report: https://github.com/gpac/gpac/issues/3829
Fix: https://github.com/gpac/gpac/commit/e34f4ba349d55cd1849f0bcf4cf46552732e2db7
PoC: https://github.com/user-attachments/files/30635900/poc_01.zip
Related report: https://github.com/gpac/gpac/issues/3808 |
|---|
| Nguồn | ⚠️ https://github.com/gpac/gpac/issues/3829 |
|---|
| Người dùng | fczhang (UID 97720) |
|---|
| Đệ trình | 20/08/2026 18:26 (cách đây 27 ngày) |
|---|
| Kiểm duyệt | 16/09/2026 14:15 (27 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 405733 [GPAC 26.08-DEV Proto Link mpeg4_inline.c gf_inline_get_proto_lib tràn bộ đệm] |
|---|
| điểm | 20 |
|---|