提交 #876597: flvmeta 1.2.2 SEGV

## Summary
A null pointer dereference exists in `amf_object_get()` when processing a malformed FLV file. The function attempts to access a member at offset 0x10 from a NULL object pointer, causing a segmentation fault (SIGSEGV) reading from address 0x10.

## Vulnerability Details
**Program**: flvmeta (version 1.2.2)
**Crash Type**: SEGV (null pointer dereference)
**Root Cause**: Missing null check before dereferencing AMF object pointer.

##ASAN report
=================================================================
==2134322==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x59010167f26d bp 0x7fff90caa3f0 sp 0x7fff90caa3d0 T0)
==2134322==The signal is caused by a READ memory access.
==2134322==Hint: address points to the zero page.
#0 0x59010167f26d in amf_object_get /home/xmut/wyf/LLM-optionFuzz/benchlatest/flvmeta-asan/flvmeta-1.2.2/src/amf.c:974
#1 0x59010169ef64 in compute_metadata /home/xmut/wyf/LLM-optionFuzz/benchlatest/flvmeta-asan/flvmeta-1.2.2/src/info.c:665
#2 0x5901016a1eec in update_metadata /home/xmut/wyf/LLM-optionFuzz/benchlatest/flvmeta-asan/flvmeta-1.2.2/src/update.c:279
#3 0x590101698fd5 in main /home/xmut/wyf/LLM-optionFuzz/benchlatest/flvmeta-asan/flvmeta-1.2.2/src/flvmeta.c:388
#4 0x7c7457e2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#5 0x7c7457e2a28a in __libc_start_main_impl ../csu/libc-start.c:360
#6 0x59010167a844 in _start (/home/xmut/wyf/LLM-optionFuzz/benchlatest/flvmeta-asan/build/src/flvmeta+0x12844) (BuildId: 0e3e850f77cbf5d18ae1ae702897d71336632326)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/xmut/wyf/LLM-optionFuzz/benchlatest/flvmeta-asan/flvmeta-1.2.2/src/amf.c:974 in amf_object_get
==2134322==ABORTING

### Root Cause
1. During AMF metadata parsing, `compute_metadata()` retrieves an object via `amf_object_get()`.
2. The object pointer passed to `amf_object_get()` is NULL due to corrupted or incomplete AMF data.
3. The function does not validate the pointer and directly dereferences it, e.g., `obj->member`.
4. Accessing NULL + 0x10 triggers a page fault.

### Vulnerable Code (amf.c:974)
```c
// Likely a member access without NULL check
node = node->next->next;
```

##Proof of Concept
**PoC File**: flvmeta_SEGV (malformed FLV causing incomplete AMF object)

**Reproduction**:
``bash
flvmeta -p -f -i --dump-format=json -m flvmeta_SEGV /tmp/out.flv
```

• 用户: Raind (UID 99455)
• 提交: 2026-07-01 14時52分 (2 月前)
• 管理: 2026-08-31 09時04分 (2 months later)
• 状态: 已接受
• VulDB条目: 397244 [FLVMeta 直到 1.2.2 AMF Object Parsing src/amf.c amf_object_get 拒绝服务]
• 积分: 15