Headline
CVE-2021-45262: Invalid free in gf_sg_command_del() · Issue #1980 · gpac/gpac
An invalid free vulnerability exists in gpac 1.1.0 via the gf_sg_command_del function, which causes a segmentation fault and application crash.
Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!
- I looked for a similar issue and couldn’t find any.
- I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line …). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95
Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/
An invalid free was discovered in gf_sg_command_del(). The vulnerability causes a segmentation fault and application crash.
Version:
MP4Box - GPAC version 1.1.0-DEV-revUNKNOWN_REV
(c) 2000-2021 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io
Please cite our work in your research:
GPAC Filters: https://doi.org/10.1145/3339825.3394929
GPAC: https://doi.org/10.1145/1291233.1291452
GPAC Configuration:
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_JPEG GPAC_HAS_PNG GPAC_HAS_LINUX_DVB GPAC_DISABLE_3D
System information
Ubuntu 20.04 focal, AMD EPYC 7742 64-Core @ 16x 2.25GHz
command:
./MP4Box -bt ./poc/poc_17
poc_17.zip
Result
[iso file] extra box maxr found in hinf, deleting
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type 80rak in parent moov
[iso file] Unknown box type prl in parent dref
[iso file] Incomplete box mdat - start 11495 size 860323
[iso file] Incomplete file while reading for dump - aborting parsing
[iso file] extra box maxr found in hinf, deleting
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type 80rak in parent moov
[iso file] Unknown box type prl in parent dref
[iso file] Incomplete box mdat - start 11495 size 860323
[iso file] Incomplete file while reading for dump - aborting parsing
MPEG-4 LASeR Scene Parsing
[LASeR] memory overread - corrupted decoding
[LASeR] memory overread - corrupted decoding
[MP4 Loading] decoding sample 1 from track ID 8 failed
free(): invalid pointer
[1] 3334251 abort ./MP4Box -bt ./poc/poc_17
gdb
free(): invalid pointer
Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
───────────────────────────────[ REGISTERS ]────────────────────────────────
RAX 0x0
RBX 0x7ffff72bf040 ◂— 0x7ffff72bf040
RCX 0x7ffff758218b (raise+203) ◂— mov rax, qword ptr [rsp + 0x108]
RDX 0x0
RDI 0x2
RSI 0x7fffffff6f20 ◂— 0x0
R8 0x0
R9 0x7fffffff6f20 ◂— 0x0
R10 0x8
R11 0x246
R12 0x7fffffff7190 ◂— 0x0
R13 0x10
R14 0x7ffff7ffb000 ◂— 0x6565726600001000
R15 0x1
RBP 0x7fffffff7270 —▸ 0x5555555df1e0 —▸ 0x5555555d4370 ◂— 0x0
RSP 0x7fffffff6f20 ◂— 0x0
RIP 0x7ffff758218b (raise+203) ◂— mov rax, qword ptr [rsp + 0x108]
───────────────────────────────────────[ DISASM ]────────────────────────────────────────
► 0x7ffff758218b <raise+203> mov rax, qword ptr [rsp + 0x108]
0x7ffff7582193 <raise+211> xor rax, qword ptr fs:[0x28]
0x7ffff758219c <raise+220> jne raise+260 <raise+260>
↓
0x7ffff75821c4 <raise+260> call __stack_chk_fail <__stack_chk_fail>
0x7ffff75821c9 nop dword ptr [rax]
0x7ffff75821d0 <killpg> endbr64
0x7ffff75821d4 <killpg+4> test edi, edi
0x7ffff75821d6 <killpg+6> js killpg+16 <killpg+16>
0x7ffff75821d8 <killpg+8> neg edi
0x7ffff75821da <killpg+10> jmp kill <kill>
0x7ffff75821df <killpg+15> nop
────────────────────────────────────────[ STACK ]────────────────────────────────────────
00:0000│ rsi r9 rsp 0x7fffffff6f20 ◂— 0x0
01:0008│ 0x7fffffff6f28 —▸ 0x7ffff77534c8 ◂— 0xe001200003748 /* 'H7' */
02:0010│ 0x7fffffff6f30 —▸ 0x7fffffff72f0 —▸ 0x5555555d47a0 —▸ 0x5555555d4370 ◂— 0x0
03:0018│ 0x7fffffff6f38 —▸ 0x7ffff7fe7c2e ◂— mov r11, rax
04:0020│ 0x7fffffff6f40 ◂— 0x0
05:0028│ 0x7fffffff6f48 ◂— 0x0
06:0030│ 0x7fffffff6f50 —▸ 0x5555555df390 —▸ 0x5555555df3f0 —▸ 0x5555555df0f0 ◂— 0x0
07:0038│ 0x7fffffff6f58 ◂— 0x0
──────────────────────────────────────[ BACKTRACE ]──────────────────────────────────────
► f 0 0x7ffff758218b raise+203
f 1 0x7ffff7561859 abort+299
f 2 0x7ffff75cc3ee __libc_message+670
f 3 0x7ffff75d447c
f 4 0x7ffff75d5cac _int_free+748
f 5 0x7ffff784f461 gf_sg_command_del+353
f 6 0x7ffff7a88203 gf_sm_del+195
f 7 0x555555584423 dump_isom_scene+627
─────────────────────────────────────────────────────────────────────────────────────────
break gf_svg_delete_attribute_value
pwndbg>
0x00007ffff784f45c in gf_sg_command_del () from /root/fuckit/test/gpac1210/bin/gcc/libgpac.so.10
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
───────────────────────────────[ REGISTERS ]────────────────────────────────
RAX 0x0
RBX 0x0
RCX 0x5555555df310 ◂— 0x0
*RDX 0x5555555d4370 ◂— 0x0
RDI 0x0
RSI 0x5555555df300 ◂— 0x0
R8 0x2
R9 0xfffffff6
R10 0x7ffff775ba72 ◂— 'gf_node_unregister_children'
R11 0x7ffff784a6d0 (gf_node_unregister_children) ◂— endbr64
R12 0x5555555df2e0 ◂— 0x0
R13 0x5555555d47a0 —▸ 0x5555555d4370 ◂— 0x0
R14 0x5555555d4370 ◂— 0x0
R15 0x0
RBP 0x5555555df1e0 —▸ 0x5555555d4370 ◂— 0x0
RSP 0x7fffffff7310 ◂— 0x1
*RIP 0x7ffff784f45c (gf_sg_command_del+348) ◂— call 0x7ffff78c7fb0
───────────────────────────────────────[ DISASM ]────────────────────────────────────────
0x7ffff784f449 <gf_sg_command_del+329> mov rsi, qword ptr [r12 + 8]
0x7ffff784f44e <gf_sg_command_del+334> test rsi, rsi
0x7ffff784f451 <gf_sg_command_del+337> je gf_sg_command_del+255
<gf_sg_command_del+255>
0x7ffff784f453 <gf_sg_command_del+339> mov edi, dword ptr [r12 + 4]
0x7ffff784f458 <gf_sg_command_del+344> mov rdx, qword ptr [rbp]
► 0x7ffff784f45c <gf_sg_command_del+348> call gf_svg_delete_attribute_value <gf_svg_delete_attribute_value>
rdi: 0x0
rsi: 0x5555555df300 ◂— 0x0
rdx: 0x5555555d4370 ◂— 0x0
rcx: 0x5555555df310 ◂— 0x0
0x7ffff784f461 <gf_sg_command_del+353> jmp gf_sg_command_del+255
<gf_sg_command_del+255>
0x7ffff784f463 <gf_sg_command_del+355> nop dword ptr [rax + rax]
0x7ffff784f468 <gf_sg_command_del+360> mov rdi, qword ptr [r12 + 8]
0x7ffff784f46d <gf_sg_command_del+365> test rdi, rdi
0x7ffff784f470 <gf_sg_command_del+368> je gf_sg_command_del+384
<gf_sg_command_del+384>
────────────────────────────────────────[ STACK ]────────────────────────────────────────
00:0000│ rsp 0x7fffffff7310 ◂— 0x1
01:0008│ 0x7fffffff7318 ◂— 0x5cf4ff747866de00
02:0010│ 0x7fffffff7320 —▸ 0x7fffffff7340 —▸ 0x5555555df1e0 —▸ 0x5555555d4370 ◂— 0x0
03:0018│ 0x7fffffff7328 —▸ 0x5555555defe0 ◂— 0x8
04:0020│ 0x7fffffff7330 —▸ 0x5555555df130 ◂— 0x0
05:0028│ 0x7fffffff7338 —▸ 0x7ffff7a88203 (gf_sm_del+195) ◂— jmp 0x7ffff7a881c8
06:0030│ 0x7fffffff7340 —▸ 0x5555555df1e0 —▸ 0x5555555d4370 ◂— 0x0
07:0038│ 0x7fffffff7348 ◂— 0x5cf4ff747866de00
──────────────────────────────────────[ BACKTRACE ]──────────────────────────────────────
► f 0 0x7ffff784f45c gf_sg_command_del+348
f 1 0x7ffff7a88203 gf_sm_del+195
f 2 0x555555584423 dump_isom_scene+627
f 3 0x55555557b42c mp4boxMain+9228
f 4 0x7ffff75630b3 __libc_start_main+243
─────────────────────────────────────────────────────────────────────────────────────────
pwndbg>
free(): invalid pointer
Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
───────────────────────────────[ REGISTERS ]────────────────────────────────
RAX 0x0
*RBX 0x7ffff72bf040 ◂— 0x7ffff72bf040
*RCX 0x7ffff758218b (raise+203) ◂— mov rax, qword ptr [rsp + 0x108]
*RDX 0x0
*RDI 0x2
*RSI 0x7fffffff6f20 ◂— 0x0
*R8 0x0
*R9 0x7fffffff6f20 ◂— 0x0
*R10 0x8
*R11 0x246
*R12 0x7fffffff7190 ◂— 0x0
*R13 0x10
*R14 0x7ffff7ffb000 ◂— 0x6565726600001000
*R15 0x1
*RBP 0x7fffffff7270 —▸ 0x5555555df1e0 —▸ 0x5555555d4370 ◂— 0x0
*RSP 0x7fffffff6f20 ◂— 0x0
*RIP 0x7ffff758218b (raise+203) ◂— mov rax, qword ptr [rsp + 0x108]
───────────────────────────────────────[ DISASM ]────────────────────────────────────────
► 0x7ffff758218b <raise+203> mov rax, qword ptr [rsp + 0x108]
0x7ffff7582193 <raise+211> xor rax, qword ptr fs:[0x28]
0x7ffff758219c <raise+220> jne raise+260 <raise+260>
↓
0x7ffff75821c4 <raise+260> call __stack_chk_fail <__stack_chk_fail>
0x7ffff75821c9 nop dword ptr [rax]
0x7ffff75821d0 <killpg> endbr64
0x7ffff75821d4 <killpg+4> test edi, edi
0x7ffff75821d6 <killpg+6> js killpg+16 <killpg+16>
0x7ffff75821d8 <killpg+8> neg edi
0x7ffff75821da <killpg+10> jmp kill <kill>
0x7ffff75821df <killpg+15> nop
────────────────────────────────────────[ STACK ]────────────────────────────────────────
00:0000│ rsi r9 rsp 0x7fffffff6f20 ◂— 0x0
01:0008│ 0x7fffffff6f28 —▸ 0x7ffff77534c8 ◂— 0xe001200003748 /* 'H7' */
02:0010│ 0x7fffffff6f30 —▸ 0x7fffffff72f0 —▸ 0x5555555d47a0 —▸ 0x5555555d4370 ◂— 0x0
03:0018│ 0x7fffffff6f38 —▸ 0x7ffff7fe7c2e ◂— mov r11, rax
04:0020│ 0x7fffffff6f40 ◂— 0x0
05:0028│ 0x7fffffff6f48 ◂— 0x0
06:0030│ 0x7fffffff6f50 —▸ 0x5555555df390 —▸ 0x5555555df3f0 —▸ 0x5555555df0f0 ◂— 0x0
07:0038│ 0x7fffffff6f58 ◂— 0x0
──────────────────────────────────────[ BACKTRACE ]──────────────────────────────────────
► f 0 0x7ffff758218b raise+203
f 1 0x7ffff7561859 abort+299
f 2 0x7ffff75cc3ee __libc_message+670
f 3 0x7ffff75d447c
f 4 0x7ffff75d5cac _int_free+748
f 5 0x7ffff784f461 gf_sg_command_del+353
f 6 0x7ffff7a88203 gf_sm_del+195
f 7 0x555555584423 dump_isom_scene+627