GPAC Null Pointer Dereference Vulnerability in DASH Client

A null pointer dereference vulnerability has been identified in GPAC versions through 2.4. The issue arises in the function 'gf_dash_download_init_segment' within 'src/media_tools/dash_client.c'. The vulnerability is triggered by manipulating the 'base_init_url' argument, leading to a null pointer dereference. This flaw can be exploited remotely, causing a segmentation fault by dereferencing a null pointer that was not properly validated. The vulnerability has been publicly disclosed and is known to be exploitable.

Impact

Exploitation of this vulnerability leads to a null pointer dereference, causing a segmentation fault and crashing the application.

Reproduction

The vulnerability can be reproduced by using a crafted input URL that exceeds the length limit, causing the 'gf_url_concatenate' function to return NULL. This NULL value is then passed to 'gf_dash_download_init_segment', where it is dereferenced without any validation, leading to a crash.

Remediation

Users are advised to update to the patched version of GPAC, available on the official GitHub repository.