GPAC Null Pointer Dereference Vulnerability in MP4Box Component

A null pointer dereference vulnerability has been identified in GPAC versions prior to 2.4.0, specifically within the MP4Box component. The issue arises in the MergeFragment function, located in src/isomedia/isom_intern.c. This vulnerability can be exploited locally, leading to a crash by passing a null pointer to a memory function that expects a non-null argument. The vulnerability has been publicly disclosed and exploited.

Impact

Exploitation of this vulnerability causes a crash due to a null pointer being passed to a memory function, violating the function's non-null requirement. This type of error can lead to undefined behavior, potentially allowing for further exploitation in different contexts.

Reproduction

The vulnerability can be reproduced using the command 'MP4Box -hint' followed by a crafted MP4 file that triggers the null pointer dereference. This can be done by using the UndefinedBehaviorSanitizer (UBSan) to catch the error. The issue can be replicated with the latest GPAC build by referencing issue #3549.

Remediation

Users are advised to update to GPAC version 2.4.0 or later, where this vulnerability has been patched.