[Security] NULL pointer dereference (SEGV at address 0x0) in sei_message() when parsing a crafted MP4 file

Đang mở
  • Có gì không ổn?
#2,444 0 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 7 ngày

@yasar710 đang làm issue này rồi.

Từ ngày 2/11/2026.

  • #2448 của @yasar710 — đang mở

Đánh giá

Độ khó
2/5
Thời gian dự kiến
1-3 giờ
Mức phù hợp với người mới
50/100
Loại issue
Lỗi
Độ rõ ràng
Đặc tả rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
c
Lĩnh vực
security

Hướng nghiên cứu

Start in the sei_rbsp() loop in src/lib_ccx/avc_functions.c (around lines 366-412), where the NULL return from sei_message() is not checked before the next iteration reads through it. Reproduce by building with AddressSanitizer and running the attached crash-input.bin, which should currently abort in sei_message. Done means the crafted input exits without a SEGV and a truncated SEI is handled as an error. Because this is a security report, check with maintainers before opening a public fix.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

1. Summary

CCExtractor (master commit d7eb132e15f4d1e2c40f4655349596b2b8f708de, version string 0.96.5) crashes with a NULL pointer dereference while parsing a crafted MP4 file. During GPAC-based MP4 processing of an AVC video track, process_avc_sample() (src/lib_ccx/mp4.c:100) hands a SEI NAL unit to sei_rbsp() (src/lib_ccx/avc_functions.c:366). The loop in sei_rbsp() does not handle the NULL return value of sei_message(): sei_message() returns NULL (src/lib_ccx/avc_functions.c:401/412) when the SEI payload-type/payload-size field (a run of 0xFF bytes) extends to the end of the NAL, and the next loop iteration dereferences that NULL pointer at src/lib_ccx/avc_functions.c:395. Under AddressSanitizer the process aborts with "SEGV on unknown address 0x000000000000 ... READ memory access ... in sei_message". The defect is a denial of service: any tool or pipeline that runs ccextractor on a malicious MP4 file can be crashed.

2. Affected version / environment

- Project: CCExtractor (https://github.com/CCExtractor/ccextractor)
- Version: version string 0.96.5, master branch commit d7eb132e15f4d1e2c40f4655349596b2b8f708de (source dated 2026-10-17, binary compiled 2026-10-26)
- Environment: Linux x86_64 (Ubuntu container), ccextractor built with AddressSanitizer, statically linked; libGPAC 2.0; default CLI options, output target .srt
- Component: src/lib_ccx/avc_functions.c (sei_message / sei_rbsp), reached via src/lib_ccx/mp4.c:100 (process_avc_sample) through the GPAC MP4 demux path

3. Steps to reproduce

1. Build ccextractor at master commit d7eb132e15f4d1e2c40f4655349596b2b8f708de with AddressSanitizer (any recent clang/gcc with -fsanitize=address works).
2. Save the attached crash-input.bin (SHA-256 f6bbb40d2694e61029e0b0394af4633283447b5a919b7c2b56f12e1fde86e3ce, a malformed MP4 file, 85,748 bytes).
3. Run: ccextractor crash-input.bin
   (verification used: env ASAN_OPTIONS=abort_on_error=0:symbolize=1:detect_leaks=0:allocator_may_return_null=1:print_legend=0:malloc_context_size=0 /lh/ccextractor/src/build/ccextractor /lh/tmp/poc-export/ccx-sei/crash-input.bin inside the container)
4. Observe the process abort with an AddressSanitizer SEGV report while "Processing track 1, type=vide subtype=avc1".
5. Negative control: a valid MPEG-TS file (negative-control.bin, SHA-256 8cc876f39877677b17319e64d3577aa7ce1ae1ef1bfa5ffd14f0cf1b7f823ff2) processes to completion with no sanitizer report, confirming the crash is input-specific.

4. Expected behavior

ccextractor should detect the malformed SEI NAL unit, report/skip it, and exit normally (or with a controlled error message) without dereferencing a NULL pointer.

5. Actual behavior

AddressSanitizer:DEADLYSIGNAL
=================================================================
==1826035==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x563d9ee4e716 bp 0x7fff50c2fff0 sp 0x7fff50c2ff50 T0)
==1826035==The signal is caused by a READ memory access.
==1826035==Hint: address points to the zero page.
    #0 0x563d9ee4e716 in sei_message /lh/ccextractor/src/src/lib_ccx/avc_functions.c:395:28
    #1 0x563d9ee4e716 in sei_rbsp /lh/ccextractor/src/src/lib_ccx/avc_functions.c:371:10
    #2 0x563d9ee4cb4f in do_NAL /lh/ccextractor/src/src/lib_ccx/avc_functions.c
    #3 0x563d9ede5f6c in process_avc_sample /lh/ccextractor/src/src/lib_ccx/mp4.c:100:4
    #4 0x563d9ede5f6c in process_avc_track /lh/ccextractor/src/src/lib_ccx/mp4.c:295:13
    #5 0x563d9ede5f6c in processmp4 /lh/ccextractor/src/src/lib_ccx/mp4.c:989:9
    #6 0x563d9eae34e0 in start_ccx /lh/ccextractor/src/src/ccextractor.c:252:12
SUMMARY: AddressSanitizer: SEGV /lh/ccextractor/src/src/lib_ccx/avc_functions.c:395:28 in sei_message

6. Impact

Denial of service (CWE-476, NULL pointer dereference). A crafted MP4 file makes ccextractor dereference a NULL pointer and crash on every run, so any automated transcoding/caption-extraction pipeline that feeds user-supplied media to ccextractor can be interrupted by a single small file. No memory corruption, information disclosure, or code execution is involved: the faulting access is a read at address 0x0.

7. Suggested fix

In sei_rbsp() (src/lib_ccx/avc_functions.c:369-372) the loop ignores the NULL that sei_message() returns when the SEI header fields run past the end of the NAL unit; on the next iteration the NULL is dereferenced at line 395. Guarding the loop, e.g.

    while (tbuf < seiend - 1)
    {
        tbuf = sei_message(ctx, tbuf, seiend - 1);
        if (tbuf == NULL)
            break;
    }

(or treating a NULL return like the existing "unexpected SEI unit length" path) stops the crash; optionally also validate the payload_type/payload_size varint parsing in sei_message() so a truncated SEI is reported once instead of silently returning NULL.

8. Additional context (PoC / logs, redacted)

- Attached: crash-input.bin (malformed MP4, ftyp/free/mdat boxes, one avc1 video track; SHA-256 f6bbb40d2694e61029e0b0394af4633283447b5a919b7c2b56f12e1fde86e3ce)
- Negative control attached: negative-control.bin (valid MPEG-TS transport stream, SHA-256 8cc876f39877677b17319e64d3577aa7ce1ae1ef1bfa5ffd14f0cf1b7f823ff2) — runs clean
- Crash discovered by coverage-guided fuzzing of the master build; full sanitizer transcript archived in the verification environment; terminal screenshots of the live reproduction are available on request.
- No reproduction was attempted on any other version; affected range is therefore not asserted beyond the tested commit.

poc.zip

Ngôn ngữ chính
C
Star
913
Fork
603
Merge trung bình
6 ngày 8 giờ
Pull request đã merge (30 ngày)
33

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của CCExtractor/ccextractor

Tất cả issue của CCExtractor/ccextractor

Issue tương tự

Thêm issue về C

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.