NULL Pointer Dereference in GPAC SFImage Field Cloning

Executive Summary

This is a NULL pointer dereference vulnerability in GPAC's BIFS scene decoder. It occurs in the gf_sg_vrml_field_clone() function when cloning a PROTO node's default SFImage field. The function copies image data without checking if the source pixel buffer is NULL, leading to crashes in both sanitized and release builds.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes in GPAC applications when processing BIFS streams or VRML files. Enable AddressSanitizer (ASan) and UndefinedBehaviorSanitizer (UBSan) during compilation to catch NULL pointer dereferences. Test with crafted inputs containing PROTO nodes with SFImage fields where pixels are NULL but dimensions are non-zero.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this by providing a specially crafted input file to trigger a crash, causing denial of service. This could disrupt media playback or processing applications using vulnerable GPAC versions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes application crashes via denial-of-service, which could disrupt systems processing media files. For GDPR, availability impacts may affect data subject rights if systems become inaccessible. HIPAA requires availability of ePHI; crashes could disrupt access to protected health information. However, the vulnerability itself does not directly expose or leak data.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the patch from Resource 2 which adds NULL checks in gf_sg_vrml_field_clone(). Avoid processing untrusted BIFS or VRML files until patched. Monitor GPAC applications for crashes and update to a fixed GPAC version once available.

Useful 0 Not Useful 0