NULL Pointer Dereference in mp4v2 MP4File::GenerateTracks()

Executive Summary

This vulnerability is a NULL pointer dereference in the MP4File::GenerateTracks() function of mp4v2 version 2.0.0. A NULL pointer dereference occurs when a program attempts to access memory at a NULL address, which typically leads to a crash or denial of service.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes in applications using mp4v2 2.0.0 when processing MP4 files. Use sanitizer builds (AddressSanitizer, UndefinedBehaviorSanitizer) to detect NULL pointer dereferences or misaligned loads. Test with the 575-byte malformed MP4 file mentioned in the reports to trigger the crash.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a remote attacker to cause a denial of service by exploiting the NULL pointer dereference in the MP4File::GenerateTracks() function. This could result in the application crashing or becoming unresponsive when processing malicious MP4 files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a denial of service (DoS) via NULL pointer dereference, which could disrupt systems processing MP4 files. For compliance with GDPR or HIPAA, such disruptions may impact availability of data processing systems, potentially violating requirements for timely access or processing of personal health or user data.

Useful 0 Not Useful 0

Mitigation Strategies

Update mp4v2 to a version that patches the NULL pointer dereference in MP4File::GenerateTracks(). Avoid processing untrusted MP4 files until patched.

Useful 0 Not Useful 0