CVE-2025-60481: NULL Pointer Dereference in GPAC/MP4Box via gf_odf_ac4_cfg_dsi_v1 on crafted AC-4 stream

["Alexander A. Shvedov" <shvedov () gmx com>]

Product:   GPAC (MP4Box)
Affected:  gpac/gpac prior to commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b
CVE:       CVE-2025-60481
CWE:       CWE-476 (NULL Pointer Dereference)
CVSS 3.1:  4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Reporter:  sigdevel <https://infosec.exchange/@sigdevel>

Description:
  The function gf_odf_ac4_cfg_dsi_v1 in odf/descriptors.c:2148 parses AC-4
  audio stream descriptor sub-configurations during media import. When
  MP4Box processes a specially crafted AC-4 file via -info, the parsing
  pipeline (ac4dmx_check_pid -> gf_odf_ac4_cfg_write -> gf_odf_ac4_cfg_dsi_v1)
  encounters an invalid or missing DSI substructure pointer.

  The code does not validate the pointer before dereferencing it, resulting
  in a null pointer dereference (READ at address 0x000000000000) and an
  immediate fatal crash under AddressSanitizer.

  Crash is reproducible on the current master branch at the time of
  discovery. No authentication or special privileges required beyond
  ability to provide a crafted file.

Reproduction:
  -Build-opts: `--static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0"` ;
  -Command: ./MP4Box -info 45_gf_odf_ac4_cfg_dsi_v1_odf_descriptors_c_2148

Asan-log:
==1848484==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f77c30a5cfa bp 0x000000000000 sp 
0x7ffdad34e3d0 T0)
==1848484==The signal is caused by a READ memory access.
    #0 0x7f77c30a5cfa in gf_odf_ac4_cfg_dsi_v1 odf/descriptors.c:2148
    #1 0x7f77c30a6ae1 in gf_odf_ac4_cfg_write_bs odf/descriptors.c:2281
    #2 0x7f77c30a6ae1 in gf_odf_ac4_cfg_write odf/descriptors.c:2288

PoC:
  https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/45/45_gf_odf_ac4_cfg_dsi_v1_odf_descriptors_c_2148

References:
  https://github.com/gpac/gpac/issues/3296
  https://nvd.nist.gov/vuln/detail/CVE-2025-60481
  https://www.cve.org/CVERecord?id=CVE-2025-60481

 
---
Best regards,
Alexander A. Shvedov
https://github.com/sigdevel