CVE-2025-60483: NULL Pointer Dereference in GPAC/MP4Box via gf_ac4_pres_b_4_back_channels_present on crafted AC-4 stream

["Alexander A. Shvedov" <shvedov () gmx com>]

Product:   GPAC (MP4Box)
Affected:  gpac/gpac prior to fix commit (see References)
CVE:       CVE-2025-60483
CWE:       CWE-476 (NULL Pointer Dereference)
CVSS 3.1:  4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Reporter:  sigdevel <https://infosec.exchange/@sigdevel>

Description:
  The gf_ac4_pres_b_4_back_channels_present function in media_tools/av_parsers.c
  accesses presentation substream group data using an index derived from the AC-4
  stream. When a crafted AC-4 file specifies an invalid substream group index
  (e.g., group 4 that does not exist for presentation 0), the parser reaches
  line 15703 without first validating the index against the available group count.

  The invalid index causes a dereference of pres->substream_groups at a 72-byte
  offset from a NULL or uninitialized base pointer (READ at address 0x000000000048),
  terminating the process with SIGSEGV. No evidence of arbitrary code execution
  was observed; the impact is limited to Denial of Service.

  Crash is reproducible on the current master branch at the time of
  discovery. No authentication or special privileges required beyond
  ability to provide a crafted file.

Reproduction:
  -Build-opts: `--static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0"` ;
  -Command: ./MP4Box -dash 100 49_gf_ac4_pres_b_4_back_channels_present_media_tools_av_parsers_c_15703

Asan-log:
==56315==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000048 (pc 0x7f3ff4b7f8d1 bp 0x0a100000018e sp 
0x7ffcf2d7c730 T0)
==56315==The signal is caused by a READ memory access.
    #0 0x7f3ff4b7f8d1 in gf_ac4_pres_b_4_back_channels_present media_tools/av_parsers.c:15703
    #1 0x7f3ff4b7f8d1 in gf_ac4_raw_frame media_tools/av_parsers.c:15999
    #2 0x7f3ff4b7f8d1 in gf_ac4_parser_bs media_tools/av_parsers.c:16141

PoC:
  
https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/49/49_gf_ac4_pres_b_4_back_channels_present_media_tools_av_parsers_c_15703

References:
  https://github.com/gpac/gpac/issues/3302
  https://nvd.nist.gov/vuln/detail/CVE-2025-60483
  https://www.cve.org/CVERecord?id=CVE-2025-60483

 
---
Best regards,
Alexander A. Shvedov
https://github.com/sigdevel