CVE-2025-60486: Use-After-Free in GPAC/MP4Box via dasher_process on crafted MPEG-2 TS file

["Alexander A. Shvedov" <shvedov () gmx com>]

Product:   GPAC (MP4Box)
Affected:  gpac/gpac prior to fix commit 3f20eb0cd22116367c036e6ffe6ace299b38d686 (GPAC version 
2.5-DEV-rev1665-g3f20eb0cd-master)
CVE:       CVE-2025-60486
CWE:       CWE-416 (Use After Free)
CVSS 3.1:  8.8 HIGH (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Reporter:  sigdevel <https://infosec.exchange/@sigdevel>

Description:
  The dasher_configure_pid function in filters/dasher.c frees a PID context
  structure at line 976 when reconfiguring a stream during DASH segmentation.
  The freed pointer is not cleared after deallocation, and dasher_process
  subsequently accesses the same memory region at line 9445 during the next
  processing cycle, creating a heap use-after-free condition.

  A crafted MPEG-2 TS file with repeated sync marker violations, broken PMT
  descriptor sizes, and conflicting PID assignments triggers the reconfiguration
  sequence that exposes the stale pointer. The subsequent READ of 4 bytes at
  316 bytes into the freed 1096-byte region terminates the process. Code execution
  cannot be ruled out; use-after-free vulnerabilities can allow an attacker to
  control freed memory contents and redirect execution flow.

  Crash is reproducible on the current master branch at the time of
  discovery. No authentication or special privileges required beyond
  ability to provide a crafted file.

Reproduction:
  -Build-opts: `--static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0"` ;
  -Command: ./MP4Box -dash 100 53_dasher_process_filters_dasher_c_9445

Asan-log:
==55065==ERROR: AddressSanitizer: heap-use-after-free on address 0x519000022cbc at pc 0x7f2fc41c3300 bp 0x7ffe86651b00 
sp 0x7ffe86651af8
==55065==The signal is caused by a READ memory access.
    #0 0x7f2fc41c32ff in dasher_process filters/dasher.c:9445
    #1 0x7f2fc4119440 in gf_filter_process_task filter_core/filter.c:3208
    #2 0x7f2fc40ed45e in gf_fs_thread_proc filter_core/filter_session.c:2393

PoC:
  https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/53/53_dasher_process_filters_dasher_c_9445

References:
  https://github.com/gpac/gpac/issues/3314
  https://nvd.nist.gov/vuln/detail/CVE-2025-60486
  https://www.cve.org/CVERecord?id=CVE-2025-60486

 
---
Best regards,
Alexander A. Shvedov
https://github.com/sigdevel