CVE-2025-60495: NULL Pointer Dereference in GPAC/MP4Box via gf_media_get_color_info on crafted MP4 with inconsistent sample entry

["Alexander A. Shvedov" <shvedov () gmx com>]

Product:   GPAC (MP4Box)
Affected:  gpac/gpac prior to commit 50b5741f291126b610c59db433fc02e8a17f0c5d  (GPAC version 
2.5-DEV-rev1780-g50b5741f2-master)
CVE:       CVE-2025-60495
CWE:       CWE-476 (NULL Pointer Dereference)
CVSS 3.1:  4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Reporter:  sigdevel <https://infosec.exchange/@sigdevel>

Description:
  The function gf_media_get_color_info in media_tools/isom_tools.c:979 retrieves
  color information from an ISO media sample entry during PID configuration in the
  MP4 muxer pipeline. When a crafted MP4 file contains a video sample entry with an
  inconsistent box structure (e.g., a v210 uncompressed video entry that incorrectly
  embeds an avcC AVC Decoder Configuration Box), the parser logs an "Unknown box type"
  warning and proceeds without properly initializing the entry's internal state.

  The function subsequently dereferences a near-null pointer (READ at address
  0x000000000008, 8 bytes into a NULL base) without validating the entry structure,
  terminating the process with SIGSEGV. No evidence of arbitrary code execution was
  observed; the impact is limited to Denial of Service.

  Crash is reproducible on the current master branch at the time of
  discovery. No authentication or special privileges required beyond
  ability to provide a crafted file.

Reproduction:
  -Build-opts: `CC="gcc -fsanitize=address -g" CXX="g++ -fsanitize=address -g"` ;
  -Command: ./MP4Box -split-size 8000 66_gf_media_get_color_info_media_tools_isom_tools_c_979

Asan-log:
==3196882==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x7ff47af04f7e bp 0x0ffe8ce234c0 sp 
0x7ffca3293ad0 T0)
==3196882==The signal is caused by a READ memory access.
    #0 0x7ff47af04f7e in gf_media_get_color_info media_tools/isom_tools.c:979
    #1 0x7ff47b82b690 in mp4_mux_setup_pid filters/mux_isom.c:3673
    #2 0x7ff47b4adde1 in gf_filter_pid_configure filter_core/filter_pid.c:939

PoC:
  https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/66/66_gf_media_get_color_info_media_tools_isom_tools_c_979

References:
  https://github.com/gpac/gpac/issues/3335
  https://nvd.nist.gov/vuln/detail/CVE-2025-60495
  https://www.cve.org/CVERecord?id=CVE-2025-60495

 
---
Best regards,
Alexander A. Shvedov
https://github.com/sigdevel