CVE-2023-48013: Double Free (CWE-415)
value: GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a double free via the gf_filterpacket_del function at /gpac/src/filter_core/filter.c.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 7.8
Published: 2023-11-15T19:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/isoffin_read_ch.c
Commit date: 2023-10-12 16:17:31 +0200
Commit message: Fixed #2612

Diff: diff --git a/src/filters/isoffin_read_ch.c b/src/filters/isoffin_read_ch.c
index bd96400689f..6e74ce8e3f9 100644
--- a/src/filters/isoffin_read_ch.c
+++ b/src/filters/isoffin_read_ch.c
@@ -393,10 +393,12 @@ void isor_reader_get_sample(ISOMChannel *ch)
 
 			/*we are in forced seek mode: fetch all samples before the one matching the sample time*/
 			if (ch->edit_sync_frame) {
 				ch->edit_sync_frame++;
 				if (ch->edit_sync_frame < ch->sample_num) {
+					ch->static_sample->alloc_size = 0;
+					ch->static_sample->dataLength = 0;
 					ch->sample = gf_isom_get_sample_ex(ch->owner->mov, ch->track, ch->edit_sync_frame, &sample_desc_index, ch->static_sample, &ch->sample_data_offset);
 					if (ch->sample) {
 						ch->sample->DTS = ch->sample_time;
 						ch->sample->CTS_Offset = 0;
 					}
@@ -414,16 +416,24 @@ void isor_reader_get_sample(ISOMChannel *ch)
 
 						if (sample_num >= gf_isom_get_sample_count(ch->owner->mov, ch->track) ) {
 							//e = GF_EOS;
 						} else {
 							u32 time_diff = gf_isom_get_sample_duration(ch->owner->mov, ch->track, sample_num);
+
+							ch->static_sample->alloc_size = 0;
+							ch->static_sample->dataLength = 0;
+
 							e = gf_isom_get_sample_for_movie_time(ch->owner->mov, ch->track, ch->sample_time + time_diff, &sample_desc_index, GF_ISOM_SEARCH_FORWARD, &ch->static_sample, &ch->sample_num, &ch->sample_data_offset);
 							ch->static_sample->alloc_size = 0;
 							if (e==GF_OK) {
 								if (ch->sample_num == prev_sample) {
 									ch->sample_time += time_diff;
 									ch->sample = NULL;
+									if (ch->pck) {
+										gf_filter_pck_discard(ch->pck);
+										ch->pck = NULL;
+									}
 									return;
 								} else {
 									ch->sample = ch->static_sample;
 								}
 							}
@@ -435,10 +445,12 @@ void isor_reader_get_sample(ISOMChannel *ch)
 				force seek mode*/
 				if (ch->sample && !ch->sample->IsRAP && ch->has_rap && (ch->sample_num != prev_sample+1)) {
 					GF_ISOSample *found = ch->static_sample;
 					u32 samp_num = ch->sample_num;
 					ch->sample = NULL;
+					ch->static_sample->alloc_size = 0;
+					ch->static_sample->dataLength = 0;
 					e = gf_isom_get_sample_for_movie_time(ch->owner->mov, ch->track, ch->sample_time + 1, &sample_desc_index, GF_ISOM_SEARCH_SYNC_BACKWARD, &ch->static_sample, &ch->sample_num, &ch->sample_data_offset);
 
 					ch->static_sample->alloc_size = 0;
 					ch->sample = (e == GF_OK) ? ch->static_sample : NULL;
 

Fixed code: 					ch->static_sample->alloc_size = 0;
					ch->static_sample->dataLength = 0;

							ch->static_sample->alloc_size = 0;
							ch->static_sample->dataLength = 0;

									if (ch->pck) {
										gf_filter_pck_discard(ch->pck);
										ch->pck = NULL;
									}
					ch->static_sample->alloc_size = 0;
					ch->static_sample->dataLength = 0;