Project: gpac (gpac/gpac), language: c++
Vulnerability instance: gpac.cve-2020-23932
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/gpac/gpac/issues/1566
## Description:
Issue: gpac/gpac#1566
Title: A Segmentation fault in filedump.c:1627
State: closed
Created by: seviezhou
Created at: 2020-08-07 03:10:20+00:00

Issue Body:
## System info

Ubuntu x86_64, gcc (Ubuntu 5.5.0-12ubuntu1), MP4Box (latest master [2aa266](https://github.com/gpac/gpac/commit/2aa266dfaab6aaad9f9f4f216ad7d1e62adc7fa0))

## Configure

CFLAGS="-g -fsanitize=address" LDFLAGS="-fsanitize=address" ./configure --static-mp4box

## Command line

./bin/gcc/MP4Box -sdp -ttxt -2 -dump-chap-ogg -dump-cover -drtp -bt -out /dev/null @@

## Output

```
Scene loaded - dumping root scene
Exporting MPEG-4 AAC Audio - SampleRate 44100 2 channels 16 bits per sample
Segmentation fault (core dumped)
```

## AddressSanitizer output

```
ASAN:SIGSEGV
=================================================================
==31981==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f1269c005a1 bp 0x000000000000 sp 0x7fffad3ba678 T0)
    #0 0x7f1269c005a0  (/lib/x86_64-linux-gnu/libc.so.6+0x18e5a0)
    #1 0x7f1269af1204 in fputs (/lib/x86_64-linux-gnu/libc.so.6+0x7f204)
    #2 0x55eb9834073a in dump_isom_sdp /home/seviezhou/gpac/applications/mp4box/filedump.c:1627
    #3 0x55eb98311eb3 in mp4boxMain /home/seviezhou/gpac/applications/mp4box/main.c:5533
    #4 0x7f1269a93b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #5 0x55eb982eff09 in _start (/home/seviezhou/gpac/bin/gcc/MP4Box+0x27ff09)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ??:0 ??
==31981==ABORTING
```

## POC

[SEGV-dump_isom_sdp-filedump-1627.zip](https://github.com/gpac/gpac/files/5039113/SEGV-dump_isom_sdp-filedump-1627.zip)



Attachments:
https://github.com/gpac/gpac/files/5039113/SEGV-dump_isom_sdp-filedump-1627.zip

Commit References:
2aa266dfaab6aaad9f9f4f216ad7d1e62adc7fa0

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./configure --static-build --extra-cflags="${CFLAGS}" --extra-ldflags="${CFLAGS}"
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y build-essential pkg-config libz-dev
RUN git clone https://github.com/gpac/gpac gpac
RUN git -C gpac checkout 9eeac00b38348c664dfeae2525bba0cf1bc32349
WORKDIR $SRC/gpac
COPY build.sh $SRC/

Additional files:
filename: fuzz_parse.c
content: /* Copyright 2021 Google LLC
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
      http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#include <stdio.h>
#include <unistd.h>

#include <gpac/internal/isomedia_dev.h>
#include <gpac/constants.h>

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
    char filename[256];
    sprintf(filename, "/tmp/libfuzzer.%d", getpid());

    FILE *fp = fopen(filename, "wb");
    if (!fp) {
        return 0;
    }
    fwrite(data, size, 1, fp);
    fclose(fp);

    GF_ISOFile *movie = NULL;
    movie = gf_isom_open_file(filename, GF_ISOM_OPEN_READ_DUMP, NULL);
    if (movie != NULL) {
        gf_isom_close(movie);
    }
    unlink(filename);
    return 0;
}