Project: gpac (gpac/gpac), language: c++
Vulnerability instance: gpac.cve-2024-57184
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/gpac/gpac/issues/1421
## Description:
Issue: gpac/gpac#1421
Title: AddressSanitizer: heap-buffer-overflow media_tools/mpegts.c:2163 in gf_m2ts_process_pmt
State: closed
Created by: dr3dd589
Created at: 2020-02-29 21:56:39+00:00

Issue Body:
Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [x] I looked for a similar issue and couldn't find any.
- [x] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [x] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/

System info:
Ubuntu 18.04.6 LTS, X64, gcc version 7.4.0, gpac (latest master 4a7a63)

Compile Command:
```asm
$ CC="gcc -fsanitize=address -g" CXX="g++ -fsanitize=address -g" ./configure --static-mp4box
$ make
```
Run Command:

```asm
./MP4Box -dash 1000 crsh1
```

ASAN info:
```asm
=================================================================
==9568==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000491 at pc 0x55a56f2ac689 bp 0x7fff440c4d00 sp 0x7fff440c4cf0
READ of size 1 at 0x602000000491 thread T0
    #0 0x55a56f2ac688 in gf_m2ts_process_pmt media_tools/mpegts.c:2163
    #1 0x55a56f29e975 in gf_m2ts_section_complete media_tools/mpegts.c:1610
    #2 0x55a56f29f3ab in gf_m2ts_gather_section media_tools/mpegts.c:1740
    #3 0x55a56f2a519e in gf_m2ts_process_packet media_tools/mpegts.c:3446
    #4 0x55a56f2a519e in gf_m2ts_process_data media_tools/mpegts.c:3507
    #5 0x55a56f2b4886 in gf_m2ts_probe_file media_tools/mpegts.c:4641
    #6 0x55a56f1dc7f0 in gf_dash_segmenter_probe_input media_tools/dash_segmenter.c:5505
    #7 0x55a56f20350a in gf_dasher_add_input media_tools/dash_segmenter.c:6669
    #8 0x55a56eddea6f in mp4boxMain /home/dr3dd/fuzzing/gpac/applications/mp4box/main.c:4704
    #9 0x7f56187cfb96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #10 0x55a56edcd7a9 in _start (/home/dr3dd/fuzzing/gpac/bin/gcc/MP4Box+0x1657a9)

0x602000000491 is located 0 bytes to the right of 1-byte region [0x602000000490,0x602000000491)
allocated by thread T0 here:
    #0 0x7f5619457b50 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb50)
    #1 0x55a56f29dfb5 in gf_m2ts_section_complete media_tools/mpegts.c:1550
    #2 0x55a56f664196  (/home/dr3dd/fuzzing/gpac/bin/gcc/MP4Box+0x9fc196)

SUMMARY: AddressSanitizer: heap-buffer-overflow media_tools/mpegts.c:2163 in gf_m2ts_process_pmt
Shadow bytes around the buggy address:
  0x0c047fff8040: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8050: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8060: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8070: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8080: fa fa 00 00 fa fa 03 fa fa fa 00 00 fa fa 00 00
=>0x0c047fff8090: fa fa[01]fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff80e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==9568==ABORTING
```
gdb Info:

```asm
Program received signal SIGSEGV, Segmentation fault.
0x0000555555d47488 in gf_m2ts_process_pmt (ts=<optimized out>, pmt=<optimized out>, sections=<optimized out>, table_id=<optimized out>, ex_table_id=<optimized out>, 
    version_number=<optimized out>, last_section_number=<optimized out>, status=<optimized out>) at media_tools/mpegts.c:2541
2541			if (es->stream_type == GF_M2TS_VIDEO_HEVC) nb_hevc++;
(gdb) bt
#0  0x0000555555d47488 in gf_m2ts_process_pmt (ts=<optimized out>, pmt=<optimized out>, sections=<optimized out>, table_id=<optimized out>, ex_table_id=<optimized out>, 
    version_number=<optimized out>, last_section_number=<optimized out>, status=<optimized out>) at media_tools/mpegts.c:2541
#1  0x0000555555d35506 in gf_m2ts_section_complete (ts=ts@entry=0x5555562c5a40, sec=sec@entry=0x5555562d74a0, ses=ses@entry=0x5555562d73f0) at media_tools/mpegts.c:1610
#2  0x0000555555d3638a in gf_m2ts_gather_section (ts=ts@entry=0x5555562c5a40, sec=0x5555562d74a0, ses=ses@entry=0x5555562d73f0, data=0x7ffffffa680d "", 
    data@entry=0x7ffffffa67ef "", data_size=<optimized out>, hdr=<optimized out>, hdr=<optimized out>) at media_tools/mpegts.c:1740
#3  0x0000555555d3f3be in gf_m2ts_process_packet (data=0x7ffffffa67ef "", ts=0x5555562c5a40) at media_tools/mpegts.c:3446
#4  gf_m2ts_process_data (ts=ts@entry=0x5555562c5a40, data=data@entry=0x7ffffffa66e0 "\377\377\377\376zWCG@", data_size=<optimized out>) at media_tools/mpegts.c:3507
#5  0x0000555555d54ca1 in gf_m2ts_probe_file (fileName=<optimized out>) at media_tools/mpegts.c:4641
#6  0x0000555555bf0844 in gf_dash_segmenter_probe_input (io_dash_inputs=io_dash_inputs@entry=0x5555562c4978, nb_dash_inputs=nb_dash_inputs@entry=0x5555562c4980, 
    idx=idx@entry=0) at media_tools/dash_segmenter.c:5505
#7  0x0000555555c2dabb in gf_dasher_add_input (dasher=0x5555562c4970, input=<optimized out>) at media_tools/dash_segmenter.c:6669
#8  0x00005555555c88f5 in mp4boxMain (argc=<optimized out>, argv=<optimized out>) at main.c:4704
#9  0x00007ffff722bb97 in __libc_start_main () from /lib/x86_64-linux-gnu/libc.so.6
#10 0x00005555555a3e0a in _start () at main.c:5985
(gdb)
```
here is crash file:
[crsh1.zip](https://github.com/gpac/gpac/files/4271005/crsh1.zip)


Attachments:
https://github.com/gpac/gpac/files/4271005/crsh1.zip

Commit References:
eec9e058a9486fe4e99c33021481d9e1826ca9db

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./configure --static-build --extra-cflags="${CFLAGS}" --extra-ldflags="${CFLAGS}"
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y build-essential pkg-config libz-dev
RUN git clone https://github.com/gpac/gpac gpac
RUN git -C gpac checkout ad3ca600020e01dd514874ab67c28b53c57d0d4c
WORKDIR $SRC/gpac
COPY build.sh $SRC/

Additional files:
filename: fuzz_parse.c
content: /* Copyright 2021 Google LLC
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
      http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#include <stdio.h>
#include <unistd.h>

#include <gpac/internal/isomedia_dev.h>
#include <gpac/constants.h>

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
    char filename[256];
    sprintf(filename, "/tmp/libfuzzer.%d", getpid());

    FILE *fp = fopen(filename, "wb");
    if (!fp) {
        return 0;
    }
    fwrite(data, size, 1, fp);
    fclose(fp);

    GF_ISOFile *movie = NULL;
    movie = gf_isom_open_file(filename, GF_ISOM_OPEN_READ_DUMP, NULL);
    if (movie != NULL) {
        gf_isom_close(movie);
    }
    unlink(filename);
    return 0;
}