Project: gpac (gpac/gpac), language: c++
Vulnerability instance: gpac.cve-2021-32270
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/gpac/gpac/issues/1586
## Description:
Issue: gpac/gpac#1586
Title: A Segmentation fault in box_code_base.c:11579
State: closed
Created by: seviezhou
Created at: 2020-09-04 14:58:11+00:00

Issue Body:
## System info

Ubuntu x86_64, gcc (Ubuntu 5.5.0-12ubuntu1), MP4Box (latest master [5a884e](https://github.com/gpac/gpac/commit/5a884e376e1f67b3d40ec91c0b70ab49219fe3cd))

## Configure

CFLAGS="-g -fsanitize=address" LDFLAGS="-fsanitize=address" ./configure --static-mp4box

## Command line

./bin/gcc/MP4Box -diso -out /dev/null @@

## AddressSanitizer output

```
ASAN:SIGSEGV
=================================================================
==14934==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x556b734996bc bp 0x0c0c00001d9e sp 0x7fffb5212f80 T0)
    #0 0x556b734996bb in vwid_box_del isomedia/box_code_base.c:11579
    #1 0x556b721a79de in gf_isom_box_del isomedia/box_funcs.c:1668
    #2 0x556b721ab705 in gf_isom_box_parse_ex isomedia/box_funcs.c:295
    #3 0x556b721ac7a1 in gf_isom_parse_root_box isomedia/box_funcs.c:38
    #4 0x556b721e2f9c in gf_isom_parse_movie_boxes isomedia/isom_intern.c:259
    #5 0x556b721ede7e in gf_isom_parse_movie_boxes isomedia/isom_intern.c:247
    #6 0x556b721ede7e in gf_isom_open_file isomedia/isom_intern.c:740
    #7 0x556b71b167df in mp4boxMain /home/seviezhou/gpac/applications/mp4box/main.c:5333
    #8 0x7f5bcfaeeb96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #9 0x556b71ae9be9 in _start (/home/seviezhou/gpac/bin/gcc/MP4Box+0x280be9)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV isomedia/box_code_base.c:11579 vwid_box_del
==14934==ABORTING
```

## POC

[SEGV-vwid_box_del-box_code_base-11579.zip](https://github.com/gpac/gpac/files/5175561/SEGV-vwid_box_del-box_code_base-11579.zip)



Attachments:
https://github.com/gpac/gpac/files/5175561/SEGV-vwid_box_del-box_code_base-11579.zip

Commit References:
5a884e376e1f67b3d40ec91c0b70ab49219fe3cd

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./configure --static-build --extra-cflags="${CFLAGS}" --extra-ldflags="${CFLAGS}"
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y build-essential pkg-config libz-dev
RUN git clone https://github.com/gpac/gpac gpac
RUN git -C gpac checkout 9d593d5d7fd48bb4ab6d90b40f79faf9c6270136
WORKDIR $SRC/gpac
COPY build.sh $SRC/

Additional files:
filename: fuzz_parse.c
content: /* Copyright 2021 Google LLC
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
      http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#include <stdio.h>
#include <unistd.h>

#include <gpac/internal/isomedia_dev.h>
#include <gpac/constants.h>

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
    char filename[256];
    sprintf(filename, "/tmp/libfuzzer.%d", getpid());

    FILE *fp = fopen(filename, "wb");
    if (!fp) {
        return 0;
    }
    fwrite(data, size, 1, fp);
    fclose(fp);

    GF_ISOFile *movie = NULL;
    movie = gf_isom_open_file(filename, GF_ISOM_OPEN_READ_DUMP, NULL);
    if (movie != NULL) {
        gf_isom_close(movie);
    }
    unlink(filename);
    return 0;
}