Project: gpac (gpac/gpac), language: c++
Vulnerability instance: gpac.cve-2022-24576
Sanitizer: address

================= Bug Report (1/2) ==================
## Source: GitHub Issue
## URL: https://github.com/gpac/gpac/issues/2061
## Description:
Issue: gpac/gpac#2061
Title: Heap-based Buffer Overflow
State: closed
Created by: rbouqueau
Created at: 2022-01-21 08:56:18+00:00

Issue Body:


```
Proof of Concept

Version:

MP4Box - GPAC version 1.1.0-DEV-rev1646-gddd7990bb-master
(c) 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
        GPAC Filters: https://doi.org/10.1145/3339825.3394929
        GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --prefix=/home/aidai/fuzzing/gpac/
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D

System information Ubuntu 20.04 focal, AMD EPYC 7742 64-Core @ 16x 2.25GHz

poc

base64 poc
//7/AGUKCio=

command:

./MP4Box -info poc

Result

=================================================================
==1529455==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000001a1a at pc 0x00000043e343 bp 0x7ffeafafa9a0 sp 0x7ffeafafa158
READ of size 11 at 0x602000001a1a thread T0
    #0 0x43e342 in StrstrCheck(void*, char*, char const*, char const*) (/home/aidai/fuzzing/gpac/gpac-asan/bin/gcc/MP4Box+0x43e342)
    #1 0x43e171 in strstr (/home/aidai/fuzzing/gpac/gpac-asan/bin/gcc/MP4Box+0x43e171)
    #2 0x7f61341e32d7 in ctxload_probe_data /home/aidai/fuzzing/gpac/gpac-asan/src/filters/load_bt_xmt.c:837:6
    #3 0x7f6134037b52 in gf_filter_pid_raw_new /home/aidai/fuzzing/gpac/gpac-asan/src/filter_core/filter.c:3777:13
    #4 0x7f6134153a31 in filein_process /home/aidai/fuzzing/gpac/gpac-asan/src/filters/in_file.c:481:7
    #5 0x7f6134030e3a in gf_filter_process_task /home/aidai/fuzzing/gpac/gpac-asan/src/filter_core/filter.c:2515:7
    #6 0x7f613401015f in gf_fs_thread_proc /home/aidai/fuzzing/gpac/gpac-asan/src/filter_core/filter_session.c:1756:3
    #7 0x7f613400de3e in gf_fs_run /home/aidai/fuzzing/gpac/gpac-asan/src/filter_core/filter_session.c:2000:2
    #8 0x7f6133c4d27e in gf_media_import /home/aidai/fuzzing/gpac/gpac-asan/src/media_tools/media_import.c:1218:3
    #9 0x524fe4 in convert_file_info /home/aidai/fuzzing/gpac/gpac-asan/applications/mp4box/fileimport.c:128:6
    #10 0x4f45c2 in mp4boxMain /home/aidai/fuzzing/gpac/gpac-asan/applications/mp4box/main.c:6063:6
    #11 0x7f61332740b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
    #12 0x429b7d in _start (/home/aidai/fuzzing/gpac/gpac-asan/bin/gcc/MP4Box+0x429b7d)

0x602000001a1a is located 0 bytes to the right of 10-byte region [0x602000001a10,0x602000001a1a)
allocated by thread T0 here:
    #0 0x4a22bd in malloc (/home/aidai/fuzzing/gpac/gpac-asan/bin/gcc/MP4Box+0x4a22bd)
    #1 0x7f613372a4fb in gf_utf_get_utf8_string_from_bom /home/aidai/fuzzing/gpac/gpac-asan/src/utils/utf.c:680:14

SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/aidai/fuzzing/gpac/gpac-asan/bin/gcc/MP4Box+0x43e342) in StrstrCheck(void*, char*, char const*, char const*)
Shadow bytes around the buggy address:
  0x0c047fff82f0: fa fa 00 00 fa fa 04 fa fa fa 04 fa fa fa 00 00
  0x0c047fff8300: fa fa 00 00 fa fa 04 fa fa fa 00 00 fa fa 06 fa
  0x0c047fff8310: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8320: fa fa 00 00 fa fa fd fa fa fa 00 00 fa fa 00 00
  0x0c047fff8330: fa fa 04 fa fa fa 04 fa fa fa 04 fa fa fa fd fd
=>0x0c047fff8340: fa fa 00[02]fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8350: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8360: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8370: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8390: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==1529455==ABORTING

```


================= Bug Report (2/2) ==================
## Source: Huntr
## URL: https://huntr.dev/bounties/011ac07c-6139-4f43-b745-424143e60ac7/
## Description:
Description
Use After Free in gpac
Proof of Concept
MP4Box -bt POC4
MP4Box -bt POC5
POC4 is here. POC5 is here.
ASAN
==414586==ERROR: AddressSanitizer: heap-use-after-free on address 0x6100000007fc at pc 0x7f7926081250 bp 0x7ffd2e84f4a0 sp 0x7ffd2e84f490
READ of size 4 at 0x6100000007fc thread T0
    #0 0x7f792608124f in BD_ReadSFFloat bifs/field_decode.c:68
    #1 0x7f792608124f in gf_bifs_dec_sf_field bifs/field_decode.c:112
    #2 0x7f79260835ca in gf_bifs_dec_node_mask bifs/field_decode.c:656
    #3 0x7f792607d212 in gf_bifs_dec_node bifs/field_decode.c:918
    #4 0x7f7926068f24 in gf_bifs_dec_proto_list bifs/com_dec.c:1143
    #5 0x7f7926068eff in gf_bifs_dec_proto_list bifs/com_dec.c:1132
    #6 0x7f7926069790 in BD_DecSceneReplace bifs/com_dec.c:1351
    #7 0x7f792609318a in BM_SceneReplace bifs/memory_decoder.c:860
    #8 0x7f7926093b6e in BM_ParseCommand bifs/memory_decoder.c:910
    #9 0x7f79260946fc in gf_bifs_decode_command_list bifs/memory_decoder.c:1019
    #10 0x7f7926631eac in gf_sm_load_run_isom scene_manager/loader_isom.c:303
    #11 0x556d347e807b in dump_isom_scene /home/zxq/CVE_testing/ASAN-install/gpac/applications/mp4box/filedump.c:203
    #12 0x556d347d2d60 in mp4boxMain /home/zxq/CVE_testing/ASAN-install/gpac/applications/mp4box/main.c:6146
    #13 0x7f79236610b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #14 0x556d347aeb1d in _start (/home/zxq/CVE_testing/ASAN-install/gpac/bin/gcc/MP4Box+0xa6b1d)

0x6100000007fc is located 188 bytes inside of 192-byte region [0x610000000740,0x610000000800)
freed by thread T0 here:
    #0 0x7f792974d7cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
    #1 0x7f7925d2df6d in gf_node_unregister scenegraph/base_scenegraph.c:761
    #2 0x7f7925d2eb05 in gf_node_unregister_children scenegraph/base_scenegraph.c:1369
    #3 0x7f7925ee916e in gf_sg_vrml_parent_destroy scenegraph/vrml_tools.c:161
    #4 0x7f7925dfdedd in TemporalTransform_Del scenegraph/mpeg4_nodes.c:22212
    #5 0x7f7925dfdedd in gf_sg_mpeg4_node_del scenegraph/mpeg4_nodes.c:37853
    #6 0x7f7925d2df6d in gf_node_unregister scenegraph/base_scenegraph.c:761
    #7 0x7f792607de2f in gf_bifs_dec_node bifs/field_decode.c:930
    #8 0x7f7926068f24 in gf_bifs_dec_proto_list bifs/com_dec.c:1143
    #9 0x7f7926069790 in BD_DecSceneReplace bifs/com_dec.c:1351
    #10 0x7f792609318a in BM_SceneReplace bifs/memory_decoder.c:860
    #11 0x7f7926093b6e in BM_ParseCommand bifs/memory_decoder.c:910
    #12 0x7f7926093e69 in gf_bifs_flush_command_list bifs/memory_decoder.c:951
    #13 0x7f7926068f4a in gf_bifs_dec_proto_list bifs/com_dec.c:1162
    #14 0x7f7926068eff in gf_bifs_dec_proto_list bifs/com_dec.c:1132
    #15 0x7f7926069790 in BD_DecSceneReplace bifs/com_dec.c:1351
    #16 0x7f792609318a in BM_SceneReplace bifs/memory_decoder.c:860
    #17 0x7f7926093b6e in BM_ParseCommand bifs/memory_decoder.c:910
    #18 0x7f79260946fc in gf_bifs_decode_command_list bifs/memory_decoder.c:1019
    #19 0x7f7926631eac in gf_sm_load_run_isom scene_manager/loader_isom.c:303
    #20 0x556d347e807b in dump_isom_scene /home/zxq/CVE_testing/ASAN-install/gpac/applications/mp4box/filedump.c:203
    #21 0x556d347d2d60 in mp4boxMain /home/zxq/CVE_testing/ASAN-install/gpac/applications/mp4box/main.c:6146
    #22 0x7f79236610b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

previously allocated by thread T0 here:
    #0 0x7f792974dbc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
    #1 0x7f7925ddc107 in QuantizationParameter_Create scenegraph/mpeg4_nodes.c:12496
    #2 0x7f7925d2fe86 in gf_node_new scenegraph/base_scenegraph.c:1994
    #3 0x7f792607d185 in gf_bifs_dec_node bifs/field_decode.c:892
    #4 0x7f79260824a1 in BD_DecMFFieldVec bifs/field_decode.c:432
    #5 0x7f7926082b2d in gf_bifs_dec_field bifs/field_decode.c:558
    #6 0x7f7926083035 in gf_bifs_dec_node_list bifs/field_decode.c:618
    #7 0x7f792607cfd4 in gf_bifs_dec_node bifs/field_decode.c:920
    #8 0x7f7926068f24 in gf_bifs_dec_proto_list bifs/com_dec.c:1143
    #9 0x7f7926069790 in BD_DecSceneReplace bifs/com_dec.c:1351
    #10 0x7f792609318a in BM_SceneReplace bifs/memory_decoder.c:860
    #11 0x7f7926093b6e in BM_ParseCommand bifs/memory_decoder.c:910
    #12 0x7f7926093e69 in gf_bifs_flush_command_list bifs/memory_decoder.c:951
    #13 0x7f7926068f4a in gf_bifs_dec_proto_list bifs/com_dec.c:1162
    #14 0x7f7926068eff in gf_bifs_dec_proto_list bifs/com_dec.c:1132
    #15 0x7f7926069790 in BD_DecSceneReplace bifs/com_dec.c:1351
    #16 0x7f792609318a in BM_SceneReplace bifs/memory_decoder.c:860
    #17 0x7f7926093b6e in BM_ParseCommand bifs/memory_decoder.c:910
    #18 0x7f79260946fc in gf_bifs_decode_command_list bifs/memory_decoder.c:1019
    #19 0x7f7926631eac in gf_sm_load_run_isom scene_manager/loader_isom.c:303
    #20 0x556d347e807b in dump_isom_scene /home/zxq/CVE_testing/ASAN-install/gpac/applications/mp4box/filedump.c:203
    #21 0x556d347d2d60 in mp4boxMain /home/zxq/CVE_testing/ASAN-install/gpac/applications/mp4box/main.c:6146
    #22 0x7f79236610b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: heap-use-after-free bifs/field_decode.c:68 in BD_ReadSFFloat
Shadow bytes around the buggy address:
  0x0c207fff80a0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c207fff80b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c207fff80c0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c207fff80d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c207fff80e0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c207fff80f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]
  0x0c207fff8100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c207fff8110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c207fff8120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c207fff8130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c207fff8140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==414586==ABORTING
==1293588==ERROR: AddressSanitizer: heap-use-after-free on address 0x6100000004e4 at pc 0x7f13db4147f8 bp 0x7ffd9ad3c8c0 sp 0x7ffd9ad3c8b0
READ of size 4 at 0x6100000004e4 thread T0
    #0 0x7f13db4147f7 in Q_IsTypeOn bifs/unquantize.c:185
    #1 0x7f13db41a3f4 in gf_bifs_dec_unquant_field bifs/unquantize.c:397
    #2 0x7f13db3e3b4a in gf_bifs_dec_sf_field bifs/field_decode.c:84
    #3 0x7f13db3e767f in BD_DecMFFieldVec bifs/field_decode.c:426
    #4 0x7f13db3e7b2d in gf_bifs_dec_field bifs/field_decode.c:558
    #5 0x7f13db3e8035 in gf_bifs_dec_node_list bifs/field_decode.c:618
    #6 0x7f13db3e1fd4 in gf_bifs_dec_node bifs/field_decode.c:920
    #7 0x7f13db3cdf24 in gf_bifs_dec_proto_list bifs/com_dec.c:1143
    #8 0x7f13db3ce790 in BD_DecSceneReplace bifs/com_dec.c:1351
    #9 0x7f13db3f818a in BM_SceneReplace bifs/memory_decoder.c:860
    #10 0x7f13db3f8b6e in BM_ParseCommand bifs/memory_decoder.c:910
    #11 0x7f13db3f96fc in gf_bifs_decode_command_list bifs/memory_decoder.c:1019
    #12 0x7f13db996eac in gf_sm_load_run_isom scene_manager/loader_isom.c:303
    #13 0x56255741007b in dump_isom_scene /home/zxq/CVE_testing/ASAN-install/gpac/applications/mp4box/filedump.c:203
    #14 0x5625573fad60 in mp4boxMain /home/zxq/CVE_testing/ASAN-install/gpac/applications/mp4box/main.c:6146
    #15 0x7f13d89c60b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #16 0x5625573d6b1d in _start (/home/zxq/CVE_testing/ASAN-install/gpac/bin/gcc/MP4Box+0xa6b1d)

0x6100000004e4 is located 164 bytes inside of 192-byte region [0x610000000440,0x610000000500)
freed by thread T0 here:
    #0 0x7f13deab27cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
    #1 0x7f13db092f6d in gf_node_unregister scenegraph/base_scenegraph.c:761
    #2 0x7f13db093b05 in gf_node_unregister_children scenegraph/base_scenegraph.c:1369
    #3 0x7f13db24e16e in gf_sg_vrml_parent_destroy scenegraph/vrml_tools.c:161
    #4 0x7f13db162edd in TemporalTransform_Del scenegraph/mpeg4_nodes.c:22212
    #5 0x7f13db162edd in gf_sg_mpeg4_node_del scenegraph/mpeg4_nodes.c:37853
    #6 0x7f13db092f6d in gf_node_unregister scenegraph/base_scenegraph.c:761
    #7 0x7f13db3e2e2f in gf_bifs_dec_node bifs/field_decode.c:930
    #8 0x7f13db3cdf24 in gf_bifs_dec_proto_list bifs/com_dec.c:1143
    #9 0x7f13db3ce790 in BD_DecSceneReplace bifs/com_dec.c:1351
    #10 0x7f13db3f818a in BM_SceneReplace bifs/memory_decoder.c:860
    #11 0x7f13db3f8b6e in BM_ParseCommand bifs/memory_decoder.c:910
    #12 0x7f13db3f8e69 in gf_bifs_flush_command_list bifs/memory_decoder.c:951
    #13 0x7f13db3cdf4a in gf_bifs_dec_proto_list bifs/com_dec.c:1162
    #14 0x7f13db3cdeff in gf_bifs_dec_proto_list bifs/com_dec.c:1132
    #15 0x7f13db3ce790 in BD_DecSceneReplace bifs/com_dec.c:1351
    #16 0x7f13db3f818a in BM_SceneReplace bifs/memory_decoder.c:860
    #17 0x7f13db3f8b6e in BM_ParseCommand bifs/memory_decoder.c:910
    #18 0x7f13db3f96fc in gf_bifs_decode_command_list bifs/memory_decoder.c:1019
    #19 0x7f13db996eac in gf_sm_load_run_isom scene_manager/loader_isom.c:303
    #20 0x56255741007b in dump_isom_scene /home/zxq/CVE_testing/ASAN-install/gpac/applications/mp4box/filedump.c:203
    #21 0x5625573fad60 in mp4boxMain /home/zxq/CVE_testing/ASAN-install/gpac/applications/mp4box/main.c:6146
    #22 0x7f13d89c60b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

previously allocated by thread T0 here:
    #0 0x7f13deab2bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
    #1 0x7f13db141107 in QuantizationParameter_Create scenegraph/mpeg4_nodes.c:12496
    #2 0x7f13db094e86 in gf_node_new scenegraph/base_scenegraph.c:1994
    #3 0x7f13db3e2185 in gf_bifs_dec_node bifs/field_decode.c:892
    #4 0x7f13db3e74a1 in BD_DecMFFieldVec bifs/field_decode.c:432
    #5 0x7f13db3e7b2d in gf_bifs_dec_field bifs/field_decode.c:558
    #6 0x7f13db3e8035 in gf_bifs_dec_node_list bifs/field_decode.c:618
    #7 0x7f13db3e1fd4 in gf_bifs_dec_node bifs/field_decode.c:920
    #8 0x7f13db3cdf24 in gf_bifs_dec_proto_list bifs/com_dec.c:1143
    #9 0x7f13db3ce790 in BD_DecSceneReplace bifs/com_dec.c:1351
    #10 0x7f13db3f818a in BM_SceneReplace bifs/memory_decoder.c:860
    #11 0x7f13db3f8b6e in BM_ParseCommand bifs/memory_decoder.c:910
    #12 0x7f13db3f8e69 in gf_bifs_flush_command_list bifs/memory_decoder.c:951
    #13 0x7f13db3cdf4a in gf_bifs_dec_proto_list bifs/com_dec.c:1162
    #14 0x7f13db3cdeff in gf_bifs_dec_proto_list bifs/com_dec.c:1132
    #15 0x7f13db3ce790 in BD_DecSceneReplace bifs/com_dec.c:1351
    #16 0x7f13db3f818a in BM_SceneReplace bifs/memory_decoder.c:860
    #17 0x7f13db3f8b6e in BM_ParseCommand bifs/memory_decoder.c:910
    #18 0x7f13db3f96fc in gf_bifs_decode_command_list bifs/memory_decoder.c:1019
    #19 0x7f13db996eac in gf_sm_load_run_isom scene_manager/loader_isom.c:303
    #20 0x56255741007b in dump_isom_scene /home/zxq/CVE_testing/ASAN-install/gpac/applications/mp4box/filedump.c:203
    #21 0x5625573fad60 in mp4boxMain /home/zxq/CVE_testing/ASAN-install/gpac/applications/mp4box/main.c:6146
    #22 0x7f13d89c60b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: heap-use-after-free bifs/unquantize.c:185 in Q_IsTypeOn
Shadow bytes around the buggy address:
  0x0c207fff8040: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c207fff8050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05
  0x0c207fff8060: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c207fff8070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c207fff8080: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c207fff8090: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd
  0x0c207fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c207fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c207fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c207fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c207fff80e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==1293588==ABORTING

Relevant Links:
https://github.com/gpac/gpac
https://drive.google.com/file/d/1XMZOm8qcWPBUDH5rmZzIQvis6X9E9n_i/view?usp=sharing
https://drive.google.com/file/d/1sBydrjdd5hP9L81sWHWCiXhDA-8Djv5p/view?usp=sharing

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./configure --static-build --extra-cflags="${CFLAGS}" --extra-ldflags="${CFLAGS}"
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y build-essential pkg-config libz-dev
RUN git clone https://github.com/gpac/gpac gpac
RUN git -C gpac checkout d8538e8ae946b32d99c6b2c57cbb327146e9cd9d
WORKDIR $SRC/gpac
COPY build.sh $SRC/

Additional files:
filename: fuzz_parse.c
content: /* Copyright 2021 Google LLC
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
      http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#include <stdio.h>
#include <unistd.h>

#include <gpac/internal/isomedia_dev.h>
#include <gpac/constants.h>

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
    char filename[256];
    sprintf(filename, "/tmp/libfuzzer.%d", getpid());

    FILE *fp = fopen(filename, "wb");
    if (!fp) {
        return 0;
    }
    fwrite(data, size, 1, fp);
    fclose(fp);

    GF_ISOFile *movie = NULL;
    movie = gf_isom_open_file(filename, GF_ISOM_OPEN_READ_DUMP, NULL);
    if (movie != NULL) {
        gf_isom_close(movie);
    }
    unlink(filename);
    return 0;
}