Project: gpac (gpac/gpac), language: c++
Vulnerability instance: gpac.cve-2022-27148
Sanitizer: undefined

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/gpac/gpac/issues/2067
## Description:
Issue: gpac/gpac#2067
Title: Signed integer overflow
State: closed
Created by: AAArdu
Created at: 2022-01-26 05:27:46+00:00

Issue Body:
## Description
There are some signed-integer-overflow caused runtime error and are detected by UndefinedBehaviorSanitizer

## System info
```
Ubuntu 20.04.2 LTS
clang version 12.0.0-++20210402082642+04ba60cfe598-1~exp1~20210402063359.71
MP4Box - GPAC version 1.1.0-DEV-rev1663-g881c6a94a-master
```

## Build command
```
./configure --static-mp4box --prefix=`realpath ./install` --enable-sanitizer --cc=clang --cxx=clang++
```

## Crash command
MP4Box -isma -timescale 600 -out /dev/null poc_file

## Pocs
[POCs](https://drive.google.com/file/d/1MuTp6ebwU_2ybz1VJxJ0b6LSx-ISyGUX/view?usp=sharing)

## Crash output
poc_3
```
media_tools/av_parsers.c:5271:24: runtime error: signed integer overflow: 160041545 * 16 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior media_tools/av_parsers.c:5271:24 in /zhengjie/collect/collec.sh: line 13:  9327 Aborted (core dumped) 
```
poc_9
```
[iso file] Box "oinf" size 15 (start 0) invalid (read 18)
[iso file] Unknown top-level box type )85B691
[ODF] Error reading descriptor (tag 2 size 1): Invalid MPEG-4 Descriptor
[iso file] Box "sinf" (start 635) has 81 extra bytes
[ODF] Error reading descriptor (tag 2 size 1): Invalid MPEG-4 Descriptor
[ODF] Not enough bytes (11) to read descriptor (size=81)
[ODF] Error reading descriptor (tag 2 size 17): Invalid MPEG-4 Descriptor
[iso file] Box "stco" (start 859) has 239 extra bytes
[iso file] Box "stco" is larger than container box
[iso file] Box "stbl" size 339 (start 536) invalid (read 578)
[iso file] Unknown box type mvex in parent minf
[iso file] Unknown box type moov in parent minf
[iso file] Unknown box type 00000000 in parent minf
[iso file] Unknown box type u7Fl  in parent minf
media_tools/av_parsers.c:5271:24: runtime error: signed integer overflow: 551209680 * 16 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior media_tools/av_parsers.c:5271:24 in /zhengjie/collect/collec.sh: line 13: 16205 Aborted (core dumped)
```
poc_19
```
media_tools/av_parsers.c:5271:24: runtime error: signed integer overflow: 414855863 * 16 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior media_tools/av_parsers.c:5271:24 in /zhengjie/collect/collec.sh: line 13: 27854 Aborted (core dumped)
```


Comments:
Comment by AAArdu on 2022-01-27 09:07:35+00:00:
Sorry for uploading the wrong POC.
Here is the true POC
[poc.zip](https://github.com/gpac/gpac/files/7949089/poc.zip)



Attachments:
https://github.com/gpac/gpac/files/7949089/poc.zip

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./configure --static-build --extra-cflags="${CFLAGS}" --extra-ldflags="${CFLAGS}"
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y build-essential pkg-config libz-dev
RUN git clone https://github.com/gpac/gpac gpac
RUN git -C gpac checkout 62bbb9f3977e358631ef395625471bbcf284785e
WORKDIR $SRC/gpac
COPY build.sh $SRC/

Additional files: