Project: gpac (gpac/gpac), language: c++
Vulnerability instance: gpac.cve-2022-45204
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/gpac/gpac/issues/2307
## Description:
Issue: gpac/gpac#2307
Title: Memory Leak in dimC_box_read at isomedia/box_code_3gpp.c:1060
State: closed
Created by: Janette88
Created at: 2022-11-07 12:35:15+00:00

Issue Body:
### Description
Memory Leak in dimC_box_read at isomedia/box_code_3gpp.c:1060

### System info
ubuntu 20.04 lts
### 
version info:
```
./MP4Box -version
MP4Box - GPAC version 2.1-DEV-rev460-g9d963dc62-master
(c) 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
	GPAC Filters: https://doi.org/10.1145/3339825.3394929
	GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: 
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_LINUX_DVB  GPAC_DI
```
### compile
./configure --enable-sanitizer
make

### crash command:
./MP4Box -bt poc_ml

poc :
https://github.com/Janette88/test_pocs/blob/main/poc_ml

Here is  output by ASAN:
```
[ISOBMFF] AV1ConfigurationBox: read only 4 bytes (expected 16).
[iso file] Box "av1C" (start 20) has 12 extra bytes
[isom] not enough bytes in box dimC: 0 left, reading 1 (file isomedia/box_code_3gpp.c, line 1082)
[iso file] Read Box "dimC" (start 44) failed (Invalid IsoMedia File) - skipping
Error opening file /home/fuzz/test/poc_ml: Invalid IsoMedia File

=================================================================
==71539==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 2566 byte(s) in 1 object(s) allocated from:
    #0 0x7fe8c635f808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
    #1 0x7fe8c2ef8d39 in dimC_box_read isomedia/box_code_3gpp.c:1060
    #2 0x7fe8c2fb75c3 in gf_isom_box_read isomedia/box_funcs.c:1866
    #3 0x7fe8c2fb75c3 in gf_isom_box_parse_ex isomedia/box_funcs.c:271
    #4 0x7fe8c2fb8a15 in gf_isom_parse_root_box isomedia/box_funcs.c:38
    #5 0x7fe8c2fe1a8c in gf_isom_parse_movie_boxes_internal isomedia/isom_intern.c:378
    #6 0x7fe8c2fe7ca1 in gf_isom_parse_movie_boxes isomedia/isom_intern.c:868
    #7 0x7fe8c2fe7ca1 in gf_isom_open_file isomedia/isom_intern.c:988
    #8 0x55c56a3e9139 in mp4box_main /home/fuzz/gpac/applications/mp4box/mp4box.c:6209
    #9 0x7fe8c0558082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: 2566 byte(s) leaked in 1 allocation(s).
```
### code location:
```
GF_Err dimC_box_read(GF_Box *s, GF_BitStream *bs)
{
	u32 i, msize;
	GF_DIMSSceneConfigBox *p = (GF_DIMSSceneConfigBox *)s;

	ISOM_DECREASE_SIZE(p, 3);
	p->profile = gf_bs_read_u8(bs);
	p->level = gf_bs_read_u8(bs);
	p->pathComponents = gf_bs_read_int(bs, 4);
	p->fullRequestHost = gf_bs_read_int(bs, 1);
	p->streamType = gf_bs_read_int(bs, 1);
	p->containsRedundant = gf_bs_read_int(bs, 2);

	char *str = gf_malloc(sizeof(char)*(p->size+1));       //line 1060   here p->size+1 = 2566
	if (!str) return GF_OUT_OF_MEM;
	msize = (u32) p->size;
	str[msize] = 0;
	i=0;
	str[0]=0;
	while (i < msize) {
		ISOM_DECREASE_SIZE(p, 1);
		str[i] = gf_bs_read_u8(bs);
		if (!str[i]) break;
		i++;
	}
	if (i == msize) {
		gf_free(str);
		return GF_ISOM_INVALID_FILE;
	}

	p->textEncoding = gf_strdup(str);

	i=0;
	str[0]=0;
	while (i < msize) {
		ISOM_DECREASE_SIZE(p, 1);            //line :1082 not enough bytes in box dimC: 0 left, reading 1 

		str[i] = gf_bs_read_u8(bs);
		if (!str[i]) break;
		i++;
	}
	if (i == msize) {
		gf_free(str);
		return GF_ISOM_INVALID_FILE;
	}

	p->contentEncoding = gf_strdup(str);
	gf_free(str);
	if (!p->textEncoding || !p->contentEncoding)
		return GF_OUT_OF_MEM;
	return GF_OK;
}
```
ps: The issue could be verified using the poc in issue 2294 and 2296.  The patch of  issue 2294 and 2296 was not perfect because it still existed memory leak risk . 

ref:
https://github.com/gpac/gpac/issues/2294
https://github.com/gpac/gpac/issues/2296



Comments:
Comment by jeanlf on 2022-11-07 16:09:18+00:00:
indeed thanks for the cross-check

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./configure --static-build --extra-cflags="${CFLAGS}" --extra-ldflags="${CFLAGS}"
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y build-essential pkg-config libz-dev
RUN git clone https://github.com/gpac/gpac gpac
RUN git -C gpac checkout 65430e30593bb04579445e77df0a1207adfad357
WORKDIR $SRC/gpac
COPY build.sh $SRC/

Additional files: