Project: gpac (gpac/gpac), language: c++
Vulnerability instance: gpac.cve-2024-50664
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/gpac/gpac/issues/2988
## Description:
Issue: gpac/gpac#2988
Title: heap-buffer-overflow at isomedia/sample_descs.c:1799 in gf_isom_new_mpha_description in gpac/MP4Box
State: closed
Created by: Frank-Z7
Created at: 2024-10-07 12:09:15+00:00

Issue Body:
### Description

Dear developers, 

We found the following heap buffer overflow bug on gpac(version 2.4), please confirm.

The latest master branch and version 2.4 both have this bug.

### Version

```shell
MP4Box - GPAC version 2.4-rev0-g5d70253ac-HEAD
```

### ASAN Log

Fuzz Trigger command 1: 

./bin/gcc/MP4Box -dash 1000 -ps -dref -out /dev/null poc8gpac

Fuzz Trigger command 2: 

./bin/gcc/MP4Box -dash 500 -bo -bound -keep-utc -out /dev/null poc9gpac

Normal command:

./bin/gcc/MP4Box -dash 500 -out /dev/null poc9gpac

```shell
=================================================================
==3389396==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000003751 at pc 0x7f740dee42c3 bp 0x7ffc60ecac00 sp 0x7ffc60eca3a8
WRITE of size 14 at 0x602000003751 thread T0
    #0 0x7f740dee42c2 in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827
    #1 0x7f740ab53e89 in memcpy /usr/include/x86_64-linux-gnu/bits/string_fortified.h:29
    #2 0x7f740ab53e89 in gf_isom_new_mpha_description isomedia/sample_descs.c:1799
    #3 0x7f740b6737ce in mp4_mux_setup_pid filters/mux_isom.c:3055
    #4 0x7f740b2738f9 in gf_filter_pid_configure filter_core/filter_pid.c:893
    #5 0x7f740b27c61e in gf_filter_pid_connect_task filter_core/filter_pid.c:1260
    #6 0x7f740b2c3104 in gf_fs_thread_proc filter_core/filter_session.c:2144
    #7 0x7f740b2c7fce in gf_fs_run filter_core/filter_session.c:2451
    #8 0x7f740ac500ae in gf_dasher_process media_tools/dash_segmenter.c:1255
    #9 0x55ba9e0366d5 in do_dash /gpac2.4/applications/mp4box/mp4box.c:4832
    #10 0x55ba9e055617 in mp4box_main /gpac2.4/applications/mp4box/mp4box.c:6256
    #11 0x7f740817bd8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)
    #12 0x7f740817be3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f)
    #13 0x55ba9e02ff04 in _start (/gpac2.4/bin/gcc/MP4Box+0xadf04)

0x602000003751 is located 0 bytes to the right of 1-byte region [0x602000003750,0x602000003751)
allocated by thread T0 here:
    #0 0x7f740df5e887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x7f740ab53dd7 in gf_isom_new_mpha_description isomedia/sample_descs.c:1797
    #2 0x7f740b6737ce in mp4_mux_setup_pid filters/mux_isom.c:3055
    #3 0x7f740b2738f9 in gf_filter_pid_configure filter_core/filter_pid.c:893
    #4 0x7f740b27c61e in gf_filter_pid_connect_task filter_core/filter_pid.c:1260
    #5 0x7f740b2c3104 in gf_fs_thread_proc filter_core/filter_session.c:2144
    #6 0x7f740b2c7fce in gf_fs_run filter_core/filter_session.c:2451
    #7 0x7f740ac500ae in gf_dasher_process media_tools/dash_segmenter.c:1255
    #8 0x55ba9e0366d5 in do_dash /gpac2.4/applications/mp4box/mp4box.c:4832
    #9 0x55ba9e055617 in mp4box_main /gpac2.4/applications/mp4box/mp4box.c:6256
    #10 0x7f740817bd8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827 in __interceptor_memcpy
Shadow bytes around the buggy address:
  0x0c047fff8690: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff86a0: fa fa 00 00 fa fa 00 00 fa fa fd fa fa fa 00 00
  0x0c047fff86b0: fa fa 00 00 fa fa 00 01 fa fa 02 fa fa fa 00 00
  0x0c047fff86c0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff86d0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 04 fa
=>0x0c047fff86e0: fa fa 00 00 fa fa 00 00 fa fa[01]fa fa fa fa fa
  0x0c047fff86f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8710: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8720: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8730: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==3389396==ABORTING

```

### Reproduction

```shell
git clone https://github.com/gpac/gpac.git
cd gpac
./configure --enable-sanitizer
make -j24

./bin/gcc/MP4Box -dash 1000 -ps -dref -out /dev/null poc8gpac
# OR
./bin/gcc/MP4Box -dash 500 -bo -bound -keep-utc -out /dev/null poc9gpac
```

### PoC

poc8gpac: https://github.com/Frank-Z7/z-vulnerabilitys/blob/main/poc8gpac

poc9gpac: https://github.com/Frank-Z7/z-vulnerabilitys/blob/main/poc9gpac

### Reference

https://github.com/gpac/gpac

### Environment

```
ubuntu:20.04
gcc version 9.4.0 (Ubuntu 9.4.0-1ubuntu1~20.04.2)
clang version 10.0.0-4ubuntu1
afl-cc++4.09
```

*Thanks* *for* *your* *time*!


Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./configure --static-build --extra-cflags="${CFLAGS}" --extra-ldflags="${CFLAGS}"
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y build-essential pkg-config libz-dev
RUN git clone https://github.com/gpac/gpac gpac
RUN git -C gpac checkout 5d70253ac94e5840be7b86054131dd753af63cc7
WORKDIR $SRC/gpac
COPY build.sh $SRC/

Additional files: