Project: gpac (gpac/gpac), language: c++
Vulnerability instance: gpac.cve-2021-41456
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/gpac/gpac/issues/1911
## Description:
Issue: gpac/gpac#1911
Title: Stack-buffer-overflow in MP4Box at src/filters/dmx_nhml.c:1004 in nhmldmx_send_sample
State: closed
Created by: AntsKnows
Created at: 2021-09-07 16:21:54+00:00

Issue Body:
Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [x] I looked for a similar issue and couldn't find any.
- [x] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [x] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). 


Step to reproduce:

1.get latest commit code (GPAC version 1.1.0-DEV-rev1221-gd626acad8-master)
2.compile with --enable-sanitizer
3.run MP4Box -add poc.nhml -new new.mp4
Env:
Ubunut 20.04 , clang 12.0.1

ASAN report

```
==344946==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffe54d816f0 at pc 0x000000491bf8 bp 0x7ffe54d80610 sp 0x7ffe54d7fdd0
WRITE of size 5081 at 0x7ffe54d816f0 thread T0
    #0 0x491bf7 in __interceptor_strcpy (/home/lly/pro/gpac_asan/bin/gcc/MP4Box+0x491bf7)
    #1 0x7fefcb5fca2d in nhmldmx_send_sample /home/lly/pro/gpac_asan/src/filters/dmx_nhml.c:1004:6
    #2 0x7fefcb5fca2d in nhmldmx_process /home/lly/pro/gpac_asan/src/filters/dmx_nhml.c:1341:7
    #3 0x7fefcb529997 in gf_filter_process_task /home/lly/pro/gpac_asan/src/filter_core/filter.c:2441:7
    #4 0x7fefcb50b965 in gf_fs_thread_proc /home/lly/pro/gpac_asan/src/filter_core/filter_session.c:1664:3
    #5 0x7fefcb50ae60 in gf_fs_run /home/lly/pro/gpac_asan/src/filter_core/filter_session.c:1901:2
    #6 0x7fefcb02c708 in gf_media_import /home/lly/pro/gpac_asan/src/media_tools/media_import.c:1486:2
    #7 0x526ea9 in import_file /home/lly/pro/gpac_asan/applications/mp4box/fileimport.c:1289:7
    #8 0x4eb996 in do_add_cat /home/lly/pro/gpac_asan/applications/mp4box/main.c:4257:10
    #9 0x4e7d46 in mp4boxMain /home/lly/pro/gpac_asan/applications/mp4box/main.c:5746:13
    #10 0x7fefca2ad0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
    #11 0x429a4d in _start (/home/lly/pro/gpac_asan/bin/gcc/MP4Box+0x429a4d)

Address 0x7ffe54d816f0 is located in stack of thread T0 at offset 4304 in frame
    #0 0x7fefcb5fb93f in nhmldmx_process /home/lly/pro/gpac_asan/src/filters/dmx_nhml.c:1314
```
[poc.zip](https://github.com/gpac/gpac/files/7122999/poc.zip)





Comments:
Comment by jeanlf on 2021-09-09 13:04:57+00:00:
now fixed, thanks for the report

Attachments:
https://github.com/gpac/gpac/files/7122999/poc.zip

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./configure --static-build --extra-cflags="${CFLAGS}" --extra-ldflags="${CFLAGS}"
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y build-essential pkg-config libz-dev
RUN git clone https://github.com/gpac/gpac gpac
RUN git -C gpac checkout d8538e8ae946b32d99c6b2c57cbb327146e9cd9d
WORKDIR $SRC/gpac
COPY build.sh $SRC/

Additional files:
filename: fuzz_parse.c
content: /* Copyright 2021 Google LLC
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
      http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#include <stdio.h>
#include <unistd.h>

#include <gpac/internal/isomedia_dev.h>
#include <gpac/constants.h>

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
    char filename[256];
    sprintf(filename, "/tmp/libfuzzer.%d", getpid());

    FILE *fp = fopen(filename, "wb");
    if (!fp) {
        return 0;
    }
    fwrite(data, size, 1, fp);
    fclose(fp);

    GF_ISOFile *movie = NULL;
    movie = gf_isom_open_file(filename, GF_ISOM_OPEN_READ_DUMP, NULL);
    if (movie != NULL) {
        gf_isom_close(movie);
    }
    unlink(filename);
    return 0;
}