GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer Overflow.
Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [X] I looked for a similar issue and couldn't find any.
- [X] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [X] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/

# Description

buffer overflow in gf_vvc_read_pps_bs_internal function of media_tools/av_parsers.c

```c
while (nb_ctb_left >= uni_size_ctb) {
	nb_ctb_left -= uni_size_ctb;
	pps->tile_cols_width_ctb[pps->num_tile_cols] = uni_size_ctb; // when pps->num_tile_cols == 30, overflow at pps->tile_cols_width_ctb
	pps->num_tile_cols++;
}
```

# Version info

```
MP4Box - GPAC version 2.1-DEV-rev574-g9d5bb184b-master
(c) 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
	GPAC Filters: https://doi.org/10.1145/3339825.3394929
	GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --enable-sanitizer
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SSL GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D
```

# Reproduce

compile and run

```
./configure --enable-sanitizer
make
./MP4Box import -add poc_bof3.mp4
```

Crash reported by sanitizer

```
[Core] exp-golomb read failed, not enough bits in bitstream !
[VVC] Warning: Error parsing NAL unit
[Core] exp-golomb read failed, not enough bits in bitstream !
media_tools/av_parsers.c:10964:28: runtime error: index 30 out of bounds for type 'u32 [30]'
```

# POC
[poc_bof3.zip](https://github.com/gpac/gpac/files/10199841/poc_bof3.zip)


# Impact

Potentially causing DoS and RCE

# Credit 

Xdchase


Another Buffer overflow in gf_vvc_read_pps_bs_internal function of media_tools/av_parsers.c
This is a GitHub Issue
repo:gpac
owner:gpac
Title : Another Buffer overflow in gf_vvc_read_pps_bs_internal function of media_tools/av_parsers.c
Issue date:

--- start body ---
Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [X] I looked for a similar issue and couldn't find any.
- [X] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [X] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/

# Description

buffer overflow in gf_vvc_read_pps_bs_internal function of media_tools/av_parsers.c

```c
while (nb_ctb_left >= uni_size_ctb) {
	nb_ctb_left -= uni_size_ctb;
	pps->tile_cols_width_ctb[pps->num_tile_cols] = uni_size_ctb; // when pps->num_tile_cols == 30, overflow at pps->tile_cols_width_ctb
	pps->num_tile_cols++;
}
```

# Version info

```
MP4Box - GPAC version 2.1-DEV-rev574-g9d5bb184b-master
(c) 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
	GPAC Filters: https://doi.org/10.1145/3339825.3394929
	GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --enable-sanitizer
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SSL GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D
```

# Reproduce

compile and run

```
./configure --enable-sanitizer
make
./MP4Box import -add poc_bof3.mp4
```

Crash reported by sanitizer

```
[Core] exp-golomb read failed, not enough bits in bitstream !
[VVC] Warning: Error parsing NAL unit
[Core] exp-golomb read failed, not enough bits in bitstream !
media_tools/av_parsers.c:10964:28: runtime error: index 30 out of bounds for type 'u32 [30]'
```

# POC
[poc_bof3.zip](https://github.com/gpac/gpac/files/10199841/poc_bof3.zip)


# Impact

Potentially causing DoS and RCE

# Credit 

Xdchase


--- end body ---

A buffer overflow vulnerability in the gf_vvc_read_pps_bs_internal function of GPAC's media_tools/av_parsers.c can lead to potential Denial of Service (DoS) and Remote Code Execution (RCE). The issue arises when the number of tile columns exceeds the allocated size of the array, causing an overflow when attempting to write to pps->tile_cols_width_ctb.