poc.py is available [here](https://drive.google.com/file/d/1iH28RyOdIbMDdUONKZSBbJU0Y6QiAEl_/view?usp=sharing)

```
Description

A malicious server can trigger an out-of-bounds heap write via a specially crafted SDP packet due to no bounds check when parsing time zone information into the AdjustmentTime and AdjustmentOffset fields of GF_SDPTiming.

(terminal 1)

python3 poc.py 31337

(terminal 2)

./configure --enable-sanitizer
make -j32
./bin/gcc/gpac -play rtsp://127.0.0.1:31337/test
ietf/sdp.c:624:27: runtime error: index 10 out of bounds for type 'u32 [10]'

GDB

Thread 1 "gpac" received signal SIGSEGV, Segmentation fault.
0x00007ffff7828932 in gf_sdp_info_parse () from /gpac/bin/gcc/libgpac.so.11
(gdb) bt
#0  0x00007ffff7828932 in gf_sdp_info_parse () at /gpac/bin/gcc/libgpac.so.11
#1  0x00007ffff7be6020 in rtpin_load_sdp () at /gpac/bin/gcc/libgpac.so.11
#2  0x00007ffff7be6d6c in rtpin_rtsp_describe_process () at /gpac/bin/gcc/libgpac.so.11
#3  0x00007ffff7be493b in rtpin_rtsp_process_commands () at /gpac/bin/gcc/libgpac.so.11
#4  0x00007ffff7be3d56 in rtpin_process () at /gpac/bin/gcc/libgpac.so.11
#5  0x00007ffff7b47945 in gf_filter_process_task () at /gpac/bin/gcc/libgpac.so.11
#6  0x00007ffff7b34e67 in gf_fs_thread_proc () at /gpac/bin/gcc/libgpac.so.11
#7  0x00007ffff7b39e1b in gf_fs_run () at /gpac/bin/gcc/libgpac.so.11
#8  0x0000555555563a43 in gpac_main ()
#9  0x00007ffff744c310 in __libc_start_call_main () at /usr/lib/libc.so.6
#10 0x00007ffff744c3c1 in __libc_start_main_impl () at /usr/lib/libc.so.6
#11 0x0000555555559dc5 in _start ()

Impact

This is capable of causing crashes and allowing modification of heap memory which could lead to remote code execution.
Occurrences

sdp.c L626

Lack of bounds check on write to fixed size, heap allocated field
```
Controlled heap buffer overflow in SDP packet parsing
This is a GitHub Issue
repo:gpac
owner:gpac
Title : Controlled heap buffer overflow in SDP packet parsing
Issue date:

--- start body ---
poc.py is available [here](https://drive.google.com/file/d/1iH28RyOdIbMDdUONKZSBbJU0Y6QiAEl_/view?usp=sharing)

```
Description

A malicious server can trigger an out-of-bounds heap write via a specially crafted SDP packet due to no bounds check when parsing time zone information into the AdjustmentTime and AdjustmentOffset fields of GF_SDPTiming.

(terminal 1)

python3 poc.py 31337

(terminal 2)

./configure --enable-sanitizer
make -j32
./bin/gcc/gpac -play rtsp://127.0.0.1:31337/test
ietf/sdp.c:624:27: runtime error: index 10 out of bounds for type 'u32 [10]'

GDB

Thread 1 "gpac" received signal SIGSEGV, Segmentation fault.
0x00007ffff7828932 in gf_sdp_info_parse () from /gpac/bin/gcc/libgpac.so.11
(gdb) bt
#0  0x00007ffff7828932 in gf_sdp_info_parse () at /gpac/bin/gcc/libgpac.so.11
#1  0x00007ffff7be6020 in rtpin_load_sdp () at /gpac/bin/gcc/libgpac.so.11
#2  0x00007ffff7be6d6c in rtpin_rtsp_describe_process () at /gpac/bin/gcc/libgpac.so.11
#3  0x00007ffff7be493b in rtpin_rtsp_process_commands () at /gpac/bin/gcc/libgpac.so.11
#4  0x00007ffff7be3d56 in rtpin_process () at /gpac/bin/gcc/libgpac.so.11
#5  0x00007ffff7b47945 in gf_filter_process_task () at /gpac/bin/gcc/libgpac.so.11
#6  0x00007ffff7b34e67 in gf_fs_thread_proc () at /gpac/bin/gcc/libgpac.so.11
#7  0x00007ffff7b39e1b in gf_fs_run () at /gpac/bin/gcc/libgpac.so.11
#8  0x0000555555563a43 in gpac_main ()
#9  0x00007ffff744c310 in __libc_start_call_main () at /usr/lib/libc.so.6
#10 0x00007ffff744c3c1 in __libc_start_main_impl () at /usr/lib/libc.so.6
#11 0x0000555555559dc5 in _start ()

Impact

This is capable of causing crashes and allowing modification of heap memory which could lead to remote code execution.
Occurrences

sdp.c L626

Lack of bounds check on write to fixed size, heap allocated field
```
--- end body ---

A controlled heap buffer overflow vulnerability exists in the SDP packet parsing of GPAC due to a lack of bounds checking when parsing time zone information into the AdjustmentTime and AdjustmentOffset fields of GF_SDPTiming. This can be exploited by a malicious server to trigger an out-of-bounds heap write, leading to potential crashes and allowing modification of heap memory, which could result in remote code execution.