Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [x] I looked for a similar issue and couldn't find any.
- [x] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [x] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/

An Invalid free was discovered in gf_svg_delete_attribute_value(). The vulnerability causes a segmentation fault and application crash.

**Version:**

```
MP4Box - GPAC version 1.1.0-DEV-rev1555-g339e7a736-master
(c) 2000-2021 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
        GPAC Filters: https://doi.org/10.1145/3339825.3394929
        GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --prefix=/root/fuck_bin/gpac/test
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_JPEG GPAC_HAS_PNG GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D
```
**System information**
Ubuntu 20.04 focal, AMD EPYC 7742 64-Core @ 16x 2.25GHz

**command:**

```
./MP4Box -bt poc
```
[__GI___libc_free-gf_svg_delete_attribute_value.zip](https://github.com/gpac/gpac/files/7708353/__GI___libc_free-gf_svg_delete_attribute_value.zip)

**Result**

```
../../test/lib/MP4Box -bt __GI___libc_free-gf_svg_delete_attribute_value/id:000389,sig:11,src:004543,op:havoc,rep:4
[iso file] extra box maxr found in hinf, deleting
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type 80rak in parent moov
[iso file] Incomplete box mdat - start 11495 size 853090
[iso file] Incomplete file while reading for dump - aborting parsing
[iso file] extra box maxr found in hinf, deleting
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type 80rak in parent moov
[iso file] Incomplete box mdat - start 11495 size 853090
[iso file] Incomplete file while reading for dump - aborting parsing
MPEG-4 LASeR Scene Parsing
[LASeR] samepolyXXX coded in bitstream but no polyXXX defined !
[LASeR] Undefined LASeR event 59
[LASeR] Undefined LASeR event 49
[LASeR] Undefined LASeR event 54
[LASeR] Undefined LASeR event 37
[LASeR] memory overread - corrupted decoding
[MP4 Loading] decoding sample 1 from track ID 8 failed
[1]    1657234 segmentation fault  ../../test/lib/MP4Box -bt
```

**gdb**

```
Program received signal SIGSEGV, Segmentation fault.
__GI___libc_free (mem=0xd8) at malloc.c:3102
3102    malloc.c: No such file or directory.
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
───────────────────────────────────────────────────[ REGISTERS ]───────────────────────────────────────────────────
 RAX  0x0
 RBX  0x5555556ae120 ◂— 0x340072 /* 'r' */
 RCX  0x0
 RDX  0x7ffff7e0d840 ◂— 0xffabb7bdffabb7b0
 RDI  0xd8
 RSI  0x5555556ae160 ◂— 0xd8
 R8   0x7
 R9   0xfffffff6
 R10  0x7ffff775ca72 ◂— 'gf_node_unregister_children'
 R11  0x7ffff784b6d0 (gf_node_unregister_children) ◂— endbr64
 R12  0x5555555d36f0 ◂— 0x0
 R13  0x1
 R14  0x5555555d36f0 ◂— 0x0
 R15  0x0
 RBP  0x5555556ae160 ◂— 0xd8
 RSP  0x7fffffff70c0 ◂— 0x2
 RIP  0x7ffff75d9870 (free+32) ◂— mov    rax, qword ptr [rdi - 8]
────────────────────────────────────────────────────[ DISASM ]─────────────────────────────────────────────────────
 ► 0x7ffff75d9870 <free+32>         mov    rax, qword ptr [rdi - 8]
   0x7ffff75d9874 <free+36>         lea    rsi, [rdi - 0x10]
   0x7ffff75d9878 <free+40>         test   al, 2
   0x7ffff75d987a <free+42>         jne    free+96                <free+96>
    ↓
   0x7ffff75d98b0 <free+96>         mov    edx, dword ptr [rip + 0x14d9fe] <0x7ffff77272b4>
   0x7ffff75d98b6 <free+102>        test   edx, edx
   0x7ffff75d98b8 <free+104>        jne    free+123                <free+123>
    ↓
   0x7ffff75d98cb <free+123>        mov    rdi, rsi
   0x7ffff75d98ce <free+126>        add    rsp, 0x18
   0x7ffff75d98d2 <free+130>        jmp    munmap_chunk                <munmap_chunk>
    ↓
   0x7ffff75d4630 <munmap_chunk>    sub    rsp, 8
─────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────
00:0000│ rsp 0x7fffffff70c0 ◂— 0x2
01:0008│     0x7fffffff70c8 ◂— 0x8000000000000006
02:0010│     0x7fffffff70d0 ◂— 0x0
03:0018│     0x7fffffff70d8 —▸ 0x7ffff78c8ffd (gf_svg_delete_attribute_value+61) ◂— add    rsp, 8
04:0020│     0x7fffffff70e0 ◂— 0x0
05:0028│     0x7fffffff70e8 —▸ 0x5555556ae120 ◂— 0x340072 /* 'r' */
06:0030│     0x7fffffff70f0 —▸ 0x5555556ae140 ◂— 0x2a /* '*' */
07:0038│     0x7fffffff70f8 —▸ 0x5555555d36f0 ◂— 0x0
───────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────
 ► f 0   0x7ffff75d9870 free+32
   f 1   0x7ffff78c8ffd gf_svg_delete_attribute_value+61
   f 2   0x7ffff78c9130 gf_svg_delete_attribute_value+368
   f 3   0x7ffff78e2b85 gf_node_delete_attributes+69
   f 4   0x7ffff78c8c3a gf_svg_node_del+282
   f 5   0x7ffff784b51d gf_node_unregister+349
   f 6   0x7ffff784b6f4 gf_node_unregister_children+36
   f 7   0x7ffff784b731 gf_sg_parent_reset+17
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> bt
#0  __GI___libc_free (mem=0xd8) at malloc.c:3102
#1  0x00007ffff78c8ffd in gf_svg_delete_attribute_value () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#2  0x00007ffff78c9130 in gf_svg_delete_attribute_value () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#3  0x00007ffff78e2b85 in gf_node_delete_attributes () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#4  0x00007ffff78c8c3a in gf_svg_node_del () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#5  0x00007ffff784b51d in gf_node_unregister () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#6  0x00007ffff784b6f4 in gf_node_unregister_children () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#7  0x00007ffff784b731 in gf_sg_parent_reset () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#8  0x00007ffff78c8c42 in gf_svg_node_del () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#9  0x00007ffff784b51d in gf_node_unregister () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#10 0x00007ffff785050f in gf_sg_command_del () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#11 0x00007ffff7a893b3 in gf_sm_del () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#12 0x0000555555584423 in dump_isom_scene ()
#13 0x000055555557b42c in mp4boxMain ()
#14 0x00007ffff75630b3 in __libc_start_main (main=0x55555556c420 <main>, argc=3, argv=0x7fffffffe1d8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe1c8) at ../csu/libc-start.c:308
#15 0x000055555556c45e in _start ()
```




Invalid free in gf_svg_node_del()
This is a GitHub Issue
repo:gpac
owner:gpac
Title : Invalid free in gf_svg_node_del()
Issue date:

--- start body ---
Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [x] I looked for a similar issue and couldn't find any.
- [x] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [x] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/

An Invalid free was discovered in gf_svg_delete_attribute_value(). The vulnerability causes a segmentation fault and application crash.

**Version:**

```
MP4Box - GPAC version 1.1.0-DEV-rev1555-g339e7a736-master
(c) 2000-2021 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
        GPAC Filters: https://doi.org/10.1145/3339825.3394929
        GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --prefix=/root/fuck_bin/gpac/test
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_JPEG GPAC_HAS_PNG GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D
```
**System information**
Ubuntu 20.04 focal, AMD EPYC 7742 64-Core @ 16x 2.25GHz

**command:**

```
./MP4Box -bt poc
```
[__GI___libc_free-gf_svg_delete_attribute_value.zip](https://github.com/gpac/gpac/files/7708353/__GI___libc_free-gf_svg_delete_attribute_value.zip)

**Result**

```
../../test/lib/MP4Box -bt __GI___libc_free-gf_svg_delete_attribute_value/id:000389,sig:11,src:004543,op:havoc,rep:4
[iso file] extra box maxr found in hinf, deleting
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type 80rak in parent moov
[iso file] Incomplete box mdat - start 11495 size 853090
[iso file] Incomplete file while reading for dump - aborting parsing
[iso file] extra box maxr found in hinf, deleting
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type 80rak in parent moov
[iso file] Incomplete box mdat - start 11495 size 853090
[iso file] Incomplete file while reading for dump - aborting parsing
MPEG-4 LASeR Scene Parsing
[LASeR] samepolyXXX coded in bitstream but no polyXXX defined !
[LASeR] Undefined LASeR event 59
[LASeR] Undefined LASeR event 49
[LASeR] Undefined LASeR event 54
[LASeR] Undefined LASeR event 37
[LASeR] memory overread - corrupted decoding
[MP4 Loading] decoding sample 1 from track ID 8 failed
[1]    1657234 segmentation fault  ../../test/lib/MP4Box -bt
```

**gdb**

```
Program received signal SIGSEGV, Segmentation fault.
__GI___libc_free (mem=0xd8) at malloc.c:3102
3102    malloc.c: No such file or directory.
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
───────────────────────────────────────────────────[ REGISTERS ]───────────────────────────────────────────────────
 RAX  0x0
 RBX  0x5555556ae120 ◂— 0x340072 /* 'r' */
 RCX  0x0
 RDX  0x7ffff7e0d840 ◂— 0xffabb7bdffabb7b0
 RDI  0xd8
 RSI  0x5555556ae160 ◂— 0xd8
 R8   0x7
 R9   0xfffffff6
 R10  0x7ffff775ca72 ◂— 'gf_node_unregister_children'
 R11  0x7ffff784b6d0 (gf_node_unregister_children) ◂— endbr64
 R12  0x5555555d36f0 ◂— 0x0
 R13  0x1
 R14  0x5555555d36f0 ◂— 0x0
 R15  0x0
 RBP  0x5555556ae160 ◂— 0xd8
 RSP  0x7fffffff70c0 ◂— 0x2
 RIP  0x7ffff75d9870 (free+32) ◂— mov    rax, qword ptr [rdi - 8]
────────────────────────────────────────────────────[ DISASM ]─────────────────────────────────────────────────────
 ► 0x7ffff75d9870 <free+32>         mov    rax, qword ptr [rdi - 8]
   0x7ffff75d9874 <free+36>         lea    rsi, [rdi - 0x10]
   0x7ffff75d9878 <free+40>         test   al, 2
   0x7ffff75d987a <free+42>         jne    free+96                <free+96>
    ↓
   0x7ffff75d98b0 <free+96>         mov    edx, dword ptr [rip + 0x14d9fe] <0x7ffff77272b4>
   0x7ffff75d98b6 <free+102>        test   edx, edx
   0x7ffff75d98b8 <free+104>        jne    free+123                <free+123>
    ↓
   0x7ffff75d98cb <free+123>        mov    rdi, rsi
   0x7ffff75d98ce <free+126>        add    rsp, 0x18
   0x7ffff75d98d2 <free+130>        jmp    munmap_chunk                <munmap_chunk>
    ↓
   0x7ffff75d4630 <munmap_chunk>    sub    rsp, 8
─────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────
00:0000│ rsp 0x7fffffff70c0 ◂— 0x2
01:0008│     0x7fffffff70c8 ◂— 0x8000000000000006
02:0010│     0x7fffffff70d0 ◂— 0x0
03:0018│     0x7fffffff70d8 —▸ 0x7ffff78c8ffd (gf_svg_delete_attribute_value+61) ◂— add    rsp, 8
04:0020│     0x7fffffff70e0 ◂— 0x0
05:0028│     0x7fffffff70e8 —▸ 0x5555556ae120 ◂— 0x340072 /* 'r' */
06:0030│     0x7fffffff70f0 —▸ 0x5555556ae140 ◂— 0x2a /* '*' */
07:0038│     0x7fffffff70f8 —▸ 0x5555555d36f0 ◂— 0x0
───────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────
 ► f 0   0x7ffff75d9870 free+32
   f 1   0x7ffff78c8ffd gf_svg_delete_attribute_value+61
   f 2   0x7ffff78c9130 gf_svg_delete_attribute_value+368
   f 3   0x7ffff78e2b85 gf_node_delete_attributes+69
   f 4   0x7ffff78c8c3a gf_svg_node_del+282
   f 5   0x7ffff784b51d gf_node_unregister+349
   f 6   0x7ffff784b6f4 gf_node_unregister_children+36
   f 7   0x7ffff784b731 gf_sg_parent_reset+17
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> bt
#0  __GI___libc_free (mem=0xd8) at malloc.c:3102
#1  0x00007ffff78c8ffd in gf_svg_delete_attribute_value () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#2  0x00007ffff78c9130 in gf_svg_delete_attribute_value () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#3  0x00007ffff78e2b85 in gf_node_delete_attributes () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#4  0x00007ffff78c8c3a in gf_svg_node_del () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#5  0x00007ffff784b51d in gf_node_unregister () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#6  0x00007ffff784b6f4 in gf_node_unregister_children () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#7  0x00007ffff784b731 in gf_sg_parent_reset () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#8  0x00007ffff78c8c42 in gf_svg_node_del () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#9  0x00007ffff784b51d in gf_node_unregister () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#10 0x00007ffff785050f in gf_sg_command_del () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#11 0x00007ffff7a893b3 in gf_sm_del () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#12 0x0000555555584423 in dump_isom_scene ()
#13 0x000055555557b42c in mp4boxMain ()
#14 0x00007ffff75630b3 in __libc_start_main (main=0x55555556c420 <main>, argc=3, argv=0x7fffffffe1d8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe1c8) at ../csu/libc-start.c:308
#15 0x000055555556c45e in _start ()
```




--- end body ---

An invalid free vulnerability in the gf_svg_delete_attribute_value function of GPAC version 1.1.0-DEV can lead to a segmentation fault and application crash. This issue arises when the function attempts to free memory that was not allocated or has already been freed, resulting in undefined behavior and potential exploitation by attackers.