
Hello,
A heap-buffer-overflow has occurred when running program MP4Box,this can reproduce on the lattest commit.
System info：
Ubuntu 20.04.1 : clang 10.0.0 , gcc 9.3.0




[poc (2).zip](https://github.com/gpac/gpac/files/6757843/poc.2.zip)





Verification steps：
1.Get the source code of gpac
2.Compile 

```
cd gpac-master
CC=gcc CXX=g++ CFLAGS="-fsanitize=address" CXXFLAGS="-fsanitize=address" ./configure
make
``` 
3.run MP4Box

```
./MP4Box -hint poc -out /dev/null
```

asan info

```
=================================================================
==2004876==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000019d1 at pc 0x7fea2448ec93 bp 0x7ffc8468b6b0 sp 0x7ffc8468b6a0
READ of size 1 at 0x6020000019d1 thread T0
    #0 0x7fea2448ec92 in gp_rtp_builder_do_mpeg12_video ietf/rtp_pck_mpeg12.c:146
    #1 0x7fea24d4248a in gf_hinter_track_process media_tools/isom_hinter.c:808
    #2 0x55f9f43b8e2b in HintFile /home/.../gpac/gpac-master/applications/mp4box/main.c:3499
    #3 0x55f9f43cfd54 in mp4boxMain /home/.../gpac/gpac-master/applications/mp4box/main.c:6297
    #4 0x7fea2397a0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #5 0x55f9f4382f1d in _start (/home/.../gpac/gpac-master/bin/gcc/MP4Boxfl+0x48f1d)

0x6020000019d1 is located 0 bytes to the right of 1-byte region [0x6020000019d0,0x6020000019d1)
allocated by thread T0 here:
    #0 0x7fea26858bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
    #1 0x7fea2487e6cd in Media_GetSample isomedia/media.c:617

SUMMARY: AddressSanitizer: heap-buffer-overflow ietf/rtp_pck_mpeg12.c:146 in gp_rtp_builder_do_mpeg12_video
Shadow bytes around the buggy address:
  0x0c047fff82e0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c047fff82f0: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c047fff8300: fa fa fd fd fa fa fd fd fa fa fd fa fa fa 00 00
  0x0c047fff8310: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8320: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
=>0x0c047fff8330: fa fa 00 00 fa fa 00 00 fa fa[01]fa fa fa fa fa
  0x0c047fff8340: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8350: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8360: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8370: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==2004876==ABORTING
```


source code of rtp_pck_mpeg12.c

```
143 max_pck_size = builder->Path_MTU - 4;
144
145	payload = data + offset;
146	pic_type = (payload[1] >> 3) & 0x7;
147	/*first 6 bits (MBZ and T bit) not used*/
148	/*temp ref on 10 bits*/
149	mpv_hdr[0] = (payload[0] >> 6) & 0x3;
150	mpv_hdr[1] = (payload[0] << 2) | ((payload[1] >> 6) & 0x3);
151	mpv_hdr[2] = pic_type;
152	mpv_hdr[3] = 0;
153
154	if ((pic_type==2) || (pic_type== 3)) {
155		mpv_hdr[3] = (u8) ((((u32)payload[3]) << 5) & 0xf);
156		if ((payload[4] & 0x80) != 0) mpv_hdr[3] |= 0x10;
157		if (pic_type == 3) mpv_hdr[3] |= (payload[4] >> 3) & 0xf;
158	}
```








A heap-buffer-overflow in rtp_pck_mpeg12.c
This is a GitHub Issue
repo:gpac
owner:gpac
Title : A heap-buffer-overflow in rtp_pck_mpeg12.c
Issue date:

--- start body ---

Hello,
A heap-buffer-overflow has occurred when running program MP4Box,this can reproduce on the lattest commit.
System info：
Ubuntu 20.04.1 : clang 10.0.0 , gcc 9.3.0




[poc (2).zip](https://github.com/gpac/gpac/files/6757843/poc.2.zip)





Verification steps：
1.Get the source code of gpac
2.Compile 

```
cd gpac-master
CC=gcc CXX=g++ CFLAGS="-fsanitize=address" CXXFLAGS="-fsanitize=address" ./configure
make
``` 
3.run MP4Box

```
./MP4Box -hint poc -out /dev/null
```

asan info

```
=================================================================
==2004876==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000019d1 at pc 0x7fea2448ec93 bp 0x7ffc8468b6b0 sp 0x7ffc8468b6a0
READ of size 1 at 0x6020000019d1 thread T0
    #0 0x7fea2448ec92 in gp_rtp_builder_do_mpeg12_video ietf/rtp_pck_mpeg12.c:146
    #1 0x7fea24d4248a in gf_hinter_track_process media_tools/isom_hinter.c:808
    #2 0x55f9f43b8e2b in HintFile /home/.../gpac/gpac-master/applications/mp4box/main.c:3499
    #3 0x55f9f43cfd54 in mp4boxMain /home/.../gpac/gpac-master/applications/mp4box/main.c:6297
    #4 0x7fea2397a0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #5 0x55f9f4382f1d in _start (/home/.../gpac/gpac-master/bin/gcc/MP4Boxfl+0x48f1d)

0x6020000019d1 is located 0 bytes to the right of 1-byte region [0x6020000019d0,0x6020000019d1)
allocated by thread T0 here:
    #0 0x7fea26858bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
    #1 0x7fea2487e6cd in Media_GetSample isomedia/media.c:617

SUMMARY: AddressSanitizer: heap-buffer-overflow ietf/rtp_pck_mpeg12.c:146 in gp_rtp_builder_do_mpeg12_video
Shadow bytes around the buggy address:
  0x0c047fff82e0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c047fff82f0: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c047fff8300: fa fa fd fd fa fa fd fd fa fa fd fa fa fa 00 00
  0x0c047fff8310: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8320: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
=>0x0c047fff8330: fa fa 00 00 fa fa 00 00 fa fa[01]fa fa fa fa fa
  0x0c047fff8340: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8350: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8360: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8370: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==2004876==ABORTING
```


source code of rtp_pck_mpeg12.c

```
143 max_pck_size = builder->Path_MTU - 4;
144
145	payload = data + offset;
146	pic_type = (payload[1] >> 3) & 0x7;
147	/*first 6 bits (MBZ and T bit) not used*/
148	/*temp ref on 10 bits*/
149	mpv_hdr[0] = (payload[0] >> 6) & 0x3;
150	mpv_hdr[1] = (payload[0] << 2) | ((payload[1] >> 6) & 0x3);
151	mpv_hdr[2] = pic_type;
152	mpv_hdr[3] = 0;
153
154	if ((pic_type==2) || (pic_type== 3)) {
155		mpv_hdr[3] = (u8) ((((u32)payload[3]) << 5) & 0xf);
156		if ((payload[4] & 0x80) != 0) mpv_hdr[3] |= 0x10;
157		if (pic_type == 3) mpv_hdr[3] |= (payload[4] >> 3) & 0xf;
158	}
```








--- end body ---

A heap-buffer-overflow vulnerability in the `gp_rtp_builder_do_mpeg12_video` function of the GPAC library can lead to potential exploitation when processing MPEG-12 video data. This issue occurs due to improper handling of buffer sizes, which allows an attacker to read beyond the allocated memory, potentially leading to application crashes or arbitrary code execution.