## Description
There is a heap-use-after-free detected by AddressSanitizer

## System info
```
Ubuntu 20.04.2 LTS
clang version 12.0.0-++20210402082642+04ba60cfe598-1~exp1~20210402063359.71
MP4Box - GPAC version 1.1.0-DEV-rev1671-g0cd19f4db-master
```

## Build command
```
./configure --static-mp4box --prefix=`realpath ./install` --enable-sanitizer --cc=clang --cxx=clang++
```

## crash command
MP4Box -frag 0 -out /dev/null poc_file

## Pocs
[poc.zip](https://github.com/gpac/gpac/files/7950853/poc.zip)

## Crash output
poc_41.mp4

```
==19187==ERROR: AddressSanitizer: heap-use-after-free on address 0x603000001b17 at pc 0x0000010140cf bp 0x7ffd6975cff0 sp 0x7ffd6975cfe8
READ of size 1 at 0x603000001b17 thread T0
    #0 0x10140ce in mp4_mux_cenc_update /programs/mp4box/builds/build3/src/filters/mux_isom.c:3762:21
    #1 0x1017fdb in mp4_mux_process_sample /programs/mp4box/builds/build3/src/filters/mux_isom.c:4108:8
    #2 0x1009758 in mp4_mux_process_fragmented /programs/mp4box/builds/build3/src/filters/mux_isom.c:5599:8
    #3 0x10029a1 in mp4_mux_process /programs/mp4box/builds/build3/src/filters/mux_isom.c:6029:14
    #4 0xd8d4e9 in gf_filter_process_task /programs/mp4box/builds/build3/src/filter_core/filter.c:2515:7
    #5 0xd647ef in gf_fs_thread_proc /programs/mp4box/builds/build3/src/filter_core/filter_session.c:1756:3
    #6 0xd63523 in gf_fs_run /programs/mp4box/builds/build3/src/filter_core/filter_session.c:2000:2
    #7 0xaa99ff in gf_media_fragment_file /programs/mp4box/builds/build3/src/media_tools/isom_tools.c:3816:6
    #8 0x4ebaff in mp4boxMain /programs/mp4box/builds/build3/applications/mp4box/main.c:6455:7
    #9 0x7f9d091e20b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #10 0x41ea6d in _start (/programs/mp4box/builds/build3/bin/gcc/MP4Box+0x41ea6d)

0x603000001b17 is located 7 bytes inside of 23-byte region [0x603000001b10,0x603000001b27)
freed by thread T0 here:
    #0 0x499a62 in free (/programs/mp4box/builds/build3/bin/gcc/MP4Box+0x499a62)
    #1 0xa5e0b8 in gf_odf_avc_cfg_del /programs/mp4box/builds/build3/src/odf/descriptors.c:482:17
    #2 0x892f2e in avcc_box_del /programs/mp4box/builds/build3/src/isomedia/avc_ext.c:2728:19
    #3 0x8d76d4 in gf_isom_box_del /programs/mp4box/builds/build3/src/isomedia/box_funcs.c:1806:3
    #4 0x998f8b in gf_isom_update_sample_description_from_template /programs/mp4box/builds/build3/src/isomedia/isom_write.c:7789:4
    #5 0x1029564 in mp4_mux_setup_pid /programs/mp4box/builds/build3/src/filters/mux_isom.c:3102:4
    #6 0xd05416 in gf_filter_pid_configure /programs/mp4box/builds/build3/src/filter_core/filter_pid.c:752:6
    #7 0xd0b67f in gf_filter_pid_get_packet /programs/mp4box/builds/build3/src/filter_core/filter_pid.c:5612:8
    #8 0x1001b28 in mp4_mux_config_timing /programs/mp4box/builds/build3/src/filters/mux_isom.c:5805:9
    #9 0x1001b28 in mp4_mux_process /programs/mp4box/builds/build3/src/filters/mux_isom.c:6019:3
    #10 0xd8d4e9 in gf_filter_process_task /programs/mp4box/builds/build3/src/filter_core/filter.c:2515:7
    #11 0xd647ef in gf_fs_thread_proc /programs/mp4box/builds/build3/src/filter_core/filter_session.c:1756:3
    #12 0xd63523 in gf_fs_run /programs/mp4box/builds/build3/src/filter_core/filter_session.c:2000:2
    #13 0xaa99ff in gf_media_fragment_file /programs/mp4box/builds/build3/src/media_tools/isom_tools.c:3816:6
    #14 0x4ebaff in mp4boxMain /programs/mp4box/builds/build3/applications/mp4box/main.c:6455:7
    #15 0x7f9d091e20b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

previously allocated by thread T0 here:
    #0 0x499ccd in malloc (/programs/mp4box/builds/build3/bin/gcc/MP4Box+0x499ccd)
    #1 0x8934fa in avcc_box_read /programs/mp4box/builds/build3/src/isomedia/avc_ext.c:2773:22
    #2 0x8d6e8d in gf_isom_box_parse_ex /programs/mp4box/builds/build3/src/isomedia/box_funcs.c:264:14
    #3 0x8d923d in gf_isom_box_array_read_ex /programs/mp4box/builds/build3/src/isomedia/box_funcs.c:1719:7
    #4 0x1584e5a in video_sample_entry_box_read /programs/mp4box/builds/build3/src/isomedia/box_code_base.c:4304:6
    #5 0x8d6e8d in gf_isom_box_parse_ex /programs/mp4box/builds/build3/src/isomedia/box_funcs.c:264:14
    #6 0x998ce2 in gf_isom_update_sample_description_from_template /programs/mp4box/builds/build3/src/isomedia/isom_write.c:7756:6
    #7 0x1029564 in mp4_mux_setup_pid /programs/mp4box/builds/build3/src/filters/mux_isom.c:3102:4
    #8 0xd05416 in gf_filter_pid_configure /programs/mp4box/builds/build3/src/filter_core/filter_pid.c:752:6
    #9 0xd0b67f in gf_filter_pid_get_packet /programs/mp4box/builds/build3/src/filter_core/filter_pid.c:5612:8
    #10 0x1001b28 in mp4_mux_config_timing /programs/mp4box/builds/build3/src/filters/mux_isom.c:5805:9
    #11 0x1001b28 in mp4_mux_process /programs/mp4box/builds/build3/src/filters/mux_isom.c:6019:3
    #12 0xd8d4e9 in gf_filter_process_task /programs/mp4box/builds/build3/src/filter_core/filter.c:2515:7
    #13 0xd647ef in gf_fs_thread_proc /programs/mp4box/builds/build3/src/filter_core/filter_session.c:1756:3
    #14 0xd63523 in gf_fs_run /programs/mp4box/builds/build3/src/filter_core/filter_session.c:2000:2
    #15 0xaa99ff in gf_media_fragment_file /programs/mp4box/builds/build3/src/media_tools/isom_tools.c:3816:6
    #16 0x4ebaff in mp4boxMain /programs/mp4box/builds/build3/applications/mp4box/main.c:6455:7
    #17 0x7f9d091e20b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: heap-use-after-free /programs/mp4box/builds/build3/src/filters/mux_isom.c:3762:21 in mp4_mux_cenc_update
Shadow bytes around the buggy address:
  0x0c067fff8310: fd fa fa fa fd fd fd fa fa fa 00 00 00 00 fa fa
  0x0c067fff8320: 00 00 00 06 fa fa 00 00 00 00 fa fa 00 00 04 fa
  0x0c067fff8330: fa fa 00 00 00 00 fa fa 00 00 00 06 fa fa 00 00
  0x0c067fff8340: 00 fa fa fa 00 00 00 00 fa fa 00 00 00 fa fa fa
  0x0c067fff8350: 00 00 00 00 fa fa 00 00 00 fa fa fa fd fd fd fa
=>0x0c067fff8360: fa fa[fd]fd fd fa fa fa fd fd fd fa fa fa fd fd
  0x0c067fff8370: fd fa fa fa fd fd fd fa fa fa fd fd fd fa fa fa
  0x0c067fff8380: 00 00 00 fa fa fa fd fd fd fa fa fa 00 00 00 fa
  0x0c067fff8390: fa fa 00 00 00 00 fa fa 00 00 00 06 fa fa fd fd
  0x0c067fff83a0: fd fa fa fa fd fd fd fd fa fa 00 00 00 00 fa fa
  0x0c067fff83b0: 00 00 00 fa fa fa fd fd fd fa fa fa fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==19187==ABORTING
```
There is a heap-use-after-free detected by AddressSanitizer
This is a GitHub Issue
repo:gpac
owner:gpac
Title : There is a heap-use-after-free detected by AddressSanitizer
Issue date:

--- start body ---
## Description
There is a heap-use-after-free detected by AddressSanitizer

## System info
```
Ubuntu 20.04.2 LTS
clang version 12.0.0-++20210402082642+04ba60cfe598-1~exp1~20210402063359.71
MP4Box - GPAC version 1.1.0-DEV-rev1671-g0cd19f4db-master
```

## Build command
```
./configure --static-mp4box --prefix=`realpath ./install` --enable-sanitizer --cc=clang --cxx=clang++
```

## crash command
MP4Box -frag 0 -out /dev/null poc_file

## Pocs
[poc.zip](https://github.com/gpac/gpac/files/7950853/poc.zip)

## Crash output
poc_41.mp4

```
==19187==ERROR: AddressSanitizer: heap-use-after-free on address 0x603000001b17 at pc 0x0000010140cf bp 0x7ffd6975cff0 sp 0x7ffd6975cfe8
READ of size 1 at 0x603000001b17 thread T0
    #0 0x10140ce in mp4_mux_cenc_update /programs/mp4box/builds/build3/src/filters/mux_isom.c:3762:21
    #1 0x1017fdb in mp4_mux_process_sample /programs/mp4box/builds/build3/src/filters/mux_isom.c:4108:8
    #2 0x1009758 in mp4_mux_process_fragmented /programs/mp4box/builds/build3/src/filters/mux_isom.c:5599:8
    #3 0x10029a1 in mp4_mux_process /programs/mp4box/builds/build3/src/filters/mux_isom.c:6029:14
    #4 0xd8d4e9 in gf_filter_process_task /programs/mp4box/builds/build3/src/filter_core/filter.c:2515:7
    #5 0xd647ef in gf_fs_thread_proc /programs/mp4box/builds/build3/src/filter_core/filter_session.c:1756:3
    #6 0xd63523 in gf_fs_run /programs/mp4box/builds/build3/src/filter_core/filter_session.c:2000:2
    #7 0xaa99ff in gf_media_fragment_file /programs/mp4box/builds/build3/src/media_tools/isom_tools.c:3816:6
    #8 0x4ebaff in mp4boxMain /programs/mp4box/builds/build3/applications/mp4box/main.c:6455:7
    #9 0x7f9d091e20b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #10 0x41ea6d in _start (/programs/mp4box/builds/build3/bin/gcc/MP4Box+0x41ea6d)

0x603000001b17 is located 7 bytes inside of 23-byte region [0x603000001b10,0x603000001b27)
freed by thread T0 here:
    #0 0x499a62 in free (/programs/mp4box/builds/build3/bin/gcc/MP4Box+0x499a62)
    #1 0xa5e0b8 in gf_odf_avc_cfg_del /programs/mp4box/builds/build3/src/odf/descriptors.c:482:17
    #2 0x892f2e in avcc_box_del /programs/mp4box/builds/build3/src/isomedia/avc_ext.c:2728:19
    #3 0x8d76d4 in gf_isom_box_del /programs/mp4box/builds/build3/src/isomedia/box_funcs.c:1806:3
    #4 0x998f8b in gf_isom_update_sample_description_from_template /programs/mp4box/builds/build3/src/isomedia/isom_write.c:7789:4
    #5 0x1029564 in mp4_mux_setup_pid /programs/mp4box/builds/build3/src/filters/mux_isom.c:3102:4
    #6 0xd05416 in gf_filter_pid_configure /programs/mp4box/builds/build3/src/filter_core/filter_pid.c:752:6
    #7 0xd0b67f in gf_filter_pid_get_packet /programs/mp4box/builds/build3/src/filter_core/filter_pid.c:5612:8
    #8 0x1001b28 in mp4_mux_config_timing /programs/mp4box/builds/build3/src/filters/mux_isom.c:5805:9
    #9 0x1001b28 in mp4_mux_process /programs/mp4box/builds/build3/src/filters/mux_isom.c:6019:3
    #10 0xd8d4e9 in gf_filter_process_task /programs/mp4box/builds/build3/src/filter_core/filter.c:2515:7
    #11 0xd647ef in gf_fs_thread_proc /programs/mp4box/builds/build3/src/filter_core/filter_session.c:1756:3
    #12 0xd63523 in gf_fs_run /programs/mp4box/builds/build3/src/filter_core/filter_session.c:2000:2
    #13 0xaa99ff in gf_media_fragment_file /programs/mp4box/builds/build3/src/media_tools/isom_tools.c:3816:6
    #14 0x4ebaff in mp4boxMain /programs/mp4box/builds/build3/applications/mp4box/main.c:6455:7
    #15 0x7f9d091e20b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

previously allocated by thread T0 here:
    #0 0x499ccd in malloc (/programs/mp4box/builds/build3/bin/gcc/MP4Box+0x499ccd)
    #1 0x8934fa in avcc_box_read /programs/mp4box/builds/build3/src/isomedia/avc_ext.c:2773:22
    #2 0x8d6e8d in gf_isom_box_parse_ex /programs/mp4box/builds/build3/src/isomedia/box_funcs.c:264:14
    #3 0x8d923d in gf_isom_box_array_read_ex /programs/mp4box/builds/build3/src/isomedia/box_funcs.c:1719:7
    #4 0x1584e5a in video_sample_entry_box_read /programs/mp4box/builds/build3/src/isomedia/box_code_base.c:4304:6
    #5 0x8d6e8d in gf_isom_box_parse_ex /programs/mp4box/builds/build3/src/isomedia/box_funcs.c:264:14
    #6 0x998ce2 in gf_isom_update_sample_description_from_template /programs/mp4box/builds/build3/src/isomedia/isom_write.c:7756:6
    #7 0x1029564 in mp4_mux_setup_pid /programs/mp4box/builds/build3/src/filters/mux_isom.c:3102:4
    #8 0xd05416 in gf_filter_pid_configure /programs/mp4box/builds/build3/src/filter_core/filter_pid.c:752:6
    #9 0xd0b67f in gf_filter_pid_get_packet /programs/mp4box/builds/build3/src/filter_core/filter_pid.c:5612:8
    #10 0x1001b28 in mp4_mux_config_timing /programs/mp4box/builds/build3/src/filters/mux_isom.c:5805:9
    #11 0x1001b28 in mp4_mux_process /programs/mp4box/builds/build3/src/filters/mux_isom.c:6019:3
    #12 0xd8d4e9 in gf_filter_process_task /programs/mp4box/builds/build3/src/filter_core/filter.c:2515:7
    #13 0xd647ef in gf_fs_thread_proc /programs/mp4box/builds/build3/src/filter_core/filter_session.c:1756:3
    #14 0xd63523 in gf_fs_run /programs/mp4box/builds/build3/src/filter_core/filter_session.c:2000:2
    #15 0xaa99ff in gf_media_fragment_file /programs/mp4box/builds/build3/src/media_tools/isom_tools.c:3816:6
    #16 0x4ebaff in mp4boxMain /programs/mp4box/builds/build3/applications/mp4box/main.c:6455:7
    #17 0x7f9d091e20b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: heap-use-after-free /programs/mp4box/builds/build3/src/filters/mux_isom.c:3762:21 in mp4_mux_cenc_update
Shadow bytes around the buggy address:
  0x0c067fff8310: fd fa fa fa fd fd fd fa fa fa 00 00 00 00 fa fa
  0x0c067fff8320: 00 00 00 06 fa fa 00 00 00 00 fa fa 00 00 04 fa
  0x0c067fff8330: fa fa 00 00 00 00 fa fa 00 00 00 06 fa fa 00 00
  0x0c067fff8340: 00 fa fa fa 00 00 00 00 fa fa 00 00 00 fa fa fa
  0x0c067fff8350: 00 00 00 00 fa fa 00 00 00 fa fa fa fd fd fd fa
=>0x0c067fff8360: fa fa[fd]fd fd fa fa fa fd fd fd fa fa fa fd fd
  0x0c067fff8370: fd fa fa fa fd fd fd fa fa fa fd fd fd fa fa fa
  0x0c067fff8380: 00 00 00 fa fa fa fd fd fd fa fa fa 00 00 00 fa
  0x0c067fff8390: fa fa 00 00 00 00 fa fa 00 00 00 06 fa fa fd fd
  0x0c067fff83a0: fd fa fa fa fd fd fd fd fa fa 00 00 00 00 fa fa
  0x0c067fff83b0: 00 00 00 fa fa fa fd fd fd fa fa fa fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==19187==ABORTING
```
--- end body ---

A heap-use-after-free vulnerability in GPAC's MP4Box (version 1.1.0-DEV) allows attackers to exploit memory management issues, potentially leading to arbitrary code execution or application crashes. The issue is triggered when processing certain MP4 files, as indicated by the AddressSanitizer output, which shows that memory is accessed after it has been freed.