[poc_crash000369](https://gitee.com/FUNctionMain/mypoc/raw/master/poc_left_shift_of_negative%20/crash000369) is here.

```
MP4Box -dash 1000 ./crash000173
```

```
Description

left shift of negative value in MP4Box
Version

$ ./bin/gcc/MP4Box -version
MP4Box - GPAC version 2.3-DEV-revrelease
(c) 2000-2023 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
    GPAC Filters: https://doi.org/10.1145/3339825.3394929
    GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --enable-sanitizer
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SSL GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D

Reproduce

complie and run

./configure --enable-sanitizer
make

Proof of Concept

./bin/gcc/MP4Box -dash 1000 ./crash000173

[poc_crash000369](https://gitee.com/FUNctionMain/mypoc/raw/master/poc_left_shift_of_negative%20/crash000369) is here.
ASAN details

information reported by sanitizer

$ ./bin/gcc/MP4Box -dash 1000 ./crash000369
SWF Import - Scene Size 29.1x-61.05 - 8448 frames @ 0 FPS
[TXTIn] swf -> svg not fully migrated, using SWF flags 0 and no flatten angle. Patch welcome
[Dasher] No template assigned, using $File$_dash$FS$$Number$
[Dasher] No bitrate property assigned to PID crash000369, computing from bitstream
[SWF Parsing] Tag UnknownTag (0x1a4) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x1bd) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x12b) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x80) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0xee) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x1b9) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x2ea) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x1cc) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x295) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x242) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x1cf) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x10c) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x84) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x2b6) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x153) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x396) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x143) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x43) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x13f) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x2d1) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0xdf) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x3be) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x24a) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x1d1) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x3ef) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x2fe) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x31e) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0xdf) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x3d6) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0xe9) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x2f7) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x3fd) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x356) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x19d) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0xe9) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x21a) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x333) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x225) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x2f4) not implemented - skipping (frame 1)
[SWF Parsing] Tag DefineMorphShape (0x2e) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x312) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x150) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x35f) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x44) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x228) not implemented - skipping (frame 1)
[SWF Parsing] Tag ExternalFont (0x34) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0xde) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x377) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x1b9) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x2b1) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0xaa) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x12c) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x9a) not implemented - skipping (frame 1)
[SWF Parsing] Tag DefineBitsLossless (0x14) not implemented - skipping (frame 1)
[SWF Parsing] tag DoAction over-read of 664 bytes (size 8) (frame 1)
[SWF Parsing] Tag UnknownTag (0x19f) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x19a) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x140) not implemented - skipping (frame 1)
scene_manager/swf_parse.c:213:12: runtime error: left shift of negative value -45

Impact

This is capable of causing crashes.

Impact

This is capable of causing crashes.
Occurrences

swf_parse.c L213

scene_manager/swf_parse.c:213:12: runtime error: left shift of negative value -45
```

left shift of negative value in scene_manager/swf_parse.c:213
This is a GitHub Issue
repo:gpac
owner:gpac
Title : left shift of negative value in scene_manager/swf_parse.c:213
Issue date:

--- start body ---
[poc_crash000369](https://gitee.com/FUNctionMain/mypoc/raw/master/poc_left_shift_of_negative%20/crash000369) is here.

```
MP4Box -dash 1000 ./crash000173
```

```
Description

left shift of negative value in MP4Box
Version

$ ./bin/gcc/MP4Box -version
MP4Box - GPAC version 2.3-DEV-revrelease
(c) 2000-2023 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
    GPAC Filters: https://doi.org/10.1145/3339825.3394929
    GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --enable-sanitizer
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SSL GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D

Reproduce

complie and run

./configure --enable-sanitizer
make

Proof of Concept

./bin/gcc/MP4Box -dash 1000 ./crash000173

[poc_crash000369](https://gitee.com/FUNctionMain/mypoc/raw/master/poc_left_shift_of_negative%20/crash000369) is here.
ASAN details

information reported by sanitizer

$ ./bin/gcc/MP4Box -dash 1000 ./crash000369
SWF Import - Scene Size 29.1x-61.05 - 8448 frames @ 0 FPS
[TXTIn] swf -> svg not fully migrated, using SWF flags 0 and no flatten angle. Patch welcome
[Dasher] No template assigned, using $File$_dash$FS$$Number$
[Dasher] No bitrate property assigned to PID crash000369, computing from bitstream
[SWF Parsing] Tag UnknownTag (0x1a4) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x1bd) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x12b) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x80) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0xee) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x1b9) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x2ea) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x1cc) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x295) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x242) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x1cf) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x10c) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x84) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x2b6) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x153) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x396) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x143) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x43) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x13f) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x2d1) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0xdf) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x3be) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x24a) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x1d1) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x3ef) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x2fe) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x31e) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0xdf) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x3d6) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0xe9) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x2f7) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x3fd) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x356) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x19d) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0xe9) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x21a) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x333) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x225) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x2f4) not implemented - skipping (frame 1)
[SWF Parsing] Tag DefineMorphShape (0x2e) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x312) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x150) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x35f) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x44) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x228) not implemented - skipping (frame 1)
[SWF Parsing] Tag ExternalFont (0x34) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0xde) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x377) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x1b9) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x2b1) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0xaa) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x12c) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x9a) not implemented - skipping (frame 1)
[SWF Parsing] Tag DefineBitsLossless (0x14) not implemented - skipping (frame 1)
[SWF Parsing] tag DoAction over-read of 664 bytes (size 8) (frame 1)
[SWF Parsing] Tag UnknownTag (0x19f) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x19a) not implemented - skipping (frame 1)
[SWF Parsing] Tag UnknownTag (0x140) not implemented - skipping (frame 1)
scene_manager/swf_parse.c:213:12: runtime error: left shift of negative value -45

Impact

This is capable of causing crashes.

Impact

This is capable of causing crashes.
Occurrences

swf_parse.c L213

scene_manager/swf_parse.c:213:12: runtime error: left shift of negative value -45
```

--- end body ---

A left shift of a negative value in the GPAC MP4Box component can lead to undefined behavior, potentially causing a crash. This occurs in the swf_parse.c file at line 213, where a negative value is being shifted, which is not a valid operation in C/C++. This vulnerability can be exploited by providing specially crafted SWF files, leading to a Denial of Service (DoS) condition.