## Description
There is a heap buffer overflow detected by AddressSanitizer

## System info
```
Ubuntu 20.04.2 LTS
clang version 12.0.0-++20210402082642+04ba60cfe598-1~exp1~20210402063359.71
MP4Box - GPAC version 1.1.0-DEV-rev1740-gbd98129fd-master
```

## Build command
```
./configure --static-mp4box --prefix=`realpath ./install` --enable-sanitizer --cc=clang --cxx=clang++
```

## crash command
```
MP4Box -frag 0 -out /dev/null poc_file
```

## Pocs

[poc.zip](https://github.com/gpac/gpac/files/8032679/poc.zip)


## Crash output

```
==8316==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000001b28 at pc 0x000000d7f7c2 bp 0x7ffce5ee42f0 sp 0x7ffce5ee42e8
READ of size 1 at 0x603000001b28 thread T0
    #0 0xd7f7c1 in mp4_mux_cenc_update /programs/mp4box/builds/build12/src/filters/mux_isom.c:3764:12
    #1 0xd82679 in mp4_mux_process_sample /programs/mp4box/builds/build12/src/filters/mux_isom.c:4143:8
    #2 0xd76b58 in mp4_mux_process_fragmented /programs/mp4box/builds/build12/src/filters/mux_isom.c:5646:8
    #3 0xd713cf in mp4_mux_process /programs/mp4box/builds/build12/src/filters/mux_isom.c:6080:14
    #4 0xb7e4f6 in gf_filter_process_task /programs/mp4box/builds/build12/src/filter_core/filter.c:2563:7
    #5 0xb5ef7e in gf_fs_thread_proc /programs/mp4box/builds/build12/src/filter_core/filter_session.c:1799:3
    #6 0xb5de24 in gf_fs_run /programs/mp4box/builds/build12/src/filter_core/filter_session.c:2043:2
    #7 0x9112c0 in gf_media_fragment_file /programs/mp4box/builds/build12/src/media_tools/isom_tools.c:3821:6
    #8 0x4e6fcc in mp4boxMain /programs/mp4box/builds/build12/applications/mp4box/main.c:6455:7
    #9 0x7fa7f5b990b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #10 0x41ea6d in _start (/programs/mp4box/builds/build12/bin/gcc/MP4Box+0x41ea6d)

0x603000001b28 is located 0 bytes to the right of 24-byte region [0x603000001b10,0x603000001b28)
allocated by thread T0 here:
    #0 0x499fe9 in realloc (/programs/mp4box/builds/build12/bin/gcc/MP4Box+0x499fe9)
    #1 0xb51b11 in gf_props_assign_value /programs/mp4box/builds/build12/src/filter_core/filter_props.c:960:32
    #2 0xb51b11 in gf_props_insert_property /programs/mp4box/builds/build12/src/filter_core/filter_props.c:1031:2
    #3 0xd090be in isoffin_process /programs/mp4box/builds/build12/src/filters/isoffin_read.c:1397:6
    #4 0xb7e4f6 in gf_filter_process_task /programs/mp4box/builds/build12/src/filter_core/filter.c:2563:7
    #5 0xb5ef7e in gf_fs_thread_proc /programs/mp4box/builds/build12/src/filter_core/filter_session.c:1799:3
    #6 0xb5de24 in gf_fs_run /programs/mp4box/builds/build12/src/filter_core/filter_session.c:2043:2
    #7 0x9112c0 in gf_media_fragment_file /programs/mp4box/builds/build12/src/media_tools/isom_tools.c:3821:6
    #8 0x4e6fcc in mp4boxMain /programs/mp4box/builds/build12/applications/mp4box/main.c:6455:7
    #9 0x7fa7f5b990b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: heap-buffer-overflow /programs/mp4box/builds/build12/src/filters/mux_isom.c:3764:12 in mp4_mux_cenc_update
Shadow bytes around the buggy address:
  0x0c067fff8310: 00 00 fa fa 00 00 00 06 fa fa fd fd fd fa fa fa
  0x0c067fff8320: 00 00 00 fa fa fa fd fd fd fa fa fa fd fd fd fd
  0x0c067fff8330: fa fa 00 00 00 00 fa fa 00 00 00 fa fa fa 00 00
  0x0c067fff8340: 00 fa fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa
  0x0c067fff8350: 00 00 00 fa fa fa fd fd fd fa fa fa fd fd fd fd
=>0x0c067fff8360: fa fa 00 00 00[fa]fa fa fd fd fd fa fa fa fd fd
  0x0c067fff8370: fd fd fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa
  0x0c067fff8380: 00 00 00 fa fa fa 00 00 00 00 fa fa 00 00 00 fa
  0x0c067fff8390: fa fa fd fd fd fa fa fa fd fd fd fd fa fa 00 00
  0x0c067fff83a0: 00 00 fa fa 00 00 00 fa fa fa fd fd fd fa fa fa
  0x0c067fff83b0: fd fd fd fd fa fa 00 00 00 fa fa fa 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==8316==ABORTING
```
There is a heap buffer overflow detected by AddressSanitizer
This is a GitHub Issue
repo:gpac
owner:gpac
Title : There is a heap buffer overflow detected by AddressSanitizer
Issue date:

--- start body ---
## Description
There is a heap buffer overflow detected by AddressSanitizer

## System info
```
Ubuntu 20.04.2 LTS
clang version 12.0.0-++20210402082642+04ba60cfe598-1~exp1~20210402063359.71
MP4Box - GPAC version 1.1.0-DEV-rev1740-gbd98129fd-master
```

## Build command
```
./configure --static-mp4box --prefix=`realpath ./install` --enable-sanitizer --cc=clang --cxx=clang++
```

## crash command
```
MP4Box -frag 0 -out /dev/null poc_file
```

## Pocs

[poc.zip](https://github.com/gpac/gpac/files/8032679/poc.zip)


## Crash output

```
==8316==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000001b28 at pc 0x000000d7f7c2 bp 0x7ffce5ee42f0 sp 0x7ffce5ee42e8
READ of size 1 at 0x603000001b28 thread T0
    #0 0xd7f7c1 in mp4_mux_cenc_update /programs/mp4box/builds/build12/src/filters/mux_isom.c:3764:12
    #1 0xd82679 in mp4_mux_process_sample /programs/mp4box/builds/build12/src/filters/mux_isom.c:4143:8
    #2 0xd76b58 in mp4_mux_process_fragmented /programs/mp4box/builds/build12/src/filters/mux_isom.c:5646:8
    #3 0xd713cf in mp4_mux_process /programs/mp4box/builds/build12/src/filters/mux_isom.c:6080:14
    #4 0xb7e4f6 in gf_filter_process_task /programs/mp4box/builds/build12/src/filter_core/filter.c:2563:7
    #5 0xb5ef7e in gf_fs_thread_proc /programs/mp4box/builds/build12/src/filter_core/filter_session.c:1799:3
    #6 0xb5de24 in gf_fs_run /programs/mp4box/builds/build12/src/filter_core/filter_session.c:2043:2
    #7 0x9112c0 in gf_media_fragment_file /programs/mp4box/builds/build12/src/media_tools/isom_tools.c:3821:6
    #8 0x4e6fcc in mp4boxMain /programs/mp4box/builds/build12/applications/mp4box/main.c:6455:7
    #9 0x7fa7f5b990b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #10 0x41ea6d in _start (/programs/mp4box/builds/build12/bin/gcc/MP4Box+0x41ea6d)

0x603000001b28 is located 0 bytes to the right of 24-byte region [0x603000001b10,0x603000001b28)
allocated by thread T0 here:
    #0 0x499fe9 in realloc (/programs/mp4box/builds/build12/bin/gcc/MP4Box+0x499fe9)
    #1 0xb51b11 in gf_props_assign_value /programs/mp4box/builds/build12/src/filter_core/filter_props.c:960:32
    #2 0xb51b11 in gf_props_insert_property /programs/mp4box/builds/build12/src/filter_core/filter_props.c:1031:2
    #3 0xd090be in isoffin_process /programs/mp4box/builds/build12/src/filters/isoffin_read.c:1397:6
    #4 0xb7e4f6 in gf_filter_process_task /programs/mp4box/builds/build12/src/filter_core/filter.c:2563:7
    #5 0xb5ef7e in gf_fs_thread_proc /programs/mp4box/builds/build12/src/filter_core/filter_session.c:1799:3
    #6 0xb5de24 in gf_fs_run /programs/mp4box/builds/build12/src/filter_core/filter_session.c:2043:2
    #7 0x9112c0 in gf_media_fragment_file /programs/mp4box/builds/build12/src/media_tools/isom_tools.c:3821:6
    #8 0x4e6fcc in mp4boxMain /programs/mp4box/builds/build12/applications/mp4box/main.c:6455:7
    #9 0x7fa7f5b990b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: heap-buffer-overflow /programs/mp4box/builds/build12/src/filters/mux_isom.c:3764:12 in mp4_mux_cenc_update
Shadow bytes around the buggy address:
  0x0c067fff8310: 00 00 fa fa 00 00 00 06 fa fa fd fd fd fa fa fa
  0x0c067fff8320: 00 00 00 fa fa fa fd fd fd fa fa fa fd fd fd fd
  0x0c067fff8330: fa fa 00 00 00 00 fa fa 00 00 00 fa fa fa 00 00
  0x0c067fff8340: 00 fa fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa
  0x0c067fff8350: 00 00 00 fa fa fa fd fd fd fa fa fa fd fd fd fd
=>0x0c067fff8360: fa fa 00 00 00[fa]fa fa fd fd fd fa fa fa fd fd
  0x0c067fff8370: fd fd fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa
  0x0c067fff8380: 00 00 00 fa fa fa 00 00 00 00 fa fa 00 00 00 fa
  0x0c067fff8390: fa fa fd fd fd fa fa fa fd fd fd fd fa fa 00 00
  0x0c067fff83a0: 00 00 fa fa 00 00 00 fa fa fa fd fd fd fa fa fa
  0x0c067fff83b0: fd fd fd fd fa fa 00 00 00 fa fa fa 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==8316==ABORTING
```
--- end body ---

A heap buffer overflow vulnerability in GPAC version 1.1.0-DEV can be exploited by providing a specially crafted input file to the MP4Box tool, leading to potential arbitrary code execution or application crash. The issue is triggered during the processing of fragmented MP4 files, specifically in the mp4_mux_cenc_update function, as indicated by the AddressSanitizer output.