Hi team,

Some crashes were found while fuzz testing of the MP4Box binary which can be triggered via malformed MP4 files. Although these malformed files only crash the program, they could potentially be crafted further into security issues where these kinds of files would be able compromise the process's memory through memory corruption, so hardening the code to prevent these kinds of bugs would be great to mitigate such issues.

See details below for repro and debug information. 

Repros uploaded [here](https://www.mediafire.com/file/yvtcsv8y8yxf746/gpac-crashes.zip/file) to the GPAC file drop along with the [mp3](https://www.mediafire.com/file/slmlm3r7xqpqtr7/test.mp3/file) used for testing.

**crash-1.mp4**

```
(gdb) r -add test.mp3 crash-1.mp4

Starting program: MP4Box -add test.mp3 crash-1.mp4
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[MP3Dmx] Broken ID3 frame tag F49EC7EE, size 64863500 but remaining bytes 37509
Track Importing MP3 - SampleRate 44100 Num Channels 1
[MP3Dmx] truncated frame!    | (00/100)

Program received signal SIGSEGV, Segmentation fault.
0x0000000000573eb7 in stbl_SetChunkOffset ()

(gdb) bt
#0  0x0000000000573eb7 in stbl_SetChunkOffset ()
#1  0x000000000055f5d4 in Media_UpdateSample ()
#2  0x000000000055b6bc in gf_isom_update_sample ()
#3  0x000000000055bcd3 in gf_isom_remove_track ()
#4  0x000000000040fd56 in remove_systems_tracks ()
#5  0x0000000000412d4b in mp4boxMain ()
#6  0x0000000000b63220 in __libc_start_main ()
#7  0x0000000000402cbe in _start ()

(gdb) i r
rax            0xf46400            16016384
rbx            0xf45db0            16014768
rcx            0xf462e0            16016096
rdx            0xee000000          3992977408
rsi            0x0                 0
rdi            0xf45cb0            16014512
rbp            0x2249              0x2249
rsp            0x7fffffff84b0      0x7fffffff84b0
r8             0x0                 0
r9             0x0                 0
r10            0xf45db0            16014768
r11            0x1                 1
r12            0xf46340            16016192
r13            0x1                 1
r14            0x1                 1
r15            0xf45db0            16014768
rip            0x573eb7            0x573eb7 <stbl_SetChunkOffset+151>
eflags         0x10286             [ PF SF IF RF ]
cs             0x33                51
ss             0x2b                43
ds             0x0                 0
es             0x0                 0
fs             0x0                 0
gs             0x0                 0

(gdb) x/i $rip
=> 0x573eb7 <stbl_SetChunkOffset+151>:	mov    %ebp,(%rax,%rdx,4)

(gdb) exploitable
Description: Access violation on destination operand
Short description: DestAv (8/22)
Hash: 05fc5ef3d17fd2ca385020aa35356875.440df1b7c08b742aea53b2fd4110b660
Exploitability Classification: EXPLOITABLE
Explanation: The target crashed on an access violation at an address matching the destination operand of the instruction. This likely indicates a write access violation, which means the attacker may control the write address and/or value.
Other tags: AccessViolation (21/22)
```

**crash-2.mp4**

```
(gdb) r -add test.mp3 crash-2.mp4

Starting program: MP4Box -add test.mp3 crash-2.mp4
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[MP3Dmx] Broken ID3 frame tag F49EC7EE, size 64863500 but remaining bytes 37509
Track Importing MP3 - SampleRate 44100 Num Channels 1
[MP3Dmx] truncated frame!    | (00/100)
free(): invalid next size (fast)

Program received signal SIGABRT, Aborted.
0x0000000000b7258b in raise ()

(gdb) bt
#0  0x0000000000b7258b in raise ()
#1  0x0000000000401f71 in abort ()
#2  0x0000000000b89cc6 in __libc_message ()
#3  0x0000000000b90f4c in malloc_printerr ()
#4  0x0000000000b9279c in _int_free ()
#5  0x000000000058e1b3 in gf_odf_del_default ()
#6  0x000000000054c822 in gf_isom_set_root_iod.part ()
#7  0x000000000054d4b9 in gf_isom_set_pl_indication ()
#8  0x000000000040fc9a in remove_systems_tracks ()
#9  0x0000000000412d4b in mp4boxMain ()
#10 0x0000000000b63220 in __libc_start_main ()
#11 0x0000000000402cbe in _start ()

(gdb) i r
rax            0x0                 0
rbx            0xf3c8c0            15976640
rcx            0xb7258b            12002699
rdx            0x0                 0
rsi            0x7fffffff81f0      140737488323056
rdi            0x2                 2
rbp            0x7fffffff8540      0x7fffffff8540
rsp            0x7fffffff81f0      0x7fffffff81f0
r8             0x0                 0
r9             0x7fffffff81f0      140737488323056
r10            0x8                 8
r11            0x246               582
r12            0x7fffffff8460      140737488323680
r13            0x10                16
r14            0x7ffff7ff8000      140737354104832
r15            0x1                 1
rip            0xb7258b            0xb7258b <raise+203>
eflags         0x246               [ PF ZF IF ]
cs             0x33                51
ss             0x2b                43
ds             0x0                 0
es             0x0                 0
fs             0x0                 0
gs             0x0                 0

(gdb) x/i $rip
=> 0xb7258b <raise+203>:	mov    rax,QWORD PTR [rsp+0x108]

(gdb) exploitable
Description: Abort signal
Short description: AbortSignal (20/22)
Hash: 73f0d0d5ddc3061dd250c7a757da51c3.3964b0c8b2bdd6ca450c2d508cbe435e
Exploitability Classification: UNKNOWN
Explanation: The target is stopped on a SIGABRT. SIGABRTs are often generated by libc and compiled check-code to indicate potentially exploitable conditions. Unfortunately this command does not yet further analyze these crashes.
```
Crashes when parsing malformed MP4 files
This is a GitHub Issue
repo:gpac
owner:gpac
Title : Crashes when parsing malformed MP4 files
Issue date:

--- start body ---
Hi team,

Some crashes were found while fuzz testing of the MP4Box binary which can be triggered via malformed MP4 files. Although these malformed files only crash the program, they could potentially be crafted further into security issues where these kinds of files would be able compromise the process's memory through memory corruption, so hardening the code to prevent these kinds of bugs would be great to mitigate such issues.

See details below for repro and debug information. 

Repros uploaded [here](https://www.mediafire.com/file/yvtcsv8y8yxf746/gpac-crashes.zip/file) to the GPAC file drop along with the [mp3](https://www.mediafire.com/file/slmlm3r7xqpqtr7/test.mp3/file) used for testing.

**crash-1.mp4**

```
(gdb) r -add test.mp3 crash-1.mp4

Starting program: MP4Box -add test.mp3 crash-1.mp4
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[MP3Dmx] Broken ID3 frame tag F49EC7EE, size 64863500 but remaining bytes 37509
Track Importing MP3 - SampleRate 44100 Num Channels 1
[MP3Dmx] truncated frame!    | (00/100)

Program received signal SIGSEGV, Segmentation fault.
0x0000000000573eb7 in stbl_SetChunkOffset ()

(gdb) bt
#0  0x0000000000573eb7 in stbl_SetChunkOffset ()
#1  0x000000000055f5d4 in Media_UpdateSample ()
#2  0x000000000055b6bc in gf_isom_update_sample ()
#3  0x000000000055bcd3 in gf_isom_remove_track ()
#4  0x000000000040fd56 in remove_systems_tracks ()
#5  0x0000000000412d4b in mp4boxMain ()
#6  0x0000000000b63220 in __libc_start_main ()
#7  0x0000000000402cbe in _start ()

(gdb) i r
rax            0xf46400            16016384
rbx            0xf45db0            16014768
rcx            0xf462e0            16016096
rdx            0xee000000          3992977408
rsi            0x0                 0
rdi            0xf45cb0            16014512
rbp            0x2249              0x2249
rsp            0x7fffffff84b0      0x7fffffff84b0
r8             0x0                 0
r9             0x0                 0
r10            0xf45db0            16014768
r11            0x1                 1
r12            0xf46340            16016192
r13            0x1                 1
r14            0x1                 1
r15            0xf45db0            16014768
rip            0x573eb7            0x573eb7 <stbl_SetChunkOffset+151>
eflags         0x10286             [ PF SF IF RF ]
cs             0x33                51
ss             0x2b                43
ds             0x0                 0
es             0x0                 0
fs             0x0                 0
gs             0x0                 0

(gdb) x/i $rip
=> 0x573eb7 <stbl_SetChunkOffset+151>:	mov    %ebp,(%rax,%rdx,4)

(gdb) exploitable
Description: Access violation on destination operand
Short description: DestAv (8/22)
Hash: 05fc5ef3d17fd2ca385020aa35356875.440df1b7c08b742aea53b2fd4110b660
Exploitability Classification: EXPLOITABLE
Explanation: The target crashed on an access violation at an address matching the destination operand of the instruction. This likely indicates a write access violation, which means the attacker may control the write address and/or value.
Other tags: AccessViolation (21/22)
```

**crash-2.mp4**

```
(gdb) r -add test.mp3 crash-2.mp4

Starting program: MP4Box -add test.mp3 crash-2.mp4
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[MP3Dmx] Broken ID3 frame tag F49EC7EE, size 64863500 but remaining bytes 37509
Track Importing MP3 - SampleRate 44100 Num Channels 1
[MP3Dmx] truncated frame!    | (00/100)
free(): invalid next size (fast)

Program received signal SIGABRT, Aborted.
0x0000000000b7258b in raise ()

(gdb) bt
#0  0x0000000000b7258b in raise ()
#1  0x0000000000401f71 in abort ()
#2  0x0000000000b89cc6 in __libc_message ()
#3  0x0000000000b90f4c in malloc_printerr ()
#4  0x0000000000b9279c in _int_free ()
#5  0x000000000058e1b3 in gf_odf_del_default ()
#6  0x000000000054c822 in gf_isom_set_root_iod.part ()
#7  0x000000000054d4b9 in gf_isom_set_pl_indication ()
#8  0x000000000040fc9a in remove_systems_tracks ()
#9  0x0000000000412d4b in mp4boxMain ()
#10 0x0000000000b63220 in __libc_start_main ()
#11 0x0000000000402cbe in _start ()

(gdb) i r
rax            0x0                 0
rbx            0xf3c8c0            15976640
rcx            0xb7258b            12002699
rdx            0x0                 0
rsi            0x7fffffff81f0      140737488323056
rdi            0x2                 2
rbp            0x7fffffff8540      0x7fffffff8540
rsp            0x7fffffff81f0      0x7fffffff81f0
r8             0x0                 0
r9             0x7fffffff81f0      140737488323056
r10            0x8                 8
r11            0x246               582
r12            0x7fffffff8460      140737488323680
r13            0x10                16
r14            0x7ffff7ff8000      140737354104832
r15            0x1                 1
rip            0xb7258b            0xb7258b <raise+203>
eflags         0x246               [ PF ZF IF ]
cs             0x33                51
ss             0x2b                43
ds             0x0                 0
es             0x0                 0
fs             0x0                 0
gs             0x0                 0

(gdb) x/i $rip
=> 0xb7258b <raise+203>:	mov    rax,QWORD PTR [rsp+0x108]

(gdb) exploitable
Description: Abort signal
Short description: AbortSignal (20/22)
Hash: 73f0d0d5ddc3061dd250c7a757da51c3.3964b0c8b2bdd6ca450c2d508cbe435e
Exploitability Classification: UNKNOWN
Explanation: The target is stopped on a SIGABRT. SIGABRTs are often generated by libc and compiled check-code to indicate potentially exploitable conditions. Unfortunately this command does not yet further analyze these crashes.
```
--- end body ---

The issue describes crashes in the MP4Box binary when parsing malformed MP4 files, which can lead to segmentation faults and potentially allow for memory corruption. This indicates a vulnerability where crafted MP4 files could exploit the program's memory management, leading to Denial of Service (DoS) or other security issues.