Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [x] I looked for a similar issue and couldn't find any.
- [x] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [x] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/bug-reporting/
Step to reproduce:

1.get latest commit code (gpac - GPAC command line filter engine - version 2.3-DEV-rev621-g3edb48d2b-master)
2.compile with --enable-sanitizer
3.run MP4Box -bt a.swf
Env:
Ubunut 20.04 , clang 16.0.1

`=================================================================
==88571==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x63200001555c at pc 0x7f817b49f69a bp 0x7ffd8439aae0 sp 0x7ffd8439a288
READ of size 32768 at 0x63200001555c thread T0
#0 0x7f817b49f699 in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823
#1 0x7f8179b097bf in updatewindow (/usr/local/lib/libz.so.1+0xb7bf)
#2 0x7f8179b0a2f3 in inflate (/usr/local/lib/libz.so.1+0xc2f3)
#3 0x7f8179b1034b in uncompress2 (/usr/local/lib/libz.so.1+0x1234b)
#4 0x7f8179b10426 in uncompress (/usr/local/lib/libz.so.1+0x12426)
#5 0x7f817a87f7c8 in swf_def_bits_jpeg scene_manager/swf_parse.c:2156
#6 0x7f817a880305 in swf_process_tag scene_manager/swf_parse.c:2378
#7 0x7f817a880524 in swf_parse_tag scene_manager/swf_parse.c:2405
#8 0x7f817a880c17 in gf_sm_load_run_swf scene_manager/swf_parse.c:2476
#9 0x55ac96ea078f in dump_isom_scene /home/lly/pro/gpac/applications/mp4box/filedump.c:209
#10 0x55ac96e8cf1d in mp4box_main /home/lly/pro/gpac/applications/mp4box/mp4box.c:6467
#11 0x7f8179ccf082 in __libc_start_main ../csu/libc-start.c:308
#12 0x55ac96e70dbd in _start (/home/lly/pro/gpac/bin/gcc/MP4Box+0x4edbd)

0x63200001555c is located 0 bytes to the right of 85340-byte region [0x632000000800,0x63200001555c)
allocated by thread T0 here:
#0 0x7f817b515157 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x7f817a87f79e in swf_def_bits_jpeg scene_manager/swf_parse.c:2155
#2 0x7f817a880305 in swf_process_tag scene_manager/swf_parse.c:2378
#3 0x7f817a880524 in swf_parse_tag scene_manager/swf_parse.c:2405
#4 0x7f817a880c17 in gf_sm_load_run_swf scene_manager/swf_parse.c:2476
#5 0x55ac96ea078f in dump_isom_scene /home/lly/pro/gpac/applications/mp4box/filedump.c:209
#6 0x55ac96e8cf1d in mp4box_main /home/lly/pro/gpac/applications/mp4box/mp4box.c:6467
#7 0x7f8179ccf082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 in __interceptor_memcpy
Shadow bytes around the buggy address:
0x0c647fffaa50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c647fffaa60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c647fffaa70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c647fffaa80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c647fffaa90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c647fffaaa0: 00 00 00 00 00 00 00 00 00 00 00[04]fa fa fa fa
0x0c647fffaab0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c647fffaac0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c647fffaad0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c647fffaae0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c647fffaaf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==88571==ABORTING
`

reason:
in swf_def_bits_jpeg, the type of para destLen to uncompress is uLongf * and can not passed it within a (uLongf *) &osize while type of osize is u32.

swf_def_bits_jpeg:
u32 osize
uncompress((Bytef *) dst, (uLongf *) &osize, buf, AlphaPlaneSize);

Or it will make the destLen much larger than dest buffer len.

[poc.swf.zip](https://github.com/gpac/gpac/files/13362187/poc.swf.zip)









heap-buffer-overflow in swf_def_bits_jpeg scene_manager/swf_parse.c:2156
This is a GitHub Issue
repo:gpac
owner:gpac
Title : heap-buffer-overflow in swf_def_bits_jpeg scene_manager/swf_parse.c:2156
Issue date:

--- start body ---
Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [x] I looked for a similar issue and couldn't find any.
- [x] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [x] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/bug-reporting/
Step to reproduce:

1.get latest commit code (gpac - GPAC command line filter engine - version 2.3-DEV-rev621-g3edb48d2b-master)
2.compile with --enable-sanitizer
3.run MP4Box -bt a.swf
Env:
Ubunut 20.04 , clang 16.0.1

`=================================================================
==88571==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x63200001555c at pc 0x7f817b49f69a bp 0x7ffd8439aae0 sp 0x7ffd8439a288
READ of size 32768 at 0x63200001555c thread T0
#0 0x7f817b49f699 in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823
#1 0x7f8179b097bf in updatewindow (/usr/local/lib/libz.so.1+0xb7bf)
#2 0x7f8179b0a2f3 in inflate (/usr/local/lib/libz.so.1+0xc2f3)
#3 0x7f8179b1034b in uncompress2 (/usr/local/lib/libz.so.1+0x1234b)
#4 0x7f8179b10426 in uncompress (/usr/local/lib/libz.so.1+0x12426)
#5 0x7f817a87f7c8 in swf_def_bits_jpeg scene_manager/swf_parse.c:2156
#6 0x7f817a880305 in swf_process_tag scene_manager/swf_parse.c:2378
#7 0x7f817a880524 in swf_parse_tag scene_manager/swf_parse.c:2405
#8 0x7f817a880c17 in gf_sm_load_run_swf scene_manager/swf_parse.c:2476
#9 0x55ac96ea078f in dump_isom_scene /home/lly/pro/gpac/applications/mp4box/filedump.c:209
#10 0x55ac96e8cf1d in mp4box_main /home/lly/pro/gpac/applications/mp4box/mp4box.c:6467
#11 0x7f8179ccf082 in __libc_start_main ../csu/libc-start.c:308
#12 0x55ac96e70dbd in _start (/home/lly/pro/gpac/bin/gcc/MP4Box+0x4edbd)

0x63200001555c is located 0 bytes to the right of 85340-byte region [0x632000000800,0x63200001555c)
allocated by thread T0 here:
#0 0x7f817b515157 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x7f817a87f79e in swf_def_bits_jpeg scene_manager/swf_parse.c:2155
#2 0x7f817a880305 in swf_process_tag scene_manager/swf_parse.c:2378
#3 0x7f817a880524 in swf_parse_tag scene_manager/swf_parse.c:2405
#4 0x7f817a880c17 in gf_sm_load_run_swf scene_manager/swf_parse.c:2476
#5 0x55ac96ea078f in dump_isom_scene /home/lly/pro/gpac/applications/mp4box/filedump.c:209
#6 0x55ac96e8cf1d in mp4box_main /home/lly/pro/gpac/applications/mp4box/mp4box.c:6467
#7 0x7f8179ccf082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 in __interceptor_memcpy
Shadow bytes around the buggy address:
0x0c647fffaa50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c647fffaa60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c647fffaa70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c647fffaa80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c647fffaa90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c647fffaaa0: 00 00 00 00 00 00 00 00 00 00 00[04]fa fa fa fa
0x0c647fffaab0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c647fffaac0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c647fffaad0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c647fffaae0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c647fffaaf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==88571==ABORTING
`

reason:
in swf_def_bits_jpeg, the type of para destLen to uncompress is uLongf * and can not passed it within a (uLongf *) &osize while type of osize is u32.

swf_def_bits_jpeg:
u32 osize
uncompress((Bytef *) dst, (uLongf *) &osize, buf, AlphaPlaneSize);

Or it will make the destLen much larger than dest buffer len.

[poc.swf.zip](https://github.com/gpac/gpac/files/13362187/poc.swf.zip)









--- end body ---

A heap-buffer-overflow vulnerability in the swf_def_bits_jpeg function of GPAC allows attackers to exploit the uncompress function by passing an incorrect type for the destination length parameter. This can lead to memory corruption and potential arbitrary code execution. The issue arises because the parameter destLen is expected to be of type uLongf*, but a u32 type is being passed instead, which can result in the destination length being larger than the allocated buffer size.