Hello,I use the fuzzer(AFL) to fuzz binary gpac and got some crashes.
The following is the details.

## Title: SEGV on unknown address 0x000000000000
**1. Description**

SEGV on unknown address 0x000000000000 has occurred in functionin dump_isom_scene /root/gpac/applications/mp4box/filedump.c:209:14
 when running program MP4Box, this can reproduce on the lattest commit.

**2.  Software version info**

```
fuzz@ubuntu:~/gpac2.1/gpac/bin/gcc$ MP4Box -version
MP4Box - GPAC version 2.3-DEV-rev395-g98979a443-master
(c) 2000-2023 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

```
**3. System  version info**
```
./uname -a
Linux ouc7 5.4.0-150-generic #167-Ubuntu SMP Mon May 15 17:35:05 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
```

**4. Command**
```
./MP4Box -bt poc1
```
**5. Result**
```
[iso file] Unknown box type 0000 in parent moov
[iso file] Unknown box type 0000 in parent moov
[iso file] Unknown box type 0000 in parent moov
[iso file] Unknown box type 0000 in parent moov
[iso file] Unknown box type 0000 in parent moov
[iso file] Unknown box type 0000 in parent moov
[iso file] Unknown box type 0000 in parent minf
[iso file] Missing DataInformationBox
[iso file] Unknown box type 0000 in parent moov
[iso file] Read Box type 0000 (0x30303030) at position 11542 has size 0 but is not at root/file level. Forbidden, skipping end of parent box !
[iso file] Box "moov" (start 20) has 806 extra bytes
[iso file] Unknown top-level box type 0000
[iso file] Incomplete box 0000 - start 12356 size 808421684
[iso file] Incomplete file while reading for dump - aborting parsing
[iso file] Unknown box type 0000 in parent moov
[iso file] Unknown box type 0000 in parent moov
[iso file] Unknown box type 0000 in parent moov
[iso file] Unknown box type 0000 in parent moov
[iso file] Unknown box type 0000 in parent moov
[iso file] Unknown box type 0000 in parent moov
[iso file] Unknown box type 0000 in parent minf
[iso file] Missing DataInformationBox
[iso file] Unknown box type 0000 in parent moov
[iso file] Read Box type 0000 (0x30303030) at position 11542 has size 0 but is not at root/file level. Forbidden, skipping end of parent box !
[iso file] Box "moov" (start 20) has 806 extra bytes
[iso file] Unknown top-level box type 0000
[iso file] Incomplete box 0000 - start 12356 size 808421684
[iso file] Incomplete file while reading for dump - aborting parsing
MPEG-4 BIFS Scene Parsing
[ODF] Reading bifs config: shift in sizes (not supported)
UndefinedBehaviorSanitizer:DEADLYSIGNAL/100)
==3913630==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f9727dd6ee1 bp 0x000000000008 sp 0x7fff18efad90 T3913630)
==3913630==The signal is caused by a READ memory access.
==3913630==Hint: address points to the zero page.
    #0 0x7f9727dd6ee1 in BM_ParseIndexValueReplace (/usr/local/lib/libgpac.so.12+0x259ee1)
    #1 0x7f9727dd7661 in BM_ParseCommand (/usr/local/lib/libgpac.so.12+0x25a661)
    #2 0x7f9727dd7d00 in gf_bifs_decode_command_list (/usr/local/lib/libgpac.so.12+0x25ad00)
    #3 0x7f9728031dfb in gf_sm_load_run_isom (/usr/local/lib/libgpac.so.12+0x4b4dfb)
    #4 0x450461 in dump_isom_scene /root/gpac/applications/mp4box/filedump.c:209:14
    #5 0x4478b0 in mp4box_main /root/gpac/applications/mp4box/mp4box.c:6461:7
    #6 0x7f9727810082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082)
    #7 0x41304d in _start (/usr/local/bin/MP4Box+0x41304d)

UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: SEGV (/usr/local/lib/libgpac.so.12+0x259ee1) in BM_ParseIndexValueReplace
==3913630==ABORTING





```


**6. Impact**

This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution.

**7. POC**

POC file list

[poc1.zip](https://github.com/gpac/gpac/files/11956120/poc1.zip)




**Report of the Information Security Laboratory of Ocean University of China @OUC_ISLOUC @OUC_Blue_Whale** 
SEGV on unknown address 0x000000000000
This is a GitHub Issue
repo:gpac
owner:gpac
Title : SEGV on unknown address 0x000000000000
Issue date:

--- start body ---
Hello,I use the fuzzer(AFL) to fuzz binary gpac and got some crashes.
The following is the details.

## Title: SEGV on unknown address 0x000000000000
**1. Description**

SEGV on unknown address 0x000000000000 has occurred in functionin dump_isom_scene /root/gpac/applications/mp4box/filedump.c:209:14
 when running program MP4Box, this can reproduce on the lattest commit.

**2.  Software version info**

```
fuzz@ubuntu:~/gpac2.1/gpac/bin/gcc$ MP4Box -version
MP4Box - GPAC version 2.3-DEV-rev395-g98979a443-master
(c) 2000-2023 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

```
**3. System  version info**
```
./uname -a
Linux ouc7 5.4.0-150-generic #167-Ubuntu SMP Mon May 15 17:35:05 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
```

**4. Command**
```
./MP4Box -bt poc1
```
**5. Result**
```
[iso file] Unknown box type 0000 in parent moov
[iso file] Unknown box type 0000 in parent moov
[iso file] Unknown box type 0000 in parent moov
[iso file] Unknown box type 0000 in parent moov
[iso file] Unknown box type 0000 in parent moov
[iso file] Unknown box type 0000 in parent moov
[iso file] Unknown box type 0000 in parent minf
[iso file] Missing DataInformationBox
[iso file] Unknown box type 0000 in parent moov
[iso file] Read Box type 0000 (0x30303030) at position 11542 has size 0 but is not at root/file level. Forbidden, skipping end of parent box !
[iso file] Box "moov" (start 20) has 806 extra bytes
[iso file] Unknown top-level box type 0000
[iso file] Incomplete box 0000 - start 12356 size 808421684
[iso file] Incomplete file while reading for dump - aborting parsing
[iso file] Unknown box type 0000 in parent moov
[iso file] Unknown box type 0000 in parent moov
[iso file] Unknown box type 0000 in parent moov
[iso file] Unknown box type 0000 in parent moov
[iso file] Unknown box type 0000 in parent moov
[iso file] Unknown box type 0000 in parent moov
[iso file] Unknown box type 0000 in parent minf
[iso file] Missing DataInformationBox
[iso file] Unknown box type 0000 in parent moov
[iso file] Read Box type 0000 (0x30303030) at position 11542 has size 0 but is not at root/file level. Forbidden, skipping end of parent box !
[iso file] Box "moov" (start 20) has 806 extra bytes
[iso file] Unknown top-level box type 0000
[iso file] Incomplete box 0000 - start 12356 size 808421684
[iso file] Incomplete file while reading for dump - aborting parsing
MPEG-4 BIFS Scene Parsing
[ODF] Reading bifs config: shift in sizes (not supported)
UndefinedBehaviorSanitizer:DEADLYSIGNAL/100)
==3913630==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f9727dd6ee1 bp 0x000000000008 sp 0x7fff18efad90 T3913630)
==3913630==The signal is caused by a READ memory access.
==3913630==Hint: address points to the zero page.
    #0 0x7f9727dd6ee1 in BM_ParseIndexValueReplace (/usr/local/lib/libgpac.so.12+0x259ee1)
    #1 0x7f9727dd7661 in BM_ParseCommand (/usr/local/lib/libgpac.so.12+0x25a661)
    #2 0x7f9727dd7d00 in gf_bifs_decode_command_list (/usr/local/lib/libgpac.so.12+0x25ad00)
    #3 0x7f9728031dfb in gf_sm_load_run_isom (/usr/local/lib/libgpac.so.12+0x4b4dfb)
    #4 0x450461 in dump_isom_scene /root/gpac/applications/mp4box/filedump.c:209:14
    #5 0x4478b0 in mp4box_main /root/gpac/applications/mp4box/mp4box.c:6461:7
    #6 0x7f9727810082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082)
    #7 0x41304d in _start (/usr/local/bin/MP4Box+0x41304d)

UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: SEGV (/usr/local/lib/libgpac.so.12+0x259ee1) in BM_ParseIndexValueReplace
==3913630==ABORTING





```


**6. Impact**

This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution.

**7. POC**

POC file list

[poc1.zip](https://github.com/gpac/gpac/files/11956120/poc1.zip)




**Report of the Information Security Laboratory of Ocean University of China @OUC_ISLOUC @OUC_Blue_Whale** 
--- end body ---

A segmentation fault (SEGV) in the GPAC library's MP4Box application occurs when processing malformed MP4 files, which can lead to a Denial of Service (DoS) and potentially allow for memory corruption or remote code execution. The issue arises in the dump_isom_scene function when it attempts to read an invalid memory address, indicating a lack of proper input validation and error handling for corrupted or unexpected file formats.