There is a integer overflow in media_tools/av_parsers.c in the hevc_parse_slice_segment function in GPAC 1.0.1 which results in a crash.
There is a integer overflow in  media_tools/av_parsers.c:6568, function hevc_parse_slice_segment.
Below code:
`
pps_id = gf_bs_read_ue_log(bs, "pps_id");
	if (pps_id >= 64)
		return -1;

	pps = &hevc->pps[pps_id];
	sps = &hevc->sps[pps->sps_id];
	si->sps = sps;
	si->pps = pps;
`
However, function may return a negative number to pps_id, which smaller than 64.
Results a crash in followed execution.

In command Line:
gpac -info bug4
![bug4_cmd](https://user-images.githubusercontent.com/44844446/112793142-537b8f00-9097-11eb-922c-a53eb5495b40.png)

In gdb:
![bug4](https://user-images.githubusercontent.com/44844446/112793147-55dde900-9097-11eb-92bd-de6cc7749391.png)

The crafted file is in the attached zip:
[bug4.zip](https://github.com/gpac/gpac/files/6219606/bug4.zip)


A Integer number overflow in function hevc_parse_slice_segment.
This is a GitHub Issue
repo:gpac
owner:gpac
Title : A Integer number overflow in function hevc_parse_slice_segment.
Issue date:

--- start body ---
There is a integer overflow in  media_tools/av_parsers.c:6568, function hevc_parse_slice_segment.
Below code:
`
pps_id = gf_bs_read_ue_log(bs, "pps_id");
	if (pps_id >= 64)
		return -1;

	pps = &hevc->pps[pps_id];
	sps = &hevc->sps[pps->sps_id];
	si->sps = sps;
	si->pps = pps;
`
However, function may return a negative number to pps_id, which smaller than 64.
Results a crash in followed execution.

In command Line:
gpac -info bug4
![bug4_cmd](https://user-images.githubusercontent.com/44844446/112793142-537b8f00-9097-11eb-922c-a53eb5495b40.png)

In gdb:
![bug4](https://user-images.githubusercontent.com/44844446/112793147-55dde900-9097-11eb-92bd-de6cc7749391.png)

The crafted file is in the attached zip:
[bug4.zip](https://github.com/gpac/gpac/files/6219606/bug4.zip)


--- end body ---

An integer overflow vulnerability in the function hevc_parse_slice_segment of GPAC allows an attacker to craft input that can lead to a crash or potentially execute arbitrary code. The issue arises when the function returns a negative value for pps_id, which is then used to access an array without proper bounds checking, leading to a segmentation fault.