Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [x] I looked for a similar issue and couldn't find any.
- [x] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [x] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Hi, there.

There is a segmentation fault caused by double free in av_parsers.c:4038 in newest commit  6c7e0564303fa1690a744ad51a6b473564ea6d1a.  It seems to be an incomplete fix of #2387, CVE-2023-1499.

Here is my environment, compiler info and gpac version:
~~~~
Distributor ID:	Ubuntu
Description:	20.04.6 LTS
Compiler: Clang 14.0.1

MP4Box - GPAC version 2.3-DEV-rev543-g6c7e05643-master
(c) 2000-2023 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
	GPAC Filters: https://doi.org/10.1145/3339825.3394929
	GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --disable-shared
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SSL GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_JPEG GPAC_HAS_PNG GPAC_HAS_JP2 GPAC_HAS_VORBIS GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D 
~~~~

To reproduce, run
~~~~
./MP4Box -info poc
~~~~

POC:
[poc.zip](https://github.com/gpac/gpac/files/12725168/mp4box-doublefree-av_parsers4038.zip)
(unzip first)

Here is the trace reported by gdb:
~~~~
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007ffff6f2a859 in __GI_abort () at abort.c:79
#2  0x00007ffff6f9526e in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7ffff70bf298 "%s\n") at ../sysdeps/posix/libc_fatal.c:155
#3  0x00007ffff6f9d2fc in malloc_printerr (str=str@entry=0x7ffff70c15d0 "free(): double free detected in tcache 2") at malloc.c:5347
#4  0x00007ffff6f9ef6d in _int_free (av=0x7ffff70f4b80 <main_arena>, p=0x6b9900, have_lock=0) at malloc.c:4201
#5  0x00007ffff7566016 in gf_av1_reset_state (state=0x6e0730, is_destroy=is_destroy@entry=GF_TRUE) at  /benchmark/gpac/src/media_tools/av_parsers.c:4038
#6  0x00007ffff7a8c662 in av1dmx_finalize (filter=<optimized out>) at  /benchmark/gpac/src/filters/reframe_av1.c:1255
#7  0x00007ffff7858421 in gf_fs_del (fsess=fsess@entry=0x6c1220) at  /benchmark/gpac/src/filter_core/filter_session.c:773
#8  0x00007ffff75b70dc in gf_media_import (importer=importer@entry=0x7fffffff7230) at  /benchmark/gpac/src/media_tools/media_import.c:1304
#9  0x0000000000450cb8 in convert_file_info (inName=0x7fffffffe5fb "tmp_crash2", track_id=0x49e1d0 <info_track_id>) at  /benchmark/gpac/applications/mp4box/fileimport.c:130
#10 0x0000000000424e82 in mp4box_main (argc=5, argv=0x7fffffffe338) at  /benchmark/gpac/applications/mp4box/mp4box.c:6380
#11 0x00007ffff6f2c083 in __libc_start_main (main=0x42a530 <main>, argc=5, argv=0x7fffffffe338, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe328) at ../csu/libc-start.c:308
#12 0x0000000000410e5e in _start ()
~~~~


Double free in gf_av1_reset_state media_tools/av_parsers.c:4038
This is a GitHub Issue
repo:gpac
owner:gpac
Title : Double free in gf_av1_reset_state media_tools/av_parsers.c:4038
Issue date:

--- start body ---
Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [x] I looked for a similar issue and couldn't find any.
- [x] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [x] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Hi, there.

There is a segmentation fault caused by double free in av_parsers.c:4038 in newest commit  6c7e0564303fa1690a744ad51a6b473564ea6d1a.  It seems to be an incomplete fix of #2387, CVE-2023-1499.

Here is my environment, compiler info and gpac version:
~~~~
Distributor ID:	Ubuntu
Description:	20.04.6 LTS
Compiler: Clang 14.0.1

MP4Box - GPAC version 2.3-DEV-rev543-g6c7e05643-master
(c) 2000-2023 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
	GPAC Filters: https://doi.org/10.1145/3339825.3394929
	GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --disable-shared
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SSL GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_JPEG GPAC_HAS_PNG GPAC_HAS_JP2 GPAC_HAS_VORBIS GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D 
~~~~

To reproduce, run
~~~~
./MP4Box -info poc
~~~~

POC:
[poc.zip](https://github.com/gpac/gpac/files/12725168/mp4box-doublefree-av_parsers4038.zip)
(unzip first)

Here is the trace reported by gdb:
~~~~
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007ffff6f2a859 in __GI_abort () at abort.c:79
#2  0x00007ffff6f9526e in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7ffff70bf298 "%s\n") at ../sysdeps/posix/libc_fatal.c:155
#3  0x00007ffff6f9d2fc in malloc_printerr (str=str@entry=0x7ffff70c15d0 "free(): double free detected in tcache 2") at malloc.c:5347
#4  0x00007ffff6f9ef6d in _int_free (av=0x7ffff70f4b80 <main_arena>, p=0x6b9900, have_lock=0) at malloc.c:4201
#5  0x00007ffff7566016 in gf_av1_reset_state (state=0x6e0730, is_destroy=is_destroy@entry=GF_TRUE) at  /benchmark/gpac/src/media_tools/av_parsers.c:4038
#6  0x00007ffff7a8c662 in av1dmx_finalize (filter=<optimized out>) at  /benchmark/gpac/src/filters/reframe_av1.c:1255
#7  0x00007ffff7858421 in gf_fs_del (fsess=fsess@entry=0x6c1220) at  /benchmark/gpac/src/filter_core/filter_session.c:773
#8  0x00007ffff75b70dc in gf_media_import (importer=importer@entry=0x7fffffff7230) at  /benchmark/gpac/src/media_tools/media_import.c:1304
#9  0x0000000000450cb8 in convert_file_info (inName=0x7fffffffe5fb "tmp_crash2", track_id=0x49e1d0 <info_track_id>) at  /benchmark/gpac/applications/mp4box/fileimport.c:130
#10 0x0000000000424e82 in mp4box_main (argc=5, argv=0x7fffffffe338) at  /benchmark/gpac/applications/mp4box/mp4box.c:6380
#11 0x00007ffff6f2c083 in __libc_start_main (main=0x42a530 <main>, argc=5, argv=0x7fffffffe338, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe328) at ../csu/libc-start.c:308
#12 0x0000000000410e5e in _start ()
~~~~


--- end body ---

A double free vulnerability in the gf_av1_reset_state function of GPAC version 2.3-DEV can lead to a segmentation fault, which may be exploited to cause a Denial of Service (DoS). This issue appears to be an incomplete fix for CVE-2023-1499, indicating a potential security risk if exploited.