There is a integer overflow in media_tools/av_parsers.c in the gf_avc_read_pps_bs_internal in GPAC 1.0.1. pps_id may be a negative number, so it will not return. However, avc->pps only has 255 unit, so there is an overflow, which results a crash.
There is a integer overflow in `media_tools/av_parsers.c:5349`, function `gf_avc_read_pps_bs_internal`.
Below code:
`pps_id = gf_bs_read_ue_log(bs, "pps_id");
	if (pps_id >= 255) {
		return -1;
	}
pps = &avc->pps[pps_id];
	pps->id = pps_id;
`
pps_id may be a negative number, so will not return.
However, avc->pps only has 255 unit, so overflow, which results a crash .

More than, because of the `pps->id = pps_id`, the vuln may lead to an any addr write.

In command Line:
gpac -info bug3
![bug3_cmd](https://user-images.githubusercontent.com/44844446/112791109-61c7ac00-9093-11eb-8fca-cd4c258dd6aa.png)

In gdb:
![bug3](https://user-images.githubusercontent.com/44844446/112791114-642a0600-9093-11eb-86ea-65536bd0eabc.png)

The crafted file is in the attached zip:
[bug3.zip](https://github.com/gpac/gpac/files/6219500/bug3.zip)

A Integer Overflow in function gf_avc_read_pps_bs_internal
This is a GitHub Issue
repo:gpac
owner:gpac
Title : A Integer Overflow in function gf_avc_read_pps_bs_internal
Issue date:

--- start body ---
There is a integer overflow in `media_tools/av_parsers.c:5349`, function `gf_avc_read_pps_bs_internal`.
Below code:
`pps_id = gf_bs_read_ue_log(bs, "pps_id");
	if (pps_id >= 255) {
		return -1;
	}
pps = &avc->pps[pps_id];
	pps->id = pps_id;
`
pps_id may be a negative number, so will not return.
However, avc->pps only has 255 unit, so overflow, which results a crash .

More than, because of the `pps->id = pps_id`, the vuln may lead to an any addr write.

In command Line:
gpac -info bug3
![bug3_cmd](https://user-images.githubusercontent.com/44844446/112791109-61c7ac00-9093-11eb-8fca-cd4c258dd6aa.png)

In gdb:
![bug3](https://user-images.githubusercontent.com/44844446/112791114-642a0600-9093-11eb-86ea-65536bd0eabc.png)

The crafted file is in the attached zip:
[bug3.zip](https://github.com/gpac/gpac/files/6219500/bug3.zip)

--- end body ---

An integer overflow vulnerability in the function gf_avc_read_pps_bs_internal of GPAC allows an attacker to potentially write to arbitrary memory addresses. This occurs because the pps_id variable can be negative, leading to an out-of-bounds access in the pps array, which only has 255 units. This can result in a crash or arbitrary memory write, making it a critical security issue.