## Description
There is a heap buffer overflow detected by AddressSanitizer

## System info
```
Ubuntu 20.04.2 LTS
clang version 12.0.0-++20210402082642+04ba60cfe598-1~exp1~20210402063359.71
MP4Box - GPAC version 1.1.0-DEV-rev1727-g8be34973d-master
```

## Build command
```
./configure --static-mp4box --prefix=`realpath ./install` --enable-sanitizer --cc=clang --cxx=clang++
```

## crash command
```
MP4Box -frag 0 -out /dev/null poc_file
```

## Pocs

[poc.zip](https://github.com/gpac/gpac/files/8020690/poc.zip)


## Crash output

```
==4028==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000003372 at pc 0x000000499077 bp 0x7ffce0570950 sp 0x7ffce0570118
READ of size 3 at 0x602000003372 thread T0
    #0 0x499076 in __asan_memcpy (/zhengjie/cmdline-fuzz/programs/mp4box/builds/build10/bin/gcc/MP4Box+0x499076)
    #1 0x548483 in gf_bs_write_data/programs/mp4box/builds/build10/src/utils/bitstream.c:1045:4
    #2 0x87195e in gf_isom_fragment_add_sample/programs/mp4box/builds/build10/src/isomedia/movie_fragments.c:2760:9
    #3 0xd7c9b7 in mp4_mux_process_sample/programs/mp4box/builds/build10/src/filters/mux_isom.c:4105:9
    #4 0xd727e8 in mp4_mux_process_fragmented/programs/mp4box/builds/build10/src/filters/mux_isom.c:5637:8
    #5 0xd6d05f in mp4_mux_process/programs/mp4box/builds/build10/src/filters/mux_isom.c:6071:14
    #6 0xb7d866 in gf_filter_process_task/programs/mp4box/builds/build10/src/filter_core/filter.c:2555:7
    #7 0xb5e41b in gf_fs_thread_proc/programs/mp4box/builds/build10/src/filter_core/filter_session.c:1793:3
    #8 0xb5d2c4 in gf_fs_run/programs/mp4box/builds/build10/src/filter_core/filter_session.c:2037:2
    #9 0x911200 in gf_media_fragment_file/programs/mp4box/builds/build10/src/media_tools/isom_tools.c:3821:6
    #10 0x4e6fcc in mp4boxMain/programs/mp4box/builds/build10/applications/mp4box/main.c:6455:7
    #11 0x7f0e712900b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #12 0x41ea6d in _start (/zhengjie/cmdline-fuzz/programs/mp4box/builds/build10/bin/gcc/MP4Box+0x41ea6d)

0x602000003372 is located 0 bytes to the right of 2-byte region [0x602000003370,0x602000003372)
allocated by thread T0 here:
    #0 0x499ccd in malloc (/zhengjie/cmdline-fuzz/programs/mp4box/builds/build10/bin/gcc/MP4Box+0x499ccd)
    #1 0x155f40e in gf_filter_pck_new_alloc_internal/programs/mp4box/builds/build10/src/filter_core/filter_pck.c:151:15
    #2 0xd0481d in isoffin_process/programs/mp4box/builds/build10/src/filters/isoffin_read.c:1343:12
    #3 0xb7d866 in gf_filter_process_task/programs/mp4box/builds/build10/src/filter_core/filter.c:2555:7
    #4 0xb5e41b in gf_fs_thread_proc/programs/mp4box/builds/build10/src/filter_core/filter_session.c:1793:3
    #5 0xb5d2c4 in gf_fs_run/programs/mp4box/builds/build10/src/filter_core/filter_session.c:2037:2
    #6 0x911200 in gf_media_fragment_file/programs/mp4box/builds/build10/src/media_tools/isom_tools.c:3821:6
    #7 0x4e6fcc in mp4boxMain/programs/mp4box/builds/build10/applications/mp4box/main.c:6455:7
    #8 0x7f0e712900b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/zhengjie/cmdline-fuzz/programs/mp4box/builds/build10/bin/gcc/MP4Box+0x499076) in __asan_memcpy
Shadow bytes around the buggy address:
  0x0c047fff8610: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8620: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8630: fa fa fd fd fa fa fd fd fa fa fd fd fa fa 00 00
  0x0c047fff8640: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8650: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
=>0x0c047fff8660: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa[02]fa
  0x0c047fff8670: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8680: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8690: fa fa fd fd fa fa 00 00 fa fa 04 fa fa fa 00 00
  0x0c047fff86a0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff86b0: fa fa 00 00 fa fa 00 fa fa fa 00 00 fa fa 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==4028==ABORTING
```
There is a heap buffer overflow detected by AddressSanitizer
This is a GitHub Issue
repo:gpac
owner:gpac
Title : There is a heap buffer overflow detected by AddressSanitizer
Issue date:

--- start body ---
## Description
There is a heap buffer overflow detected by AddressSanitizer

## System info
```
Ubuntu 20.04.2 LTS
clang version 12.0.0-++20210402082642+04ba60cfe598-1~exp1~20210402063359.71
MP4Box - GPAC version 1.1.0-DEV-rev1727-g8be34973d-master
```

## Build command
```
./configure --static-mp4box --prefix=`realpath ./install` --enable-sanitizer --cc=clang --cxx=clang++
```

## crash command
```
MP4Box -frag 0 -out /dev/null poc_file
```

## Pocs

[poc.zip](https://github.com/gpac/gpac/files/8020690/poc.zip)


## Crash output

```
==4028==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000003372 at pc 0x000000499077 bp 0x7ffce0570950 sp 0x7ffce0570118
READ of size 3 at 0x602000003372 thread T0
    #0 0x499076 in __asan_memcpy (/zhengjie/cmdline-fuzz/programs/mp4box/builds/build10/bin/gcc/MP4Box+0x499076)
    #1 0x548483 in gf_bs_write_data/programs/mp4box/builds/build10/src/utils/bitstream.c:1045:4
    #2 0x87195e in gf_isom_fragment_add_sample/programs/mp4box/builds/build10/src/isomedia/movie_fragments.c:2760:9
    #3 0xd7c9b7 in mp4_mux_process_sample/programs/mp4box/builds/build10/src/filters/mux_isom.c:4105:9
    #4 0xd727e8 in mp4_mux_process_fragmented/programs/mp4box/builds/build10/src/filters/mux_isom.c:5637:8
    #5 0xd6d05f in mp4_mux_process/programs/mp4box/builds/build10/src/filters/mux_isom.c:6071:14
    #6 0xb7d866 in gf_filter_process_task/programs/mp4box/builds/build10/src/filter_core/filter.c:2555:7
    #7 0xb5e41b in gf_fs_thread_proc/programs/mp4box/builds/build10/src/filter_core/filter_session.c:1793:3
    #8 0xb5d2c4 in gf_fs_run/programs/mp4box/builds/build10/src/filter_core/filter_session.c:2037:2
    #9 0x911200 in gf_media_fragment_file/programs/mp4box/builds/build10/src/media_tools/isom_tools.c:3821:6
    #10 0x4e6fcc in mp4boxMain/programs/mp4box/builds/build10/applications/mp4box/main.c:6455:7
    #11 0x7f0e712900b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #12 0x41ea6d in _start (/zhengjie/cmdline-fuzz/programs/mp4box/builds/build10/bin/gcc/MP4Box+0x41ea6d)

0x602000003372 is located 0 bytes to the right of 2-byte region [0x602000003370,0x602000003372)
allocated by thread T0 here:
    #0 0x499ccd in malloc (/zhengjie/cmdline-fuzz/programs/mp4box/builds/build10/bin/gcc/MP4Box+0x499ccd)
    #1 0x155f40e in gf_filter_pck_new_alloc_internal/programs/mp4box/builds/build10/src/filter_core/filter_pck.c:151:15
    #2 0xd0481d in isoffin_process/programs/mp4box/builds/build10/src/filters/isoffin_read.c:1343:12
    #3 0xb7d866 in gf_filter_process_task/programs/mp4box/builds/build10/src/filter_core/filter.c:2555:7
    #4 0xb5e41b in gf_fs_thread_proc/programs/mp4box/builds/build10/src/filter_core/filter_session.c:1793:3
    #5 0xb5d2c4 in gf_fs_run/programs/mp4box/builds/build10/src/filter_core/filter_session.c:2037:2
    #6 0x911200 in gf_media_fragment_file/programs/mp4box/builds/build10/src/media_tools/isom_tools.c:3821:6
    #7 0x4e6fcc in mp4boxMain/programs/mp4box/builds/build10/applications/mp4box/main.c:6455:7
    #8 0x7f0e712900b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/zhengjie/cmdline-fuzz/programs/mp4box/builds/build10/bin/gcc/MP4Box+0x499076) in __asan_memcpy
Shadow bytes around the buggy address:
  0x0c047fff8610: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8620: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8630: fa fa fd fd fa fa fd fd fa fa fd fd fa fa 00 00
  0x0c047fff8640: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8650: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
=>0x0c047fff8660: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa[02]fa
  0x0c047fff8670: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8680: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8690: fa fa fd fd fa fa 00 00 fa fa 04 fa fa fa 00 00
  0x0c047fff86a0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff86b0: fa fa 00 00 fa fa 00 fa fa fa 00 00 fa fa 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==4028==ABORTING
```
--- end body ---

A heap buffer overflow vulnerability in GPAC version 1.1.0-DEV can be exploited via crafted MP4 files, leading to potential arbitrary code execution or application crashes. The issue is triggered when processing specific input files, as demonstrated by the provided crash command and AddressSanitizer output.