# Version
```
$ ./MP4Box -version
MP4Box - GPAC version 2.3-DEV-rev566-g50c2ab06f-master
```

# Platform
```
$ uname -a
Linux user-GE40-2PC-Dragon-Eyes 6.2.0-33-generic #33~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep  7 10:33:52 UTC 2 x86_64 x86_64 x86_64 GNU/Linux
```

# Asan
```
/home/user/vul/MP4Box_crash/id000001sig06src000693time10921735execs106934ophavocrep8
[33m[M3U8] Unsupported directive #EXT-X-VERSION:
[0m=================================================================
==823056==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000001f2f at pc 0x7f5320f00fca bp 0x7fffc6bb8070 sp 0x7fffc6bb8068
WRITE of size 1 at 0x602000001f2f thread T0
    #0 0x7f5320f00fc9 in parse_attributes /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:538:39
    #1 0x7f5320f00fc9 in gf_m3u8_parse_sub_playlist /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:1233:18
    #2 0x7f5320f18174 in gf_m3u8_to_mpd /home/user/fuzzing_gpac/gpac/src/media_tools/mpd.c:2230:6
    #3 0x7f5320f5ad99 in gf_dash_open /home/user/fuzzing_gpac/gpac/src/media_tools/dash_client.c:8506:8
    #4 0x7f53216e97fe in dashdmx_configure_pid /home/user/fuzzing_gpac/gpac/src/filters/dmx_dash.c:1973:7
    #5 0x7f532150740c in gf_filter_pid_configure /home/user/fuzzing_gpac/gpac/src/filter_core/filter_pid.c:876:6
    #6 0x7f53215262a6 in gf_filter_pid_connect_task /home/user/fuzzing_gpac/gpac/src/filter_core/filter_pid.c:1230:3
    #7 0x7f532157d47b in gf_fs_thread_proc /home/user/fuzzing_gpac/gpac/src/filter_core/filter_session.c:2105:3
    #8 0x7f532157b5cf in gf_fs_run /home/user/fuzzing_gpac/gpac/src/filter_core/filter_session.c:2405:3
    #9 0x7f5320e2ac6a in gf_dasher_process /home/user/fuzzing_gpac/gpac/src/media_tools/dash_segmenter.c:1236:6
    #10 0x562f308dc6dc in do_dash /home/user/fuzzing_gpac/gpac/applications/mp4box/mp4box.c:4831:15
    #11 0x562f308cdb6e in mp4box_main /home/user/fuzzing_gpac/gpac/applications/mp4box/mp4box.c:6245:7
    #12 0x7f531fe29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #13 0x7f531fe29e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #14 0x562f307f5dd4 in _start (/home/user/fuzzing_gpac/gpac/bin/gcc/MP4Box+0x82dd4) (BuildId: 53333ca7bff59dd9a3d1b2821e7c5f3a9aac76b9)

0x602000001f2f is located 1 bytes to the left of 1-byte region [0x602000001f30,0x602000001f31)
allocated by thread T0 here:
    #0 0x562f30863623 in strdup (/home/user/fuzzing_gpac/gpac/bin/gcc/MP4Box+0xf0623) (BuildId: 53333ca7bff59dd9a3d1b2821e7c5f3a9aac76b9)
    #1 0x7f5320efc6a4 in parse_attributes /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:537:29
    #2 0x7f5320efc6a4 in gf_m3u8_parse_sub_playlist /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:1233:18
    #3 0x7f5320f18174 in gf_m3u8_to_mpd /home/user/fuzzing_gpac/gpac/src/media_tools/mpd.c:2230:6
    #4 0x7f5320f5ad99 in gf_dash_open /home/user/fuzzing_gpac/gpac/src/media_tools/dash_client.c:8506:8
    #5 0x7f53216e97fe in dashdmx_configure_pid /home/user/fuzzing_gpac/gpac/src/filters/dmx_dash.c:1973:7
    #6 0x7f532150740c in gf_filter_pid_configure /home/user/fuzzing_gpac/gpac/src/filter_core/filter_pid.c:876:6
    #7 0x7f53215262a6 in gf_filter_pid_connect_task /home/user/fuzzing_gpac/gpac/src/filter_core/filter_pid.c:1230:3
    #8 0x7f532157d47b in gf_fs_thread_proc /home/user/fuzzing_gpac/gpac/src/filter_core/filter_session.c:2105:3

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:538:39 in parse_attributes
Shadow bytes around the buggy address:
  0x0c047fff8390: fa fa 07 fa fa fa 05 fa fa fa 00 00 fa fa 00 00
  0x0c047fff83a0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 03
  0x0c047fff83b0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff83c0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff83d0: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fa
=>0x0c047fff83e0: fa fa 07 fa fa[fa]01 fa fa fa fa fa fa fa fa fa
  0x0c047fff83f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8410: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8420: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8430: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==823056==ABORTING
```

# Reproduce
```
./MP4Box -dash 10000 poc
```
 
# POC File
https://github.com/gandalf4a/crash_report/blob/main/gpac/MP4Box/hbo_538

# Credit
```
Gandalf4a
```
 heap-buffer-overflow in /gpac/src/media_tools/m3u8.c:538:39 in parse_attributes
This is a GitHub Issue
repo:gpac
owner:gpac
Title :  heap-buffer-overflow in /gpac/src/media_tools/m3u8.c:538:39 in parse_attributes
Issue date:

--- start body ---
# Version
```
$ ./MP4Box -version
MP4Box - GPAC version 2.3-DEV-rev566-g50c2ab06f-master
```

# Platform
```
$ uname -a
Linux user-GE40-2PC-Dragon-Eyes 6.2.0-33-generic #33~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep  7 10:33:52 UTC 2 x86_64 x86_64 x86_64 GNU/Linux
```

# Asan
```
/home/user/vul/MP4Box_crash/id000001sig06src000693time10921735execs106934ophavocrep8
[33m[M3U8] Unsupported directive #EXT-X-VERSION:
[0m=================================================================
==823056==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000001f2f at pc 0x7f5320f00fca bp 0x7fffc6bb8070 sp 0x7fffc6bb8068
WRITE of size 1 at 0x602000001f2f thread T0
    #0 0x7f5320f00fc9 in parse_attributes /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:538:39
    #1 0x7f5320f00fc9 in gf_m3u8_parse_sub_playlist /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:1233:18
    #2 0x7f5320f18174 in gf_m3u8_to_mpd /home/user/fuzzing_gpac/gpac/src/media_tools/mpd.c:2230:6
    #3 0x7f5320f5ad99 in gf_dash_open /home/user/fuzzing_gpac/gpac/src/media_tools/dash_client.c:8506:8
    #4 0x7f53216e97fe in dashdmx_configure_pid /home/user/fuzzing_gpac/gpac/src/filters/dmx_dash.c:1973:7
    #5 0x7f532150740c in gf_filter_pid_configure /home/user/fuzzing_gpac/gpac/src/filter_core/filter_pid.c:876:6
    #6 0x7f53215262a6 in gf_filter_pid_connect_task /home/user/fuzzing_gpac/gpac/src/filter_core/filter_pid.c:1230:3
    #7 0x7f532157d47b in gf_fs_thread_proc /home/user/fuzzing_gpac/gpac/src/filter_core/filter_session.c:2105:3
    #8 0x7f532157b5cf in gf_fs_run /home/user/fuzzing_gpac/gpac/src/filter_core/filter_session.c:2405:3
    #9 0x7f5320e2ac6a in gf_dasher_process /home/user/fuzzing_gpac/gpac/src/media_tools/dash_segmenter.c:1236:6
    #10 0x562f308dc6dc in do_dash /home/user/fuzzing_gpac/gpac/applications/mp4box/mp4box.c:4831:15
    #11 0x562f308cdb6e in mp4box_main /home/user/fuzzing_gpac/gpac/applications/mp4box/mp4box.c:6245:7
    #12 0x7f531fe29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #13 0x7f531fe29e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #14 0x562f307f5dd4 in _start (/home/user/fuzzing_gpac/gpac/bin/gcc/MP4Box+0x82dd4) (BuildId: 53333ca7bff59dd9a3d1b2821e7c5f3a9aac76b9)

0x602000001f2f is located 1 bytes to the left of 1-byte region [0x602000001f30,0x602000001f31)
allocated by thread T0 here:
    #0 0x562f30863623 in strdup (/home/user/fuzzing_gpac/gpac/bin/gcc/MP4Box+0xf0623) (BuildId: 53333ca7bff59dd9a3d1b2821e7c5f3a9aac76b9)
    #1 0x7f5320efc6a4 in parse_attributes /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:537:29
    #2 0x7f5320efc6a4 in gf_m3u8_parse_sub_playlist /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:1233:18
    #3 0x7f5320f18174 in gf_m3u8_to_mpd /home/user/fuzzing_gpac/gpac/src/media_tools/mpd.c:2230:6
    #4 0x7f5320f5ad99 in gf_dash_open /home/user/fuzzing_gpac/gpac/src/media_tools/dash_client.c:8506:8
    #5 0x7f53216e97fe in dashdmx_configure_pid /home/user/fuzzing_gpac/gpac/src/filters/dmx_dash.c:1973:7
    #6 0x7f532150740c in gf_filter_pid_configure /home/user/fuzzing_gpac/gpac/src/filter_core/filter_pid.c:876:6
    #7 0x7f53215262a6 in gf_filter_pid_connect_task /home/user/fuzzing_gpac/gpac/src/filter_core/filter_pid.c:1230:3
    #8 0x7f532157d47b in gf_fs_thread_proc /home/user/fuzzing_gpac/gpac/src/filter_core/filter_session.c:2105:3

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:538:39 in parse_attributes
Shadow bytes around the buggy address:
  0x0c047fff8390: fa fa 07 fa fa fa 05 fa fa fa 00 00 fa fa 00 00
  0x0c047fff83a0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 03
  0x0c047fff83b0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff83c0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff83d0: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fa
=>0x0c047fff83e0: fa fa 07 fa fa[fa]01 fa fa fa fa fa fa fa fa fa
  0x0c047fff83f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8410: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8420: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8430: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==823056==ABORTING
```

# Reproduce
```
./MP4Box -dash 10000 poc
```
 
# POC File
https://github.com/gandalf4a/crash_report/blob/main/gpac/MP4Box/hbo_538

# Credit
```
Gandalf4a
```
--- end body ---

A heap-buffer-overflow vulnerability in the parse_attributes function of GPAC's MP4Box allows attackers to cause a crash or potentially execute arbitrary code. This occurs when the function attempts to write beyond the allocated memory buffer, which can be triggered by specially crafted input files. The issue is confirmed by AddressSanitizer, indicating a serious security risk.