./bin/gcc/MP4Box -dash 1000 /home/fuzz/crashes/poc13

https://github.com/Janette88/test_pocs/blob/main/poc13

```
Description

Double-Free in isoffin_process at filters/isoffin_read.c:1541.
Version

git log
commit 5692dc729491805e0e5f55c21d50ba1e6b19e88e (HEAD -> master, origin/master, origin/HEAD)
Author: Aurelien David <aurelien.david@telecom-paristech.fr>
Date:   Wed Oct 11 13:24:46 2023 +0200

    ac3dmx: add remain size check (fixes #2627)

./MP4Box -version
MP4Box - GPAC version 2.3-DEV-rev577-g5692dc729-master
(c) 2000-2023 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Proof of Concept

./configure --enable-sanitizer
make


./bin/gcc/MP4Box -dash 1000 /home/fuzz/crashes/poc13
[iso file] Unknown box type 00000000 in parent moov
[iso file] Unknown top-level box type 00000100
[Dasher] No template assigned, using $File$_dash$FS$$Number$
[Dasher] No bitrate property assigned to PID V1, computing from bitstream
filters/isoffin_read.c:1541:6: runtime error: null pointer passed as argument 2, which is declared to never be null

ASAN log:

/bin/gcc/MP4Box -dash 1000 /home/fuzz/crash/poc13


[iso file] Unknown box type 00000000 in parent moov
[iso file] Unknown top-level box type 00000100
[Dasher] No template assigned, using $File$_dash$FS$$Number$
[Dasher] No bitrate property assigned to PID V1, computing from bitstream
[IsoMedia] Failed to fetch initial sample 1 for track 2
[iso file] Unknown box type 00000000 in parent moov
[Dasher] Representation not initialized, dropping non-SAP1/2 packet CTS 18446744073709551615/12288
[IsoMedia] Failed to fetch initial sample 1 for track 2
[MuxIsom] Packet with no CTS assigned, cannot store to track, ignoring
[IsoMedia] File truncated, aborting read for track 1
[IsoMedia] Failed to fetch initial sample 1 for track 2
[Dasher] Couldn't compute bitrate of PID V1 in time for manifest generation, please specify #Bitrate property
[Dasher] Couldn't compute bitrate of PID V1 in time for manifest generation, please specify #Bitrate property
[MPD] Generating MPD at time 2023-10-12T06:43:32.827Z
[Dasher] End of Period 
[Dasher] End of MPD (no more active streams)
=================================================================
==2796375==ERROR: AddressSanitizer: attempting double-free on 0x619000015480 in thread T0:
    #0 0x4a7292 in free (/home/fuzz/gpac/gpac/bin/gcc/MP4Box+0x4a7292)
    #1 0x7fa1fbe46f35 in gf_filterpacket_del (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0x1249f35)
    #2 0x7fa1fbe1a0b2 in gf_fq_del (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0x121d0b2)
    #3 0x7fa1fbe50ad5 in gf_filter_del (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0x1253ad5)
    #4 0x7fa1fbe1ee09 in gf_fs_del (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0x1221e09)
    #5 0x7fa1fb7c7156 in gf_dasher_del (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0xbca156)
    #6 0x5026ad in do_dash /home/fuzz/gpac/gpac/applications/mp4box/mp4box.c:4894:2
    #7 0x4f34ee in mp4box_main /home/fuzz/gpac/gpac/applications/mp4box/mp4box.c:6245:7
    #8 0x7fa1fa87e082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #9 0x42ad4d in _start (/home/fuzz/gpac/gpac/bin/gcc/MP4Box+0x42ad4d)

0x619000015480 is located 0 bytes inside of 1084-byte region [0x619000015480,0x6190000158bc)
freed by thread T0 here:
    #0 0x4a77f3 in __interceptor_realloc (/home/fuzz/gpac/gpac/bin/gcc/MP4Box+0x4a77f3)
    #1 0x7fa1fb69480d in Media_GetSample (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0xa9780d)
    #2 0x7fa1fb5f9af9 in gf_isom_get_sample_ex (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0x9fcaf9)
    #3 0x7fa1fc1037b6 in isor_reader_get_sample (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0x15067b6)
    #4 0x7fa1fc0f6855 in isoffin_process (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0x14f9855)
    #5 0x7fa1fbe5ed3e in gf_filter_process_task (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0x1261d3e)

previously allocated by thread T0 here:
LLVMSymbolizer: error reading file: No such file or directory
    #0 0x4a77f3 in __interceptor_realloc (/home/fuzz/gpac/gpac/bin/gcc/MP4Box+0x4a77f3)
    #1 0x7fa1fbdb0641 in gf_filter_pck_expand (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0x11b3641)
    #2 0x7ffd80dab79f  ([stack]+0x3379f)

SUMMARY: AddressSanitizer: double-free (/home/fuzz/gpac/gpac/bin/gcc/MP4Box+0x4a7292) in free
==2796375==ABORTING

POC file address:

https://github.com/Janette88/test_pocs/blob/main/poc13
Impact

Referencing memory after it has been freed multiple times can cause a program to crash, use unexpected values, memory leak or execute code .This might allow an attacker to write values to arbitrary memory spaces and create an interactive shell with elevated privileges.
Occurrences

isoffin_read.c L1541
```

Double-Free in isoffin_process
This is a GitHub Issue
repo:gpac
owner:gpac
Title : Double-Free in isoffin_process
Issue date:

--- start body ---
./bin/gcc/MP4Box -dash 1000 /home/fuzz/crashes/poc13

https://github.com/Janette88/test_pocs/blob/main/poc13

```
Description

Double-Free in isoffin_process at filters/isoffin_read.c:1541.
Version

git log
commit 5692dc729491805e0e5f55c21d50ba1e6b19e88e (HEAD -> master, origin/master, origin/HEAD)
Author: Aurelien David <aurelien.david@telecom-paristech.fr>
Date:   Wed Oct 11 13:24:46 2023 +0200

    ac3dmx: add remain size check (fixes #2627)

./MP4Box -version
MP4Box - GPAC version 2.3-DEV-rev577-g5692dc729-master
(c) 2000-2023 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Proof of Concept

./configure --enable-sanitizer
make


./bin/gcc/MP4Box -dash 1000 /home/fuzz/crashes/poc13
[iso file] Unknown box type 00000000 in parent moov
[iso file] Unknown top-level box type 00000100
[Dasher] No template assigned, using $File$_dash$FS$$Number$
[Dasher] No bitrate property assigned to PID V1, computing from bitstream
filters/isoffin_read.c:1541:6: runtime error: null pointer passed as argument 2, which is declared to never be null

ASAN log:

/bin/gcc/MP4Box -dash 1000 /home/fuzz/crash/poc13


[iso file] Unknown box type 00000000 in parent moov
[iso file] Unknown top-level box type 00000100
[Dasher] No template assigned, using $File$_dash$FS$$Number$
[Dasher] No bitrate property assigned to PID V1, computing from bitstream
[IsoMedia] Failed to fetch initial sample 1 for track 2
[iso file] Unknown box type 00000000 in parent moov
[Dasher] Representation not initialized, dropping non-SAP1/2 packet CTS 18446744073709551615/12288
[IsoMedia] Failed to fetch initial sample 1 for track 2
[MuxIsom] Packet with no CTS assigned, cannot store to track, ignoring
[IsoMedia] File truncated, aborting read for track 1
[IsoMedia] Failed to fetch initial sample 1 for track 2
[Dasher] Couldn't compute bitrate of PID V1 in time for manifest generation, please specify #Bitrate property
[Dasher] Couldn't compute bitrate of PID V1 in time for manifest generation, please specify #Bitrate property
[MPD] Generating MPD at time 2023-10-12T06:43:32.827Z
[Dasher] End of Period 
[Dasher] End of MPD (no more active streams)
=================================================================
==2796375==ERROR: AddressSanitizer: attempting double-free on 0x619000015480 in thread T0:
    #0 0x4a7292 in free (/home/fuzz/gpac/gpac/bin/gcc/MP4Box+0x4a7292)
    #1 0x7fa1fbe46f35 in gf_filterpacket_del (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0x1249f35)
    #2 0x7fa1fbe1a0b2 in gf_fq_del (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0x121d0b2)
    #3 0x7fa1fbe50ad5 in gf_filter_del (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0x1253ad5)
    #4 0x7fa1fbe1ee09 in gf_fs_del (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0x1221e09)
    #5 0x7fa1fb7c7156 in gf_dasher_del (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0xbca156)
    #6 0x5026ad in do_dash /home/fuzz/gpac/gpac/applications/mp4box/mp4box.c:4894:2
    #7 0x4f34ee in mp4box_main /home/fuzz/gpac/gpac/applications/mp4box/mp4box.c:6245:7
    #8 0x7fa1fa87e082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #9 0x42ad4d in _start (/home/fuzz/gpac/gpac/bin/gcc/MP4Box+0x42ad4d)

0x619000015480 is located 0 bytes inside of 1084-byte region [0x619000015480,0x6190000158bc)
freed by thread T0 here:
    #0 0x4a77f3 in __interceptor_realloc (/home/fuzz/gpac/gpac/bin/gcc/MP4Box+0x4a77f3)
    #1 0x7fa1fb69480d in Media_GetSample (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0xa9780d)
    #2 0x7fa1fb5f9af9 in gf_isom_get_sample_ex (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0x9fcaf9)
    #3 0x7fa1fc1037b6 in isor_reader_get_sample (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0x15067b6)
    #4 0x7fa1fc0f6855 in isoffin_process (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0x14f9855)
    #5 0x7fa1fbe5ed3e in gf_filter_process_task (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0x1261d3e)

previously allocated by thread T0 here:
LLVMSymbolizer: error reading file: No such file or directory
    #0 0x4a77f3 in __interceptor_realloc (/home/fuzz/gpac/gpac/bin/gcc/MP4Box+0x4a77f3)
    #1 0x7fa1fbdb0641 in gf_filter_pck_expand (/home/fuzz/gpac/gpac/bin/gcc/libgpac.so.12+0x11b3641)
    #2 0x7ffd80dab79f  ([stack]+0x3379f)

SUMMARY: AddressSanitizer: double-free (/home/fuzz/gpac/gpac/bin/gcc/MP4Box+0x4a7292) in free
==2796375==ABORTING

POC file address:

https://github.com/Janette88/test_pocs/blob/main/poc13
Impact

Referencing memory after it has been freed multiple times can cause a program to crash, use unexpected values, memory leak or execute code .This might allow an attacker to write values to arbitrary memory spaces and create an interactive shell with elevated privileges.
Occurrences

isoffin_read.c L1541
```

--- end body ---

A double-free vulnerability in the isoffin_process function of GPAC version 2.3-DEV can lead to memory corruption, crashes, or potential code execution. This occurs when the program attempts to free the same memory location multiple times, which can allow an attacker to manipulate memory and potentially execute arbitrary code.