POC: [poc_hbo01_s.dat](https://github.com/JieyongMa/poc/raw/main/gpac/2023/poc_hbo01_s.dat)

```
Description

Heap Buffer Overflow in function gf_isom_box_size at src/isomedia/box_funcs.c:1997
gpac version

git log
commit bbca869177585aaca8eb66d8541079e6f364798e (HEAD -> master, origin/master, origin/HEAD)
Author: jeanlf <jeanlf@gpac.io>
Date:   Wed Jan 18 11:40:30 2023 +0100

    fixed potentially missing last packets in tsmux

POC

./MP4Box -bt ./poc_hbo01_s.dat
[iso file] Unknown top-level box type 0000
[iso file] Unknown top-level box type 0000
[iso file] Unknown top-level box type 0000
[iso file] Unknown box type 0000 in parent moov
[iso file] Unknown box type 0000 in parent mvex
[iso file] Read Box type 0000 (0x30303030) at position 544 has size 0 but is not at root/file level. Forbidden, skipping end of parent box !
[iso file] Box "mvex" (start 488) has 24 extra bytes
[iso file] Unknown box type 0000 in parent minf
[iso file] Unknown box type 0000 in parent minf
[iso file] Unknown box type 0000 in parent stbl
[iso file] Box "sgpd" (start 1154) has 8 extra bytes
[iso file] Missing DataInformationBox
[iso file] Track with no sample description box !
[iso file] Unknown box type 0000 in parent moov
[iso file] Unknown box type 0000 in parent moov
[iso file] Read Box type 0000 (0x30303030) at position 1261 has size 0 but is not at root/file level. Forbidden, skipping end of parent box !
[iso file] Box "moov" (start 351) has 655 extra bytes
[iso file] Unknown top-level box type 0000
[iso file] Unknown top-level box type 0000
[iso file] Unknown box type 0000 in parent moof
[iso file] Unknown box type 0000 in parent traf
[iso file] Box "sbgp" (start 2072) has 8 extra bytes
[iso file] Unknown box type 0000 in parent traf
[iso file] Unknown box type 0000 in parent traf
[iso file] Box "sgpd" (start 2168) has 12 extra bytes
[iso file] Unknown box type VOID in parent traf
[iso file] Read Box type 0000 (0x30303030) at position 2220 has size 0 but is not at root/file level. Forbidden, skipping end of parent box !
[iso file] Box "traf" (start 2028) has 406 extra bytes
[iso file] Unknown box type 0000 in parent moof
[iso file] default sample description set to 808464432 but only 0 sample description(s), likely broken ! Fixing to 1
[iso file] Box sgpd wrote 36 bytes but size is 48
=================================================================
==1805484==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000001640 at pc 0x7ffff1d15327 bp 0x7fffffff2e10 sp 0x7fffffff2e08
READ of size 8 at 0x602000001640 thread T0
    #0 0x7ffff1d15326 in gf_isom_box_size /home/fuzz/gpac/src/isomedia/box_funcs.c:1997:9
    #1 0x7ffff1ed4247 in gf_isom_is_identical_sgpd /home/fuzz/gpac/src/isomedia/isom_read.c:5865:3
    #2 0x7ffff235419a in MergeTrack /home/fuzz/gpac/src/isomedia/track.c:913:11
    #3 0x7ffff1d9f8bd in MergeFragment /home/fuzz/gpac/src/isomedia/isom_intern.c:92:7
    #4 0x7ffff1dbc1d7 in gf_isom_parse_movie_boxes_internal /home/fuzz/gpac/src/isomedia/isom_intern.c:722:9
    #5 0x7ffff1da7ace in gf_isom_parse_movie_boxes /home/fuzz/gpac/src/isomedia/isom_intern.c:868:6
    #6 0x7ffff1dc3c43 in gf_isom_open_file /home/fuzz/gpac/src/isomedia/isom_intern.c:988:19
    #7 0x7ffff1df57ff in gf_isom_open /home/fuzz/gpac/src/isomedia/isom_read.c:509:11
    #8 0x540f28 in mp4box_main /home/fuzz/gpac/applications/mp4box/mp4box.c:6221:12
    #9 0x5540c1 in main /home/fuzz/gpac/applications/mp4box/mp4box.c:6846:1
    #10 0x7fffee1e1082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #11 0x42ac7d in _start (/home/fuzz/gpac/bin/gcc/MP4Box+0x42ac7d)

0x602000001640 is located 0 bytes to the right of 16-byte region [0x602000001630,0x602000001640)
allocated by thread T0 here:
    #0 0x4a5edd in malloc (/home/fuzz/gpac/bin/gcc/MP4Box+0x4a5edd)
    #1 0x7ffff03674e4 in gf_malloc /home/fuzz/gpac/src/utils/alloc.c:150:9
    #2 0x7ffff1b28192 in sgpd_parse_entry /home/fuzz/gpac/src/isomedia/box_code_base.c:9994:2
    #3 0x7ffff1b1ed19 in sgpd_box_read /home/fuzz/gpac/src/isomedia/box_code_base.c:10259:9
    #4 0x7ffff1d1093f in gf_isom_box_read /home/fuzz/gpac/src/isomedia/box_funcs.c:1897:9
    #5 0x7ffff1d0b2d6 in gf_isom_box_parse_ex /home/fuzz/gpac/src/isomedia/box_funcs.c:282:14
    #6 0x7ffff1d18173 in gf_isom_box_array_read /home/fuzz/gpac/src/isomedia/box_funcs.c:1790:7
    #7 0x7ffff1aa4de4 in traf_box_read /home/fuzz/gpac/src/isomedia/box_code_base.c:6363:13
    #8 0x7ffff1d1093f in gf_isom_box_read /home/fuzz/gpac/src/isomedia/box_funcs.c:1897:9
    #9 0x7ffff1d0b2d6 in gf_isom_box_parse_ex /home/fuzz/gpac/src/isomedia/box_funcs.c:282:14
    #10 0x7ffff1d18173 in gf_isom_box_array_read /home/fuzz/gpac/src/isomedia/box_funcs.c:1790:7
    #11 0x7ffff1a2723c in moof_box_read /home/fuzz/gpac/src/isomedia/box_code_base.c:3676:9
    #12 0x7ffff1d1093f in gf_isom_box_read /home/fuzz/gpac/src/isomedia/box_funcs.c:1897:9
    #13 0x7ffff1d0b2d6 in gf_isom_box_parse_ex /home/fuzz/gpac/src/isomedia/box_funcs.c:282:14
    #14 0x7ffff1d06ad9 in gf_isom_parse_root_box /home/fuzz/gpac/src/isomedia/box_funcs.c:38:8
    #15 0x7ffff1da93a5 in gf_isom_parse_movie_boxes_internal /home/fuzz/gpac/src/isomedia/isom_intern.c:378:7
    #16 0x7ffff1da7ace in gf_isom_parse_movie_boxes /home/fuzz/gpac/src/isomedia/isom_intern.c:868:6
    #17 0x7ffff1dc3c43 in gf_isom_open_file /home/fuzz/gpac/src/isomedia/isom_intern.c:988:19
    #18 0x7ffff1df57ff in gf_isom_open /home/fuzz/gpac/src/isomedia/isom_read.c:509:11
    #19 0x540f28 in mp4box_main /home/fuzz/gpac/applications/mp4box/mp4box.c:6221:12
    #20 0x5540c1 in main /home/fuzz/gpac/applications/mp4box/mp4box.c:6846:1
    #21 0x7fffee1e1082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/fuzz/gpac/src/isomedia/box_funcs.c:1997:9 in gf_isom_box_size
Shadow bytes around the buggy address:
  0x0c047fff8270: fa fa 00 00 fa fa 01 fa fa fa 00 00 fa fa 01 fa
  0x0c047fff8280: fa fa 00 00 fa fa 01 fa fa fa 00 00 fa fa 00 00
  0x0c047fff8290: fa fa 00 00 fa fa 00 00 fa fa 07 fa fa fa 00 00
  0x0c047fff82a0: fa fa 00 00 fa fa 00 fa fa fa 00 00 fa fa 00 00
  0x0c047fff82b0: fa fa 00 00 fa fa 00 fa fa fa 01 fa fa fa 00 00
=>0x0c047fff82c0: fa fa 00 00 fa fa 00 00[fa]fa 01 fa fa fa 00 00
  0x0c047fff82d0: fa fa 01 fa fa fa 00 00 fa fa 01 fa fa fa 00 00
  0x0c047fff82e0: fa fa 01 fa fa fa 00 00 fa fa 01 fa fa fa 00 00
  0x0c047fff82f0: fa fa 01 fa fa fa 00 00 fa fa 01 fa fa fa 00 00
  0x0c047fff8300: fa fa 01 fa fa fa 00 00 fa fa 01 fa fa fa 00 00
  0x0c047fff8310: fa fa 01 fa fa fa 00 00 fa fa 01 fa fa fa 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==1805484==ABORTING

Impact

This vulnerability is capable of crashing software, use unexpected value, or possible code execution.
Occurrences

box_funcs.c L1997
```
Heap Buffer Overflow in function gf_isom_box_size
This is a GitHub Issue
repo:gpac
owner:gpac
Title : Heap Buffer Overflow in function gf_isom_box_size
Issue date:

--- start body ---
POC: [poc_hbo01_s.dat](https://github.com/JieyongMa/poc/raw/main/gpac/2023/poc_hbo01_s.dat)

```
Description

Heap Buffer Overflow in function gf_isom_box_size at src/isomedia/box_funcs.c:1997
gpac version

git log
commit bbca869177585aaca8eb66d8541079e6f364798e (HEAD -> master, origin/master, origin/HEAD)
Author: jeanlf <jeanlf@gpac.io>
Date:   Wed Jan 18 11:40:30 2023 +0100

    fixed potentially missing last packets in tsmux

POC

./MP4Box -bt ./poc_hbo01_s.dat
[iso file] Unknown top-level box type 0000
[iso file] Unknown top-level box type 0000
[iso file] Unknown top-level box type 0000
[iso file] Unknown box type 0000 in parent moov
[iso file] Unknown box type 0000 in parent mvex
[iso file] Read Box type 0000 (0x30303030) at position 544 has size 0 but is not at root/file level. Forbidden, skipping end of parent box !
[iso file] Box "mvex" (start 488) has 24 extra bytes
[iso file] Unknown box type 0000 in parent minf
[iso file] Unknown box type 0000 in parent minf
[iso file] Unknown box type 0000 in parent stbl
[iso file] Box "sgpd" (start 1154) has 8 extra bytes
[iso file] Missing DataInformationBox
[iso file] Track with no sample description box !
[iso file] Unknown box type 0000 in parent moov
[iso file] Unknown box type 0000 in parent moov
[iso file] Read Box type 0000 (0x30303030) at position 1261 has size 0 but is not at root/file level. Forbidden, skipping end of parent box !
[iso file] Box "moov" (start 351) has 655 extra bytes
[iso file] Unknown top-level box type 0000
[iso file] Unknown top-level box type 0000
[iso file] Unknown box type 0000 in parent moof
[iso file] Unknown box type 0000 in parent traf
[iso file] Box "sbgp" (start 2072) has 8 extra bytes
[iso file] Unknown box type 0000 in parent traf
[iso file] Unknown box type 0000 in parent traf
[iso file] Box "sgpd" (start 2168) has 12 extra bytes
[iso file] Unknown box type VOID in parent traf
[iso file] Read Box type 0000 (0x30303030) at position 2220 has size 0 but is not at root/file level. Forbidden, skipping end of parent box !
[iso file] Box "traf" (start 2028) has 406 extra bytes
[iso file] Unknown box type 0000 in parent moof
[iso file] default sample description set to 808464432 but only 0 sample description(s), likely broken ! Fixing to 1
[iso file] Box sgpd wrote 36 bytes but size is 48
=================================================================
==1805484==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000001640 at pc 0x7ffff1d15327 bp 0x7fffffff2e10 sp 0x7fffffff2e08
READ of size 8 at 0x602000001640 thread T0
    #0 0x7ffff1d15326 in gf_isom_box_size /home/fuzz/gpac/src/isomedia/box_funcs.c:1997:9
    #1 0x7ffff1ed4247 in gf_isom_is_identical_sgpd /home/fuzz/gpac/src/isomedia/isom_read.c:5865:3
    #2 0x7ffff235419a in MergeTrack /home/fuzz/gpac/src/isomedia/track.c:913:11
    #3 0x7ffff1d9f8bd in MergeFragment /home/fuzz/gpac/src/isomedia/isom_intern.c:92:7
    #4 0x7ffff1dbc1d7 in gf_isom_parse_movie_boxes_internal /home/fuzz/gpac/src/isomedia/isom_intern.c:722:9
    #5 0x7ffff1da7ace in gf_isom_parse_movie_boxes /home/fuzz/gpac/src/isomedia/isom_intern.c:868:6
    #6 0x7ffff1dc3c43 in gf_isom_open_file /home/fuzz/gpac/src/isomedia/isom_intern.c:988:19
    #7 0x7ffff1df57ff in gf_isom_open /home/fuzz/gpac/src/isomedia/isom_read.c:509:11
    #8 0x540f28 in mp4box_main /home/fuzz/gpac/applications/mp4box/mp4box.c:6221:12
    #9 0x5540c1 in main /home/fuzz/gpac/applications/mp4box/mp4box.c:6846:1
    #10 0x7fffee1e1082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #11 0x42ac7d in _start (/home/fuzz/gpac/bin/gcc/MP4Box+0x42ac7d)

0x602000001640 is located 0 bytes to the right of 16-byte region [0x602000001630,0x602000001640)
allocated by thread T0 here:
    #0 0x4a5edd in malloc (/home/fuzz/gpac/bin/gcc/MP4Box+0x4a5edd)
    #1 0x7ffff03674e4 in gf_malloc /home/fuzz/gpac/src/utils/alloc.c:150:9
    #2 0x7ffff1b28192 in sgpd_parse_entry /home/fuzz/gpac/src/isomedia/box_code_base.c:9994:2
    #3 0x7ffff1b1ed19 in sgpd_box_read /home/fuzz/gpac/src/isomedia/box_code_base.c:10259:9
    #4 0x7ffff1d1093f in gf_isom_box_read /home/fuzz/gpac/src/isomedia/box_funcs.c:1897:9
    #5 0x7ffff1d0b2d6 in gf_isom_box_parse_ex /home/fuzz/gpac/src/isomedia/box_funcs.c:282:14
    #6 0x7ffff1d18173 in gf_isom_box_array_read /home/fuzz/gpac/src/isomedia/box_funcs.c:1790:7
    #7 0x7ffff1aa4de4 in traf_box_read /home/fuzz/gpac/src/isomedia/box_code_base.c:6363:13
    #8 0x7ffff1d1093f in gf_isom_box_read /home/fuzz/gpac/src/isomedia/box_funcs.c:1897:9
    #9 0x7ffff1d0b2d6 in gf_isom_box_parse_ex /home/fuzz/gpac/src/isomedia/box_funcs.c:282:14
    #10 0x7ffff1d18173 in gf_isom_box_array_read /home/fuzz/gpac/src/isomedia/box_funcs.c:1790:7
    #11 0x7ffff1a2723c in moof_box_read /home/fuzz/gpac/src/isomedia/box_code_base.c:3676:9
    #12 0x7ffff1d1093f in gf_isom_box_read /home/fuzz/gpac/src/isomedia/box_funcs.c:1897:9
    #13 0x7ffff1d0b2d6 in gf_isom_box_parse_ex /home/fuzz/gpac/src/isomedia/box_funcs.c:282:14
    #14 0x7ffff1d06ad9 in gf_isom_parse_root_box /home/fuzz/gpac/src/isomedia/box_funcs.c:38:8
    #15 0x7ffff1da93a5 in gf_isom_parse_movie_boxes_internal /home/fuzz/gpac/src/isomedia/isom_intern.c:378:7
    #16 0x7ffff1da7ace in gf_isom_parse_movie_boxes /home/fuzz/gpac/src/isomedia/isom_intern.c:868:6
    #17 0x7ffff1dc3c43 in gf_isom_open_file /home/fuzz/gpac/src/isomedia/isom_intern.c:988:19
    #18 0x7ffff1df57ff in gf_isom_open /home/fuzz/gpac/src/isomedia/isom_read.c:509:11
    #19 0x540f28 in mp4box_main /home/fuzz/gpac/applications/mp4box/mp4box.c:6221:12
    #20 0x5540c1 in main /home/fuzz/gpac/applications/mp4box/mp4box.c:6846:1
    #21 0x7fffee1e1082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/fuzz/gpac/src/isomedia/box_funcs.c:1997:9 in gf_isom_box_size
Shadow bytes around the buggy address:
  0x0c047fff8270: fa fa 00 00 fa fa 01 fa fa fa 00 00 fa fa 01 fa
  0x0c047fff8280: fa fa 00 00 fa fa 01 fa fa fa 00 00 fa fa 00 00
  0x0c047fff8290: fa fa 00 00 fa fa 00 00 fa fa 07 fa fa fa 00 00
  0x0c047fff82a0: fa fa 00 00 fa fa 00 fa fa fa 00 00 fa fa 00 00
  0x0c047fff82b0: fa fa 00 00 fa fa 00 fa fa fa 01 fa fa fa 00 00
=>0x0c047fff82c0: fa fa 00 00 fa fa 00 00[fa]fa 01 fa fa fa 00 00
  0x0c047fff82d0: fa fa 01 fa fa fa 00 00 fa fa 01 fa fa fa 00 00
  0x0c047fff82e0: fa fa 01 fa fa fa 00 00 fa fa 01 fa fa fa 00 00
  0x0c047fff82f0: fa fa 01 fa fa fa 00 00 fa fa 01 fa fa fa 00 00
  0x0c047fff8300: fa fa 01 fa fa fa 00 00 fa fa 01 fa fa fa 00 00
  0x0c047fff8310: fa fa 01 fa fa fa 00 00 fa fa 01 fa fa fa 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==1805484==ABORTING

Impact

This vulnerability is capable of crashing software, use unexpected value, or possible code execution.
Occurrences

box_funcs.c L1997
```
--- end body ---

A heap buffer overflow vulnerability exists in the function gf_isom_box_size in GPAC version 1.1.0 and later. This vulnerability can be triggered by processing specially crafted MP4 files, leading to potential crashes, unexpected behavior, or even arbitrary code execution. The issue arises from improper handling of box sizes in the MP4 parsing code, specifically at line 1997 of box_funcs.c.