POC:  ./MP4Box -dash 1000 POC8
LINK: https://drive.google.com/file/d/1hEKZtbUJi2V4euDl3oWbIAX-amnG29H9/view?usp=share_link

```
The vulnerability seems to be located in the gf_swf_read_header function, as indicated by the AddressSanitizer report showing a heap-buffer-overflow error.

Here are the details:

==2451549==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000004e51 at pc 0x7f7dd3979c23 bp 0x7ffe4fe10840 sp 0x7ffe4fe0ffe8
WRITE of size 8 at 0x602000004e51 thread T0
#0 0x7f7dd3979c22 in __interceptor_memset ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:799
#1 0x7f7dd07731d2 in gf_swf_read_header (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x26111d2)
#2 0x7f7dd0f72a10 in gf_text_process_swf (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2e10a10)
#3 0x7f7dd0f637ef in txtin_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2e017ef)
#4 0x7f7dd0ca097c in gf_filter_process_task (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b3e97c)
#5 0x7f7dd0c5c00a in gf_fs_thread_proc (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2afa00a)
#6 0x7f7dd0c6992e in gf_fs_run (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b0792e)
#7 0x7f7dd04da0ce in gf_dasher_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x23780ce)
#8 0x5572a9ad2338 in do_dash /root/gpac2/gpac/applications/mp4box/mp4box.c:4807
#9 0x5572a9ad2338 in mp4box_main /root/gpac2/gpac/applications/mp4box/mp4box.c:6184
#10 0x7f7dcd92ed8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#11 0x7f7dcd92ee3f in __libc_start_main_impl ../csu/libc-start.c:392
#12 0x5572a9aa8cb4 in _start (/root/gpac2/gpac/bin/gcc/MP4Box+0xabcb4)

0x602000004e51 is located 0 bytes to the right of 1-byte region [0x602000004e50,0x602000004e51)
allocated by thread T0 here:
#0 0x7f7dd39f4867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x7f7dd07731ba in gf_swf_read_header (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x26111ba)
#2 0x7f7dd0f72a10 in gf_text_process_swf (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2e10a10)
#3 0x7f7dd0f637ef in txtin_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2e017ef)
#4 0x7f7dd0ca097c in gf_filter_process_task (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b3e97c)
#5 0x7f7dd0c5c00a in gf_fs_thread_proc (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2afa00a)
#6 0x7f7dd0c6992e in gf_fs_run (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b0792e)
#7 0x7f7dd04da0ce in gf_dasher_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x23780ce)
#8 0x5572a9ad2338 in do_dash /root/gpac2/gpac/applications/mp4box/mp4box.c:4807
#9 0x5572a9ad2338 in mp4box_main /root/gpac2/gpac/applications/mp4box/mp4box.c:6184
#10 0x7f7dcd92ed8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:799 in __interceptor_memset
Shadow bytes around the buggy address:
0x0c047fff8970: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
0x0c047fff8980: fa fa 00 00 fa fa fd fd fa fa fd fd fa fa 06 fa
0x0c047fff8990: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
0x0c047fff89a0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
0x0c047fff89b0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
=>0x0c047fff89c0: fa fa 00 00 fa fa 00 00 fa fa[01]fa fa fa fa fa
0x0c047fff89d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff89e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff89f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8a10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable:           00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone:       fa
Freed heap region:       fd
Stack left redzone:      f1
Stack mid redzone:       f2
Stack right redzone:     f3
Stack after return:      f5
Stack use after scope:   f8
Global redzone:          f9
Global init order:       f6
Poisoned by user:        f7
Container overflow:      fc
Array cookie:            ac
Intra object redzone:    bb
ASan internal:           fe
Left alloca redzone:     ca
Right alloca redzone:    cb
Shadow gap:              cc
==2451549==ABORTING
```
heap-buffer-overflow error in gf_swf_read_header()
This is a GitHub Issue
repo:gpac
owner:gpac
Title : heap-buffer-overflow error in gf_swf_read_header()
Issue date:

--- start body ---
POC:  ./MP4Box -dash 1000 POC8
LINK: https://drive.google.com/file/d/1hEKZtbUJi2V4euDl3oWbIAX-amnG29H9/view?usp=share_link

```
The vulnerability seems to be located in the gf_swf_read_header function, as indicated by the AddressSanitizer report showing a heap-buffer-overflow error.

Here are the details:

==2451549==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000004e51 at pc 0x7f7dd3979c23 bp 0x7ffe4fe10840 sp 0x7ffe4fe0ffe8
WRITE of size 8 at 0x602000004e51 thread T0
#0 0x7f7dd3979c22 in __interceptor_memset ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:799
#1 0x7f7dd07731d2 in gf_swf_read_header (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x26111d2)
#2 0x7f7dd0f72a10 in gf_text_process_swf (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2e10a10)
#3 0x7f7dd0f637ef in txtin_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2e017ef)
#4 0x7f7dd0ca097c in gf_filter_process_task (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b3e97c)
#5 0x7f7dd0c5c00a in gf_fs_thread_proc (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2afa00a)
#6 0x7f7dd0c6992e in gf_fs_run (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b0792e)
#7 0x7f7dd04da0ce in gf_dasher_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x23780ce)
#8 0x5572a9ad2338 in do_dash /root/gpac2/gpac/applications/mp4box/mp4box.c:4807
#9 0x5572a9ad2338 in mp4box_main /root/gpac2/gpac/applications/mp4box/mp4box.c:6184
#10 0x7f7dcd92ed8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#11 0x7f7dcd92ee3f in __libc_start_main_impl ../csu/libc-start.c:392
#12 0x5572a9aa8cb4 in _start (/root/gpac2/gpac/bin/gcc/MP4Box+0xabcb4)

0x602000004e51 is located 0 bytes to the right of 1-byte region [0x602000004e50,0x602000004e51)
allocated by thread T0 here:
#0 0x7f7dd39f4867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x7f7dd07731ba in gf_swf_read_header (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x26111ba)
#2 0x7f7dd0f72a10 in gf_text_process_swf (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2e10a10)
#3 0x7f7dd0f637ef in txtin_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2e017ef)
#4 0x7f7dd0ca097c in gf_filter_process_task (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b3e97c)
#5 0x7f7dd0c5c00a in gf_fs_thread_proc (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2afa00a)
#6 0x7f7dd0c6992e in gf_fs_run (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b0792e)
#7 0x7f7dd04da0ce in gf_dasher_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x23780ce)
#8 0x5572a9ad2338 in do_dash /root/gpac2/gpac/applications/mp4box/mp4box.c:4807
#9 0x5572a9ad2338 in mp4box_main /root/gpac2/gpac/applications/mp4box/mp4box.c:6184
#10 0x7f7dcd92ed8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:799 in __interceptor_memset
Shadow bytes around the buggy address:
0x0c047fff8970: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
0x0c047fff8980: fa fa 00 00 fa fa fd fd fa fa fd fd fa fa 06 fa
0x0c047fff8990: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
0x0c047fff89a0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
0x0c047fff89b0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
=>0x0c047fff89c0: fa fa 00 00 fa fa 00 00 fa fa[01]fa fa fa fa fa
0x0c047fff89d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff89e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff89f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8a10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable:           00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone:       fa
Freed heap region:       fd
Stack left redzone:      f1
Stack mid redzone:       f2
Stack right redzone:     f3
Stack after return:      f5
Stack use after scope:   f8
Global redzone:          f9
Global init order:       f6
Poisoned by user:        f7
Container overflow:      fc
Array cookie:            ac
Intra object redzone:    bb
ASan internal:           fe
Left alloca redzone:     ca
Right alloca redzone:    cb
Shadow gap:              cc
==2451549==ABORTING
```
--- end body ---

A heap-buffer-overflow vulnerability in the gf_swf_read_header function of GPAC allows attackers to potentially exploit memory corruption issues, leading to application crashes or arbitrary code execution. The AddressSanitizer report indicates that the overflow occurs when the function attempts to write beyond the allocated memory, which can be triggered by specially crafted input files.