[POC](https://github.com/qianshuidewajueji/poc/blob/main/gpac/mhas_dmx_process_poc)

```
Version

➜  gcc git:(master) ✗ ./MP4Box -version                  
MP4Box - GPAC version 2.3-DEV-rev40-g3602a5ded-master
(c) 2000-2023 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
        GPAC Filters: https://doi.org/10.1145/3339825.3394929
        GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --enable-sanitizer --verbose
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SSL GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_PNG GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D 

Proof of Concept

➜  gcc git:(master) ✗ ./MP4Box -info mhas_dmx_process_poc
filters/reframe_mhas.c:625:25: runtime error: index 30 out of bounds for type 'u32 [28]'

Reproduce

./configure --enable-sanitizer --enable-debug
make
./MP4Box -info ./mhas_dmx_process_poc

Impact

This is capable of causing crashes by using unexpected value, or possible code execution.
Occurrences

reframe_mhas.c L625

            if (idx==0x1f)
                sr = gf_bs_read_int(ctx->bs, 24);
            else if (sr < nb_usac_sr) {
                sr = USACSampleRates[idx]; //while idx >= sizeof(USACSampleRates)-1,cased buffer over-read
            }
            ctx->nb_unknown_pck = 0;


```
buffer over-read in function mhas_dmx_process filters/reframe_mhas.c
This is a GitHub Issue
repo:gpac
owner:gpac
Title : buffer over-read in function mhas_dmx_process filters/reframe_mhas.c
Issue date:

--- start body ---
[POC](https://github.com/qianshuidewajueji/poc/blob/main/gpac/mhas_dmx_process_poc)

```
Version

➜  gcc git:(master) ✗ ./MP4Box -version                  
MP4Box - GPAC version 2.3-DEV-rev40-g3602a5ded-master
(c) 2000-2023 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
        GPAC Filters: https://doi.org/10.1145/3339825.3394929
        GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --enable-sanitizer --verbose
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SSL GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_PNG GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D 

Proof of Concept

➜  gcc git:(master) ✗ ./MP4Box -info mhas_dmx_process_poc
filters/reframe_mhas.c:625:25: runtime error: index 30 out of bounds for type 'u32 [28]'

Reproduce

./configure --enable-sanitizer --enable-debug
make
./MP4Box -info ./mhas_dmx_process_poc

Impact

This is capable of causing crashes by using unexpected value, or possible code execution.
Occurrences

reframe_mhas.c L625

            if (idx==0x1f)
                sr = gf_bs_read_int(ctx->bs, 24);
            else if (sr < nb_usac_sr) {
                sr = USACSampleRates[idx]; //while idx >= sizeof(USACSampleRates)-1,cased buffer over-read
            }
            ctx->nb_unknown_pck = 0;


```
--- end body ---

A buffer over-read vulnerability in the function mhas_dmx_process of GPAC version 2.3-DEV can lead to crashes or potential code execution. The issue occurs when an index value exceeds the bounds of the USACSampleRates array, specifically at line 625 of filters/reframe_mhas.c. This can be exploited by providing a specially crafted input that causes the index to be out of bounds, resulting in undefined behavior.