# Version
```
$ ./MP4Box -version
MP4Box - GPAC version 2.3-DEV-rev566-g50c2ab06f-master
```

# Platform
```
$ uname -a
Linux user-GE40-2PC-Dragon-Eyes 6.2.0-33-generic #33~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep  7 10:33:52 UTC 2 x86_64 x86_64 x86_64 GNU/Linux
```

# Asan
```
/home/user/vul/MP4Box_crash/id000000sig06src000693time10872278execs106399ophavocrep16
[33m[M3U8] Unsupported directive #EXT-X-SE>8ER-CONTROL:P@RT-HOL0-BACK=3
[0m[33m[M3U8] Unsupported directive #EXT-X-PA
[0m[33m[M3U8] Unsupported directive #EXT-X-INDEPENDENT�SE�XT-X-INDEPENDENT-SEGMENTS
[0m=================================================================
==822909==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6040000006f8 at pc 0x7f8553b00fb8 bp 0x7ffdd0c64ed0 sp 0x7ffdd0c64ec8
READ of size 8 at 0x6040000006f8 thread T0
    #0 0x7f8553b00fb7 in parse_attributes /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:529:10
    #1 0x7f8553b00fb7 in gf_m3u8_parse_sub_playlist /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:1233:18
    #2 0x7f8553b18174 in gf_m3u8_to_mpd /home/user/fuzzing_gpac/gpac/src/media_tools/mpd.c:2230:6
    #3 0x7f8553b5ad99 in gf_dash_open /home/user/fuzzing_gpac/gpac/src/media_tools/dash_client.c:8506:8
    #4 0x7f85542e97fe in dashdmx_configure_pid /home/user/fuzzing_gpac/gpac/src/filters/dmx_dash.c:1973:7
    #5 0x7f855410740c in gf_filter_pid_configure /home/user/fuzzing_gpac/gpac/src/filter_core/filter_pid.c:876:6
    #6 0x7f85541262a6 in gf_filter_pid_connect_task /home/user/fuzzing_gpac/gpac/src/filter_core/filter_pid.c:1230:3
    #7 0x7f855417d47b in gf_fs_thread_proc /home/user/fuzzing_gpac/gpac/src/filter_core/filter_session.c:2105:3
    #8 0x7f855417b5cf in gf_fs_run /home/user/fuzzing_gpac/gpac/src/filter_core/filter_session.c:2405:3
    #9 0x7f8553a2ac6a in gf_dasher_process /home/user/fuzzing_gpac/gpac/src/media_tools/dash_segmenter.c:1236:6
    #10 0x55daa16d76dc in do_dash /home/user/fuzzing_gpac/gpac/applications/mp4box/mp4box.c:4831:15
    #11 0x55daa16c8b6e in mp4box_main /home/user/fuzzing_gpac/gpac/applications/mp4box/mp4box.c:6245:7
    #12 0x7f8552a29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #13 0x7f8552a29e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #14 0x55daa15f0dd4 in _start (/home/user/fuzzing_gpac/gpac/bin/gcc/MP4Box+0x82dd4) (BuildId: 53333ca7bff59dd9a3d1b2821e7c5f3a9aac76b9)

0x6040000006f8 is located 0 bytes to the right of 40-byte region [0x6040000006d0,0x6040000006f8)
allocated by thread T0 here:
    #0 0x55daa1673e08 in __interceptor_calloc (/home/user/fuzzing_gpac/gpac/bin/gcc/MP4Box+0x105e08) (BuildId: 53333ca7bff59dd9a3d1b2821e7c5f3a9aac76b9)
    #1 0x7f8553b043c0 in extract_attributes /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:329:8

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:529:10 in parse_attributes
Shadow bytes around the buggy address:
  0x0c087fff8080: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x0c087fff8090: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x0c087fff80a0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x0c087fff80b0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x0c087fff80c0: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
=>0x0c087fff80d0: fa fa 00 00 00 00 00 03 fa fa 00 00 00 00 00[fa]
  0x0c087fff80e0: fa fa 00 00 00 00 02 fa fa fa fa fa fa fa fa fa
  0x0c087fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==822909==ABORTING
```

# Reproduce
```
./MP4Box -dash 10000 poc
```
 
# POC File
https://github.com/gandalf4a/crash_report/blob/main/gpac/MP4Box/hbo_529

# Credit
```
Gandalf4a
```
heap-buffer-overflow in /gpac/src/media_tools/m3u8.c:529:10 in parse_attributes
This is a GitHub Issue
repo:gpac
owner:gpac
Title : heap-buffer-overflow in /gpac/src/media_tools/m3u8.c:529:10 in parse_attributes
Issue date:

--- start body ---
# Version
```
$ ./MP4Box -version
MP4Box - GPAC version 2.3-DEV-rev566-g50c2ab06f-master
```

# Platform
```
$ uname -a
Linux user-GE40-2PC-Dragon-Eyes 6.2.0-33-generic #33~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep  7 10:33:52 UTC 2 x86_64 x86_64 x86_64 GNU/Linux
```

# Asan
```
/home/user/vul/MP4Box_crash/id000000sig06src000693time10872278execs106399ophavocrep16
[33m[M3U8] Unsupported directive #EXT-X-SE>8ER-CONTROL:P@RT-HOL0-BACK=3
[0m[33m[M3U8] Unsupported directive #EXT-X-PA
[0m[33m[M3U8] Unsupported directive #EXT-X-INDEPENDENT�SE�XT-X-INDEPENDENT-SEGMENTS
[0m=================================================================
==822909==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6040000006f8 at pc 0x7f8553b00fb8 bp 0x7ffdd0c64ed0 sp 0x7ffdd0c64ec8
READ of size 8 at 0x6040000006f8 thread T0
    #0 0x7f8553b00fb7 in parse_attributes /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:529:10
    #1 0x7f8553b00fb7 in gf_m3u8_parse_sub_playlist /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:1233:18
    #2 0x7f8553b18174 in gf_m3u8_to_mpd /home/user/fuzzing_gpac/gpac/src/media_tools/mpd.c:2230:6
    #3 0x7f8553b5ad99 in gf_dash_open /home/user/fuzzing_gpac/gpac/src/media_tools/dash_client.c:8506:8
    #4 0x7f85542e97fe in dashdmx_configure_pid /home/user/fuzzing_gpac/gpac/src/filters/dmx_dash.c:1973:7
    #5 0x7f855410740c in gf_filter_pid_configure /home/user/fuzzing_gpac/gpac/src/filter_core/filter_pid.c:876:6
    #6 0x7f85541262a6 in gf_filter_pid_connect_task /home/user/fuzzing_gpac/gpac/src/filter_core/filter_pid.c:1230:3
    #7 0x7f855417d47b in gf_fs_thread_proc /home/user/fuzzing_gpac/gpac/src/filter_core/filter_session.c:2105:3
    #8 0x7f855417b5cf in gf_fs_run /home/user/fuzzing_gpac/gpac/src/filter_core/filter_session.c:2405:3
    #9 0x7f8553a2ac6a in gf_dasher_process /home/user/fuzzing_gpac/gpac/src/media_tools/dash_segmenter.c:1236:6
    #10 0x55daa16d76dc in do_dash /home/user/fuzzing_gpac/gpac/applications/mp4box/mp4box.c:4831:15
    #11 0x55daa16c8b6e in mp4box_main /home/user/fuzzing_gpac/gpac/applications/mp4box/mp4box.c:6245:7
    #12 0x7f8552a29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #13 0x7f8552a29e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #14 0x55daa15f0dd4 in _start (/home/user/fuzzing_gpac/gpac/bin/gcc/MP4Box+0x82dd4) (BuildId: 53333ca7bff59dd9a3d1b2821e7c5f3a9aac76b9)

0x6040000006f8 is located 0 bytes to the right of 40-byte region [0x6040000006d0,0x6040000006f8)
allocated by thread T0 here:
    #0 0x55daa1673e08 in __interceptor_calloc (/home/user/fuzzing_gpac/gpac/bin/gcc/MP4Box+0x105e08) (BuildId: 53333ca7bff59dd9a3d1b2821e7c5f3a9aac76b9)
    #1 0x7f8553b043c0 in extract_attributes /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:329:8

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/user/fuzzing_gpac/gpac/src/media_tools/m3u8.c:529:10 in parse_attributes
Shadow bytes around the buggy address:
  0x0c087fff8080: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x0c087fff8090: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x0c087fff80a0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x0c087fff80b0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x0c087fff80c0: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
=>0x0c087fff80d0: fa fa 00 00 00 00 00 03 fa fa 00 00 00 00 00[fa]
  0x0c087fff80e0: fa fa 00 00 00 00 02 fa fa fa fa fa fa fa fa fa
  0x0c087fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==822909==ABORTING
```

# Reproduce
```
./MP4Box -dash 10000 poc
```
 
# POC File
https://github.com/gandalf4a/crash_report/blob/main/gpac/MP4Box/hbo_529

# Credit
```
Gandalf4a
```
--- end body ---

A heap buffer overflow vulnerability exists in the `parse_attributes` function of the GPAC library, specifically in the `m3u8.c` file. This vulnerability can be triggered by processing specially crafted M3U8 playlists, leading to potential arbitrary code execution or application crashes. The issue arises from improper handling of memory allocation, which allows reading beyond the allocated buffer size, as indicated by AddressSanitizer reports.