GPAC through 2.2.1 has a use-after-free vulnerability in the function gf_bifs_flush_command_list in bifs/memory_decoder.c.
- [Y ] I looked for a similar issue and couldn't find any.
- [Y] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [Y] I give enough information for contributors to reproduce my issue 

**Description**
There is a Null Pointer Dereference detected by AddressSanitizer

**System info**
Ubuntu 22.04.2 LTS
GPAC-2.2.1

**Build command**
CC=afl-clang-fast CXX=afl-clang-fast++ CFLAGS="-ggdb -O0 -fsanitize=address,undefined -fno-omit-frame-pointer" CXXFLAGS="-ggdb -O0 -fsanitize=address,undefined -fno-omit-frame-pointer" LDFLAGS="-ggdb -O0 -fsanitize=address,undefined" ./configure && make

**crash command**
MP4Box -bt poc_file

poc_file: 
[poc_file.zip](https://github.com/gpac/gpac/files/12288185/poc_file.zip)

**Crash output**

AddressSanitizer:DEADLYSIGNAL
=================================================================
==841115==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fae75bd843e bp 0x7ffc7386e7a0 sp 0x7ffc7386e770 T0)
==841115==The signal is caused by a READ memory access.
==841115==Hint: address points to the zero page.
    #0 0x7fae75bd843e in BS_ReadByte /root/fuzz/gpac/src/utils/bitstream.c:458:9
    #1 0x7fae75bd8257 in gf_bs_read_bit /root/fuzz/gpac/src/utils/bitstream.c:538:17
    #2 0x7fae75bd8fae in gf_bs_read_int /root/fuzz/gpac/src/utils/bitstream.c:571:10
    #3 0x7fae75fc7481 in BM_ParseCommand /root/fuzz/gpac/src/bifs/memory_decoder.c:907:10
    #4 0x7fae75fc797a in gf_bifs_flush_command_list /root/fuzz/gpac/src/bifs/memory_decoder.c:965:9
    #5 0x7fae75fc81f5 in gf_bifs_decode_command_list /root/fuzz/gpac/src/bifs/memory_decoder.c:1045:3
    #6 0x7fae7645d0e4 in gf_sm_load_run_isom /root/fuzz/gpac/src/scene_manager/loader_isom.c:303:10
    #7 0x7fae7641bf38 in gf_sm_load_run /root/fuzz/gpac/src/scene_manager/scene_manager.c:719:28
    #8 0x555d766c901c in dump_isom_scene /root/fuzz/gpac/applications/mp4box/filedump.c:209:14
    #9 0x555d766b9725 in mp4box_main /root/fuzz/gpac/applications/mp4box/mp4box.c:6461:7
    #10 0x7fae75814d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) (BuildId: 69389d485a9793dbe873f0ea2c93e02efaa9aa3d)
    #11 0x7fae75814e3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f) (BuildId: 69389d485a9793dbe873f0ea2c93e02efaa9aa3d)
    #12 0x555d765e8d84 in _start (/usr/local/bin/MP4Box+0x33d84) (BuildId: b4d8f1db695ed5d11720498d0e1dbdb36eaf06af)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/fuzz/gpac/src/utils/bitstream.c:458:9 in BS_ReadByte
==841115==ABORTING
Null Pointer Dereference in function BS_ReadByte
This is a GitHub Issue
repo:gpac
owner:gpac
Title : Null Pointer Dereference in function BS_ReadByte
Issue date:

--- start body ---
- [Y ] I looked for a similar issue and couldn't find any.
- [Y] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [Y] I give enough information for contributors to reproduce my issue 

**Description**
There is a Null Pointer Dereference detected by AddressSanitizer

**System info**
Ubuntu 22.04.2 LTS
GPAC-2.2.1

**Build command**
CC=afl-clang-fast CXX=afl-clang-fast++ CFLAGS="-ggdb -O0 -fsanitize=address,undefined -fno-omit-frame-pointer" CXXFLAGS="-ggdb -O0 -fsanitize=address,undefined -fno-omit-frame-pointer" LDFLAGS="-ggdb -O0 -fsanitize=address,undefined" ./configure && make

**crash command**
MP4Box -bt poc_file

poc_file: 
[poc_file.zip](https://github.com/gpac/gpac/files/12288185/poc_file.zip)

**Crash output**

AddressSanitizer:DEADLYSIGNAL
=================================================================
==841115==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fae75bd843e bp 0x7ffc7386e7a0 sp 0x7ffc7386e770 T0)
==841115==The signal is caused by a READ memory access.
==841115==Hint: address points to the zero page.
    #0 0x7fae75bd843e in BS_ReadByte /root/fuzz/gpac/src/utils/bitstream.c:458:9
    #1 0x7fae75bd8257 in gf_bs_read_bit /root/fuzz/gpac/src/utils/bitstream.c:538:17
    #2 0x7fae75bd8fae in gf_bs_read_int /root/fuzz/gpac/src/utils/bitstream.c:571:10
    #3 0x7fae75fc7481 in BM_ParseCommand /root/fuzz/gpac/src/bifs/memory_decoder.c:907:10
    #4 0x7fae75fc797a in gf_bifs_flush_command_list /root/fuzz/gpac/src/bifs/memory_decoder.c:965:9
    #5 0x7fae75fc81f5 in gf_bifs_decode_command_list /root/fuzz/gpac/src/bifs/memory_decoder.c:1045:3
    #6 0x7fae7645d0e4 in gf_sm_load_run_isom /root/fuzz/gpac/src/scene_manager/loader_isom.c:303:10
    #7 0x7fae7641bf38 in gf_sm_load_run /root/fuzz/gpac/src/scene_manager/scene_manager.c:719:28
    #8 0x555d766c901c in dump_isom_scene /root/fuzz/gpac/applications/mp4box/filedump.c:209:14
    #9 0x555d766b9725 in mp4box_main /root/fuzz/gpac/applications/mp4box/mp4box.c:6461:7
    #10 0x7fae75814d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) (BuildId: 69389d485a9793dbe873f0ea2c93e02efaa9aa3d)
    #11 0x7fae75814e3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f) (BuildId: 69389d485a9793dbe873f0ea2c93e02efaa9aa3d)
    #12 0x555d765e8d84 in _start (/usr/local/bin/MP4Box+0x33d84) (BuildId: b4d8f1db695ed5d11720498d0e1dbdb36eaf06af)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/fuzz/gpac/src/utils/bitstream.c:458:9 in BS_ReadByte
==841115==ABORTING
--- end body ---

A Null Pointer Dereference vulnerability in the BS_ReadByte function of GPAC v2.2.1 allows attackers to cause a Denial of Service (DoS) by providing a specially crafted input file. This issue is triggered when the function attempts to read from a null pointer, leading to a segmentation fault as reported by AddressSanitizer.