- [x] I looked for a similar issue and couldn't find any.
- [x] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [x] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). 

Hi, there.

There is a segmentation fault in gf_odf_desc_copy, odf_codec.c:381 in commit  592ba2689a3.

Here is my environment, compiler info and gpac version:
~~~~
Distributor ID:	Ubuntu
Description:	Ubuntu 16.04.6 LTS
Release:	16.04
Codename:	xenial
gcc: 5.4.0

MP4Box - GPAC version 1.1.0-DEV-rev1170-g592ba26-master
(c) 2000-2021 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io
	MINI build (encoders, decoders, audio and video output disabled)

Please cite our work in your research:
	GPAC Filters: https://doi.org/10.1145/3339825.3394929
	GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --static-bin --enable-debug
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_FREETYPE GPAC_HAS_JPEG GPAC_HAS_PNG  GPAC_DISABLE_3D
~~~~

To reproduce, run
~~~~
./MP4Box -hint poc
~~~~

POC:
[poc.zip](https://github.com/gpac/gpac/files/7038609/mp4box-uaf_gf_odf_desc_copy381.zip)
(unzip first)

Here is the trace reported by gdb:
~~~~
Stopped reason: SIGSEGV
gef➤  bt
#0  gf_odf_desc_copy (inDesc=inDesc@entry=0x7fffffff6ae0, outDesc=outDesc@entry=0x2497550) at /mnt/data/playground/gpac/src/odf/odf_codec.c:381
#1  0x00000000009d2a3f in gf_isom_set_extraction_slc (the_file=the_file@entry=0x248c220, trackNumber=trackNumber@entry=0x6, StreamDescriptionIndex=StreamDescriptionIndex@entry=0x1, slConfig=slConfig@entry=0x7fffffff6ae0) at /mnt/data/playground/gpac/src/isomedia/isom_write.c:5468
#2  0x0000000000ce75ff in gf_hinter_finalize (file=file@entry=0x248c220, IOD_Profile=<optimized out>, bandwidth=bandwidth@entry=0x231) at /mnt/data/playground/gpac/src/media_tools/isom_hinter.c:1245
#3  0x000000000043c218 in HintFile (file=0x248c220, MTUSize=MTUSize@entry=0x59e, max_ptime=0x0, rtp_rate=0x0, base_flags=<optimized out>, copy_data=GF_FALSE, interleave=GF_FALSE, regular_iod=GF_FALSE, single_group=GF_FALSE, hint_no_offset=GF_FALSE) at /mnt/data/playground/gpac/applications/mp4box/main.c:3550
#4  0x000000000044bd42 in mp4boxMain (argc=<optimized out>, argv=<optimized out>) at /mnt/data/playground/gpac/applications/mp4box/main.c:6329
#5  0x0000000001f06bb6 in generic_start_main ()
#6  0x0000000001f071a5 in __libc_start_main ()
#7  0x000000000041c4e9 in _start ()
~~~~

According to my observation, I think this may be caused by use after  free issue. I also validate this bug with valgrind and get similar results. 

~~~~
==22725== Use of uninitialised value of size 8
==22725==    at 0xAEA2BE: free (in /playground/gpac/build-o/bin/gcc/MP4Box)
==22725==    by 0x44DD29: gf_cfg_new (in /playground/gpac/build-o/bin/gcc/MP4Box)
==22725==    by 0x457415: gf_cfg_init (in /playground/gpac/build-o/bin/gcc/MP4Box)
==22725==    by 0x4575D8: gf_init_global_config (in /playground/gpac/build-o/bin/gcc/MP4Box)
==22725==    by 0x43A6AB: gf_sys_init (in /playground/gpac/build-o/bin/gcc/MP4Box)
==22725==    by 0x4109B7: mp4boxMain (in /playground/gpac/build-o/bin/gcc/MP4Box)
==22725==    by 0xABC898: (below main) (in /playground/gpac/build-o/bin/gcc/MP4Box)
==22725== 
==22725== Use of uninitialised value of size 8
==22725==    at 0xAEA2CA: free (in /playground/gpac/build-o/bin/gcc/MP4Box)
==22725==    by 0x44DD29: gf_cfg_new (in /playground/gpac/build-o/bin/gcc/MP4Box)
==22725==    by 0x457415: gf_cfg_init (in /playground/gpac/build-o/bin/gcc/MP4Box)
==22725==    by 0x4575D8: gf_init_global_config (in /playground/gpac/build-o/bin/gcc/MP4Box)
==22725==    by 0x43A6AB: gf_sys_init (in /playground/gpac/build-o/bin/gcc/MP4Box)
==22725==    by 0x4109B7: mp4boxMain (in /playground/gpac/build-o/bin/gcc/MP4Box)
==22725==    by 0xABC898: (below main) (in /playground/gpac/build-o/bin/gcc/MP4Box)

==26998== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==26998==  Access not within mapped region at address 0x3E800B9BB8B
==26998==    at 0xB24FBE: __memcpy_avx_unaligned_erms (in /playground/gpac/build-o/bin/gcc/MP4Box)
==26998==    by 0x441E31: gf_bs_write_data (in /playground/gpac/build-o/bin/gcc/MP4Box)
==26998==    by 0x59FDE1: gf_odf_write_default (in /playground/gpac/build-o/bin/gcc/MP4Box)
==26998==    by 0x5A1005: gf_odf_desc_write (in /playground/gpac/build-o/bin/gcc/MP4Box)
==26998==    by 0x5A10E8: gf_odf_desc_copy (in /playground/gpac/build-o/bin/gcc/MP4Box)
==26998==    by 0x566F22: gf_isom_set_extraction_slc (in /playground/gpac/build-o/bin/gcc/MP4Box)
==26998==    by 0x62C2A7: gf_hinter_finalize (in /playground/gpac/build-o/bin/gcc/MP4Box)
==26998==    by 0x40FDE7: HintFile (in /playground/gpac/build-o/bin/gcc/MP4Box)
==26998==    by 0x4156E9: mp4boxMain (in /playground/gpac/build-o/bin/gcc/MP4Box)
==26998==    by 0xABC898: (below main) (in /playground/gpac/build-o/bin/gcc/MP4Box)
~~~~
Segmentation fault using mp4box in gf_odf_desc_copy, odf_codec.c:381
This is a GitHub Issue
repo:gpac
owner:gpac
Title : Segmentation fault using mp4box in gf_odf_desc_copy, odf_codec.c:381
Issue date:

--- start body ---
- [x] I looked for a similar issue and couldn't find any.
- [x] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [x] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). 

Hi, there.

There is a segmentation fault in gf_odf_desc_copy, odf_codec.c:381 in commit  592ba2689a3.

Here is my environment, compiler info and gpac version:
~~~~
Distributor ID:	Ubuntu
Description:	Ubuntu 16.04.6 LTS
Release:	16.04
Codename:	xenial
gcc: 5.4.0

MP4Box - GPAC version 1.1.0-DEV-rev1170-g592ba26-master
(c) 2000-2021 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io
	MINI build (encoders, decoders, audio and video output disabled)

Please cite our work in your research:
	GPAC Filters: https://doi.org/10.1145/3339825.3394929
	GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --static-bin --enable-debug
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_FREETYPE GPAC_HAS_JPEG GPAC_HAS_PNG  GPAC_DISABLE_3D
~~~~

To reproduce, run
~~~~
./MP4Box -hint poc
~~~~

POC:
[poc.zip](https://github.com/gpac/gpac/files/7038609/mp4box-uaf_gf_odf_desc_copy381.zip)
(unzip first)

Here is the trace reported by gdb:
~~~~
Stopped reason: SIGSEGV
gef➤  bt
#0  gf_odf_desc_copy (inDesc=inDesc@entry=0x7fffffff6ae0, outDesc=outDesc@entry=0x2497550) at /mnt/data/playground/gpac/src/odf/odf_codec.c:381
#1  0x00000000009d2a3f in gf_isom_set_extraction_slc (the_file=the_file@entry=0x248c220, trackNumber=trackNumber@entry=0x6, StreamDescriptionIndex=StreamDescriptionIndex@entry=0x1, slConfig=slConfig@entry=0x7fffffff6ae0) at /mnt/data/playground/gpac/src/isomedia/isom_write.c:5468
#2  0x0000000000ce75ff in gf_hinter_finalize (file=file@entry=0x248c220, IOD_Profile=<optimized out>, bandwidth=bandwidth@entry=0x231) at /mnt/data/playground/gpac/src/media_tools/isom_hinter.c:1245
#3  0x000000000043c218 in HintFile (file=0x248c220, MTUSize=MTUSize@entry=0x59e, max_ptime=0x0, rtp_rate=0x0, base_flags=<optimized out>, copy_data=GF_FALSE, interleave=GF_FALSE, regular_iod=GF_FALSE, single_group=GF_FALSE, hint_no_offset=GF_FALSE) at /mnt/data/playground/gpac/applications/mp4box/main.c:3550
#4  0x000000000044bd42 in mp4boxMain (argc=<optimized out>, argv=<optimized out>) at /mnt/data/playground/gpac/applications/mp4box/main.c:6329
#5  0x0000000001f06bb6 in generic_start_main ()
#6  0x0000000001f071a5 in __libc_start_main ()
#7  0x000000000041c4e9 in _start ()
~~~~

According to my observation, I think this may be caused by use after  free issue. I also validate this bug with valgrind and get similar results. 

~~~~
==22725== Use of uninitialised value of size 8
==22725==    at 0xAEA2BE: free (in /playground/gpac/build-o/bin/gcc/MP4Box)
==22725==    by 0x44DD29: gf_cfg_new (in /playground/gpac/build-o/bin/gcc/MP4Box)
==22725==    by 0x457415: gf_cfg_init (in /playground/gpac/build-o/bin/gcc/MP4Box)
==22725==    by 0x4575D8: gf_init_global_config (in /playground/gpac/build-o/bin/gcc/MP4Box)
==22725==    by 0x43A6AB: gf_sys_init (in /playground/gpac/build-o/bin/gcc/MP4Box)
==22725==    by 0x4109B7: mp4boxMain (in /playground/gpac/build-o/bin/gcc/MP4Box)
==22725==    by 0xABC898: (below main) (in /playground/gpac/build-o/bin/gcc/MP4Box)
==22725== 
==22725== Use of uninitialised value of size 8
==22725==    at 0xAEA2CA: free (in /playground/gpac/build-o/bin/gcc/MP4Box)
==22725==    by 0x44DD29: gf_cfg_new (in /playground/gpac/build-o/bin/gcc/MP4Box)
==22725==    by 0x457415: gf_cfg_init (in /playground/gpac/build-o/bin/gcc/MP4Box)
==22725==    by 0x4575D8: gf_init_global_config (in /playground/gpac/build-o/bin/gcc/MP4Box)
==22725==    by 0x43A6AB: gf_sys_init (in /playground/gpac/build-o/bin/gcc/MP4Box)
==22725==    by 0x4109B7: mp4boxMain (in /playground/gpac/build-o/bin/gcc/MP4Box)
==22725==    by 0xABC898: (below main) (in /playground/gpac/build-o/bin/gcc/MP4Box)

==26998== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==26998==  Access not within mapped region at address 0x3E800B9BB8B
==26998==    at 0xB24FBE: __memcpy_avx_unaligned_erms (in /playground/gpac/build-o/bin/gcc/MP4Box)
==26998==    by 0x441E31: gf_bs_write_data (in /playground/gpac/build-o/bin/gcc/MP4Box)
==26998==    by 0x59FDE1: gf_odf_write_default (in /playground/gpac/build-o/bin/gcc/MP4Box)
==26998==    by 0x5A1005: gf_odf_desc_write (in /playground/gpac/build-o/bin/gcc/MP4Box)
==26998==    by 0x5A10E8: gf_odf_desc_copy (in /playground/gpac/build-o/bin/gcc/MP4Box)
==26998==    by 0x566F22: gf_isom_set_extraction_slc (in /playground/gpac/build-o/bin/gcc/MP4Box)
==26998==    by 0x62C2A7: gf_hinter_finalize (in /playground/gpac/build-o/bin/gcc/MP4Box)
==26998==    by 0x40FDE7: HintFile (in /playground/gpac/build-o/bin/gcc/MP4Box)
==26998==    by 0x4156E9: mp4boxMain (in /playground/gpac/build-o/bin/gcc/MP4Box)
==26998==    by 0xABC898: (below main) (in /playground/gpac/build-o/bin/gcc/MP4Box)
~~~~
--- end body ---

A segmentation fault in the gf_odf_desc_copy function of GPAC's MP4Box allows for potential exploitation through crafted input, leading to a Denial of Service (DoS). The issue appears to be related to a use-after-free vulnerability, which can be exploited to cause crashes or potentially execute arbitrary code.