###  Description
Stack buffer overflow in function dimC_box_read at isomedia/box_code_3gpp.c:1081
### System info
ubuntu 20.04 lts
### version info:
```
/MP4Box -version
MP4Box - GPAC version 2.1-DEV-rev428-gcb8ae46c8-master
(c) 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
	GPAC Filters: https://doi.org/10.1145/3339825.3394929
	GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --enable-sanitizer
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D 
```
### compile
./configure --enable-sanitizer 
make

### crash command:
./MP4Box -bt poc

### poc :
[poc.zip](https://github.com/gpac/gpac/files/9893514/poc.zip)

Here is stack overflow output by ASAN:

```
[ISOBMFF] AV1ConfigurationBox: read only 4 bytes (expected 16).
[iso file] Box "av1C" (start 20) has 12 extra bytes
=================================================================
==11666==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd002eb3a0 at pc 0x7fb38db0e3ad bp 0x7ffd002eaf30 sp 0x7ffd002ea6d8
READ of size 1028 at 0x7ffd002eb3a0 thread T0
    #0 0x7fb38db0e3ac in __interceptor_strdup ../../../../src/libsanitizer/asan/asan_interceptors.cc:443
    #1 0x7fb38a731423 in dimC_box_read isomedia/box_code_3gpp.c:1081
    #2 0x7fb38a7efa33 in gf_isom_box_read isomedia/box_funcs.c:1866
    #3 0x7fb38a7efa33 in gf_isom_box_parse_ex isomedia/box_funcs.c:271
    #4 0x7fb38a7f0e85 in gf_isom_parse_root_box isomedia/box_funcs.c:38
    #5 0x7fb38a819efc in gf_isom_parse_movie_boxes_internal isomedia/isom_intern.c:378
    #6 0x7fb38a820111 in gf_isom_parse_movie_boxes isomedia/isom_intern.c:868
    #7 0x7fb38a820111 in gf_isom_open_file isomedia/isom_intern.c:988
    #8 0x5652cd468139 in mp4box_main /home/fuzz/gpac/applications/mp4box/mp4box.c:6211
    #9 0x7fb387d9c082 in __libc_start_main ../csu/libc-start.c:308
    #10 0x5652cd443cbd in _start (/home/fuzz/gpac/bin/gcc/MP4Box+0xa3cbd)

Address 0x7ffd002eb3a0 is located in stack of thread T0 at offset 1056 in frame
    #0 0x7fb38a730eff in dimC_box_read isomedia/box_code_3gpp.c:1048

  This frame has 1 object(s):
    [32, 1056) 'str' (line 1049) <== Memory access at offset 1056 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow ../../../../src/libsanitizer/asan/asan_interceptors.cc:443 in __interceptor_strdup
Shadow bytes around the buggy address:
  0x100020055620: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100020055630: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100020055640: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100020055650: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100020055660: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x100020055670: 00 00 00 00[f3]f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3
  0x100020055680: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
  0x100020055690: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
  0x1000200556a0: f1 f1 f8 f2 00 f2 f2 f2 00 00 f3 f3 00 00 00 00
  0x1000200556b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000200556c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==11666==ABORTING
```
### Impact
This is capable of causing crashes and allowing modification of stack memory which could lead to remote code execution.

Stack buffer overflow in function dimC_box_read at isomedia/box_code_3gpp.c:1081
This is a GitHub Issue
repo:gpac
owner:gpac
Title : Stack buffer overflow in function dimC_box_read at isomedia/box_code_3gpp.c:1081
Issue date:

--- start body ---
###  Description
Stack buffer overflow in function dimC_box_read at isomedia/box_code_3gpp.c:1081
### System info
ubuntu 20.04 lts
### version info:
```
/MP4Box -version
MP4Box - GPAC version 2.1-DEV-rev428-gcb8ae46c8-master
(c) 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
	GPAC Filters: https://doi.org/10.1145/3339825.3394929
	GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --enable-sanitizer
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D 
```
### compile
./configure --enable-sanitizer 
make

### crash command:
./MP4Box -bt poc

### poc :
[poc.zip](https://github.com/gpac/gpac/files/9893514/poc.zip)

Here is stack overflow output by ASAN:

```
[ISOBMFF] AV1ConfigurationBox: read only 4 bytes (expected 16).
[iso file] Box "av1C" (start 20) has 12 extra bytes
=================================================================
==11666==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd002eb3a0 at pc 0x7fb38db0e3ad bp 0x7ffd002eaf30 sp 0x7ffd002ea6d8
READ of size 1028 at 0x7ffd002eb3a0 thread T0
    #0 0x7fb38db0e3ac in __interceptor_strdup ../../../../src/libsanitizer/asan/asan_interceptors.cc:443
    #1 0x7fb38a731423 in dimC_box_read isomedia/box_code_3gpp.c:1081
    #2 0x7fb38a7efa33 in gf_isom_box_read isomedia/box_funcs.c:1866
    #3 0x7fb38a7efa33 in gf_isom_box_parse_ex isomedia/box_funcs.c:271
    #4 0x7fb38a7f0e85 in gf_isom_parse_root_box isomedia/box_funcs.c:38
    #5 0x7fb38a819efc in gf_isom_parse_movie_boxes_internal isomedia/isom_intern.c:378
    #6 0x7fb38a820111 in gf_isom_parse_movie_boxes isomedia/isom_intern.c:868
    #7 0x7fb38a820111 in gf_isom_open_file isomedia/isom_intern.c:988
    #8 0x5652cd468139 in mp4box_main /home/fuzz/gpac/applications/mp4box/mp4box.c:6211
    #9 0x7fb387d9c082 in __libc_start_main ../csu/libc-start.c:308
    #10 0x5652cd443cbd in _start (/home/fuzz/gpac/bin/gcc/MP4Box+0xa3cbd)

Address 0x7ffd002eb3a0 is located in stack of thread T0 at offset 1056 in frame
    #0 0x7fb38a730eff in dimC_box_read isomedia/box_code_3gpp.c:1048

  This frame has 1 object(s):
    [32, 1056) 'str' (line 1049) <== Memory access at offset 1056 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow ../../../../src/libsanitizer/asan/asan_interceptors.cc:443 in __interceptor_strdup
Shadow bytes around the buggy address:
  0x100020055620: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100020055630: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100020055640: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100020055650: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100020055660: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x100020055670: 00 00 00 00[f3]f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3
  0x100020055680: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
  0x100020055690: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
  0x1000200556a0: f1 f1 f8 f2 00 f2 f2 f2 00 00 f3 f3 00 00 00 00
  0x1000200556b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000200556c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==11666==ABORTING
```
### Impact
This is capable of causing crashes and allowing modification of stack memory which could lead to remote code execution.

--- end body ---

A stack buffer overflow vulnerability in the function dimC_box_read of GPAC version 2.1-DEV can lead to crashes and potentially allow remote code execution. The issue arises when the function attempts to read more data than the allocated stack space, resulting in memory corruption.