In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because a certain -1 return value is mishandled.
In gf_text_get_utf8_line  function, gf_utf8_wcstombs  return -1 with crafted srt file, it will cause szLineConv[i] = 0 out of bound write

root@ubuntu:/opt/niugx/cov_product/gpac/gpac-master/bin/gcc# gdb ./MP4Box 
GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.3) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./MP4Box...done.
(gdb) set args  -add crafted.srt overview.mp4
(gdb) r
Starting program: /opt/niugx/cov_product/gpac/gpac-master/bin/gcc/MP4Box -add crafted.srt overview.mp4
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Timed Text (SRT) import - text track 580 x 436, font Serif (size 18)

Program received signal SIGBUS, Bus error.
0x00007ffff79b2eeb in gf_text_get_utf8_line (szLine=0x7fffffff4d80 "0", lineSize=2048, txt_in=0x66c4e0, unicode_type=2) at media_tools/text_import.c:272
272             szLineConv[i] = 0;
(gdb) bt
#0  0x00007ffff79b2eeb in gf_text_get_utf8_line (szLine=0x7fffffff4d80 "0", lineSize=2048, txt_in=0x66c4e0, unicode_type=2) at media_tools/text_import.c:272
#1  0x00007ffff79b39c6 in gf_text_import_srt (import=0x7fffffff6030) at media_tools/text_import.c:429
#2  0x00007ffff79bd165 in gf_import_timed_text (import=0x7fffffff6030) at media_tools/text_import.c:2644
#3  0x00007ffff7933f09 in gf_media_import (importer=0x7fffffff6030) at media_tools/media_import.c:10619
#4  0x000000000043727a in import_file (dest=0x65d010, inName=0x7fffffffe7f6 "crafted.srt", import_flags=0, force_fps=0, frames_per_sample=0) at fileimport.c:685
#5  0x000000000041bdac in mp4boxMain (argc=4, argv=0x7fffffffe578) at main.c:4177
#6  0x000000000042215e in main (argc=4, argv=0x7fffffffe578) at main.c:5695
(gdb)

OOB issue of gf_text_get_utf8_line
This is a GitHub Issue
repo:gpac
owner:gpac
Title : OOB issue of gf_text_get_utf8_line
Issue date:

--- start body ---
In gf_text_get_utf8_line  function, gf_utf8_wcstombs  return -1 with crafted srt file, it will cause szLineConv[i] = 0 out of bound write

root@ubuntu:/opt/niugx/cov_product/gpac/gpac-master/bin/gcc# gdb ./MP4Box 
GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.3) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./MP4Box...done.
(gdb) set args  -add crafted.srt overview.mp4
(gdb) r
Starting program: /opt/niugx/cov_product/gpac/gpac-master/bin/gcc/MP4Box -add crafted.srt overview.mp4
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Timed Text (SRT) import - text track 580 x 436, font Serif (size 18)

Program received signal SIGBUS, Bus error.
0x00007ffff79b2eeb in gf_text_get_utf8_line (szLine=0x7fffffff4d80 "0", lineSize=2048, txt_in=0x66c4e0, unicode_type=2) at media_tools/text_import.c:272
272             szLineConv[i] = 0;
(gdb) bt
#0  0x00007ffff79b2eeb in gf_text_get_utf8_line (szLine=0x7fffffff4d80 "0", lineSize=2048, txt_in=0x66c4e0, unicode_type=2) at media_tools/text_import.c:272
#1  0x00007ffff79b39c6 in gf_text_import_srt (import=0x7fffffff6030) at media_tools/text_import.c:429
#2  0x00007ffff79bd165 in gf_import_timed_text (import=0x7fffffff6030) at media_tools/text_import.c:2644
#3  0x00007ffff7933f09 in gf_media_import (importer=0x7fffffff6030) at media_tools/media_import.c:10619
#4  0x000000000043727a in import_file (dest=0x65d010, inName=0x7fffffffe7f6 "crafted.srt", import_flags=0, force_fps=0, frames_per_sample=0) at fileimport.c:685
#5  0x000000000041bdac in mp4boxMain (argc=4, argv=0x7fffffffe578) at main.c:4177
#6  0x000000000042215e in main (argc=4, argv=0x7fffffffe578) at main.c:5695
(gdb)

--- end body ---

The function gf_text_get_utf8_line in GPAC has an out-of-bounds (OOB) write vulnerability. When the function gf_utf8_wcstombs returns -1 due to a crafted SRT file, it leads to an out-of-bounds write at szLineConv[i] = 0, which can cause memory corruption or crashes. This vulnerability can be exploited by providing a specially crafted SRT file to the MP4Box tool, resulting in a SIGBUS error and potential denial of service.