- [x] I looked for a similar issue and couldn't find any.
- [x] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [x] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). 

Hi, there.

There is a buffer overflow in gf_media_nalu_add_emulation_bytes, av_parsers.c:5007 in commit 592ba2689a3 that results in system abort (core dumped).

Here is my environment, compiler info and gpac version:
~~~~
Distributor ID:	Ubuntu
Description:	Ubuntu 16.04.6 LTS
Release:	16.04
Codename:	xenial
gcc: 5.4.0

MP4Box - GPAC version 1.1.0-DEV-rev1170-g592ba26-master
(c) 2000-2021 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io
	MINI build (encoders, decoders, audio and video output disabled)

Please cite our work in your research:
	GPAC Filters: https://doi.org/10.1145/3339825.3394929
	GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --static-bin --enable-debug
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_FREETYPE GPAC_HAS_JPEG GPAC_HAS_PNG  GPAC_DISABLE_3D
~~~~

To reproduce, run
~~~~
./MP4Box -info poc
~~~~

POC:
[poc.zip](https://github.com/gpac/gpac/files/7072675/mp4box-abort-overflow_gf_media_nalu_add_emulation_bytes5007.zip)
(unzip first)

Program output:
~~~~
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
realloc(): invalid next size
Aborted (core dumped)
~~~~

Here is the trace reported by ASAN:
~~~~
==28070==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x629000004200 at pc 0x7f655bc2eccf bp 0x7ffedbcd3990 sp 0x7ffedbcd3980
 WRITE of size 1 at 0x629000004200 thread T0
     #0 0x7f655bc2ecce in gf_media_nalu_add_emulation_bytes /playground/gpac/src/media_tools/av_parsers.c:5007
     #1 0x7f655bc2ecce in gf_media_avc_reformat_sei /playground/gpac/src/media_tools/av_parsers.c:6332
     #2 0x7f655c5263c8 in naludmx_parse_nal_avc /playground/gpac/src/filters/reframe_nalu.c:2404
     #3 0x7f655c5263c8 in naludmx_process /playground/gpac/src/filters/reframe_nalu.c:2874
     #4 0x7f655c1bd920 in gf_filter_process_task /playground/gpac/src/filter_core/filter.c:2441
     #5 0x7f655c17da62 in gf_fs_thread_proc /playground/gpac/src/filter_core/filter_session.c:1640
     #6 0x7f655c188930 in gf_fs_run /playground/gpac/src/filter_core/filter_session.c:1877
     #7 0x7f655bc60c15 in gf_media_import /playground/gpac/src/media_tools/media_import.c:1178
     #8 0x555ccf3eb72f in convert_file_info /playground/gpac/applications/mp4box/fileimport.c:128
     #9 0x555ccf3be515 in mp4boxMain /playground/gpac/applications/mp4box/main.c:5925
     #10 0x7f6559613bf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)
     #11 0x555ccf39f2d9 in _start (/playground/gpac/build-a/bin/gcc/MP4Box+0x872d9)
 
 0x629000004200 is located 0 bytes to the right of 16384-byte region [0x629000000200,0x629000004200)
 allocated by thread T0 here:
     #0 0x7f655dfd3f30 in realloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdef30)
     #1 0x7f655b537a14 in BS_WriteByte /playground/gpac/src/utils/bitstream.c:730
     #2 0x7f655b537a14 in gf_bs_write_u8 /playground/gpac/src/utils/bitstream.c:827
     #3 0x7f655bc2dda9 in gf_media_avc_reformat_sei /playground/gpac/src/media_tools/av_parsers.c:6303
     #4 0x7f655c5263c8 in naludmx_parse_nal_avc /playground/gpac/src/filters/reframe_nalu.c:2404
     #5 0x7f655c5263c8 in naludmx_process /playground/gpac/src/filters/reframe_nalu.c:2874
     #6 0x7f655c1bd920 in gf_filter_process_task /playground/gpac/src/filter_core/filter.c:2441
     #7 0x7f655c17da62 in gf_fs_thread_proc /playground/gpac/src/filter_core/filter_session.c:1640
     #8 0x7f655c188930 in gf_fs_run /playground/gpac/src/filter_core/filter_session.c:1877
     #9 0x7f655bc60c15 in gf_media_import /playground/gpac/src/media_tools/media_import.c:1178
     #10 0x555ccf3eb72f in convert_file_info /playground/gpac/applications/mp4box/fileimport.c:128
     #11 0x555ccf3be515 in mp4boxMain /playground/gpac/applications/mp4box/main.c:5925
     #12 0x7f6559613bf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)
 
 SUMMARY: AddressSanitizer: heap-buffer-overflow /playground/gpac/src/media_tools/av_parsers.c:5007 in gf_media_nalu_add_emulation_bytes
 Shadow bytes around the buggy address:
   0x0c527fff87f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c527fff8800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c527fff8810: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c527fff8820: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c527fff8830: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 =>0x0c527fff8840:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c527fff8850: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c527fff8860: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c527fff8870: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c527fff8880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c527fff8890: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 Shadow byte legend (one shadow byte represents 8 application bytes):
   Addressable:           00
   Partially addressable: 01 02 03 04 05 06 07 
   Heap left redzone:       fa
   Freed heap region:       fd
   Stack left redzone:      f1
   Stack mid redzone:       f2
   Stack right redzone:     f3
   Stack after return:      f5
   Stack use after scope:   f8
   Global redzone:          f9
   Global init order:       f6
   Poisoned by user:        f7
   Container overflow:      fc
   Array cookie:            ac
   Intra object redzone:    bb
   ASan internal:           fe
   Left alloca redzone:     ca
   Right alloca redzone:    cb
 ==28070==ABORTING

~~~~

System abort (Core dumped) caused by buffer overflow using MP4Box  in gf_media_nalu_add_emulation_bytes, av_parsers.c:5007
This is a GitHub Issue
repo:gpac
owner:gpac
Title : System abort (Core dumped) caused by buffer overflow using MP4Box  in gf_media_nalu_add_emulation_bytes, av_parsers.c:5007
Issue date:

--- start body ---
- [x] I looked for a similar issue and couldn't find any.
- [x] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [x] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). 

Hi, there.

There is a buffer overflow in gf_media_nalu_add_emulation_bytes, av_parsers.c:5007 in commit 592ba2689a3 that results in system abort (core dumped).

Here is my environment, compiler info and gpac version:
~~~~
Distributor ID:	Ubuntu
Description:	Ubuntu 16.04.6 LTS
Release:	16.04
Codename:	xenial
gcc: 5.4.0

MP4Box - GPAC version 1.1.0-DEV-rev1170-g592ba26-master
(c) 2000-2021 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io
	MINI build (encoders, decoders, audio and video output disabled)

Please cite our work in your research:
	GPAC Filters: https://doi.org/10.1145/3339825.3394929
	GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --static-bin --enable-debug
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_FREETYPE GPAC_HAS_JPEG GPAC_HAS_PNG  GPAC_DISABLE_3D
~~~~

To reproduce, run
~~~~
./MP4Box -info poc
~~~~

POC:
[poc.zip](https://github.com/gpac/gpac/files/7072675/mp4box-abort-overflow_gf_media_nalu_add_emulation_bytes5007.zip)
(unzip first)

Program output:
~~~~
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
[Core] exp-golomb read failed, not enough bits in bitstream !
realloc(): invalid next size
Aborted (core dumped)
~~~~

Here is the trace reported by ASAN:
~~~~
==28070==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x629000004200 at pc 0x7f655bc2eccf bp 0x7ffedbcd3990 sp 0x7ffedbcd3980
 WRITE of size 1 at 0x629000004200 thread T0
     #0 0x7f655bc2ecce in gf_media_nalu_add_emulation_bytes /playground/gpac/src/media_tools/av_parsers.c:5007
     #1 0x7f655bc2ecce in gf_media_avc_reformat_sei /playground/gpac/src/media_tools/av_parsers.c:6332
     #2 0x7f655c5263c8 in naludmx_parse_nal_avc /playground/gpac/src/filters/reframe_nalu.c:2404
     #3 0x7f655c5263c8 in naludmx_process /playground/gpac/src/filters/reframe_nalu.c:2874
     #4 0x7f655c1bd920 in gf_filter_process_task /playground/gpac/src/filter_core/filter.c:2441
     #5 0x7f655c17da62 in gf_fs_thread_proc /playground/gpac/src/filter_core/filter_session.c:1640
     #6 0x7f655c188930 in gf_fs_run /playground/gpac/src/filter_core/filter_session.c:1877
     #7 0x7f655bc60c15 in gf_media_import /playground/gpac/src/media_tools/media_import.c:1178
     #8 0x555ccf3eb72f in convert_file_info /playground/gpac/applications/mp4box/fileimport.c:128
     #9 0x555ccf3be515 in mp4boxMain /playground/gpac/applications/mp4box/main.c:5925
     #10 0x7f6559613bf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)
     #11 0x555ccf39f2d9 in _start (/playground/gpac/build-a/bin/gcc/MP4Box+0x872d9)
 
 0x629000004200 is located 0 bytes to the right of 16384-byte region [0x629000000200,0x629000004200)
 allocated by thread T0 here:
     #0 0x7f655dfd3f30 in realloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdef30)
     #1 0x7f655b537a14 in BS_WriteByte /playground/gpac/src/utils/bitstream.c:730
     #2 0x7f655b537a14 in gf_bs_write_u8 /playground/gpac/src/utils/bitstream.c:827
     #3 0x7f655bc2dda9 in gf_media_avc_reformat_sei /playground/gpac/src/media_tools/av_parsers.c:6303
     #4 0x7f655c5263c8 in naludmx_parse_nal_avc /playground/gpac/src/filters/reframe_nalu.c:2404
     #5 0x7f655c5263c8 in naludmx_process /playground/gpac/src/filters/reframe_nalu.c:2874
     #6 0x7f655c1bd920 in gf_filter_process_task /playground/gpac/src/filter_core/filter.c:2441
     #7 0x7f655c17da62 in gf_fs_thread_proc /playground/gpac/src/filter_core/filter_session.c:1640
     #8 0x7f655c188930 in gf_fs_run /playground/gpac/src/filter_core/filter_session.c:1877
     #9 0x7f655bc60c15 in gf_media_import /playground/gpac/src/media_tools/media_import.c:1178
     #10 0x555ccf3eb72f in convert_file_info /playground/gpac/applications/mp4box/fileimport.c:128
     #11 0x555ccf3be515 in mp4boxMain /playground/gpac/applications/mp4box/main.c:5925
     #12 0x7f6559613bf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)
 
 SUMMARY: AddressSanitizer: heap-buffer-overflow /playground/gpac/src/media_tools/av_parsers.c:5007 in gf_media_nalu_add_emulation_bytes
 Shadow bytes around the buggy address:
   0x0c527fff87f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c527fff8800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c527fff8810: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c527fff8820: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x0c527fff8830: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 =>0x0c527fff8840:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c527fff8850: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c527fff8860: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c527fff8870: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c527fff8880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x0c527fff8890: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 Shadow byte legend (one shadow byte represents 8 application bytes):
   Addressable:           00
   Partially addressable: 01 02 03 04 05 06 07 
   Heap left redzone:       fa
   Freed heap region:       fd
   Stack left redzone:      f1
   Stack mid redzone:       f2
   Stack right redzone:     f3
   Stack after return:      f5
   Stack use after scope:   f8
   Global redzone:          f9
   Global init order:       f6
   Poisoned by user:        f7
   Container overflow:      fc
   Array cookie:            ac
   Intra object redzone:    bb
   ASan internal:           fe
   Left alloca redzone:     ca
   Right alloca redzone:    cb
 ==28070==ABORTING

~~~~

--- end body ---

A buffer overflow vulnerability in the gf_media_nalu_add_emulation_bytes function of GPAC's MP4Box can lead to a system abort (core dumped). This issue occurs when processing certain media files, allowing an attacker to potentially exploit this vulnerability to crash the application or execute arbitrary code.