**version info:**
```
root@d8a714203f6e:# ./MP4Box -version
MP4Box - GPAC version 2.1-DEV-rev87-g053aae8-master
(c) 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
        GPAC Filters: https://doi.org/10.1145/3339825.3394929
        GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --prefix=/path_to_gpac/build --enable-debug --enable-sanitizer
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SSL GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_FAAD GPAC_HAS_MAD GPAC_HAS_LIBA52 GPAC_HAS_JPEG GPAC_HAS_PNG GPAC_HAS_FFMPEG GPAC_HAS_JP2 GPAC_HAS_THEORA GPAC_HAS_VORBIS GPAC_HAS_XVID GPAC_HAS_LINUX_DVB
```
**poc:** [poc]()
**command:** MP4Box -hint -out /dev/null $poc$

Here is the trace reported by ASAN:
```
root@d8a714203f6e:# ./MP4Box -hint -out /dev/null poc
==27771==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60600001c200 at pc 0x7f61f6ce996d bp 0x7ffc4d4c1900 sp 0x7ffc4d4c18f0
WRITE of size 1 at 0x60600001c200 thread T0
    #0 0x7f61f6ce996c in gf_isom_add_sample_aux_info_internal isomedia/isom_write.c:8515
    #1 0x7f61f6daffc3 in MergeTrack isomedia/track.c:1208
    #2 0x7f61f6bfe1d7 in MergeFragment isomedia/isom_intern.c:92
    #3 0x7f61f6c089ae in gf_isom_parse_movie_boxes_internal isomedia/isom_intern.c:713
    #4 0x7f61f6c0a80f in gf_isom_parse_movie_boxes isomedia/isom_intern.c:859
    #5 0x7f61f6c0b31c in gf_isom_open_file isomedia/isom_intern.c:979
    #6 0x7f61f6c175da in gf_isom_open isomedia/isom_read.c:520
    #7 0x43ea06 in mp4boxMain /path_to_gpac/applications/mp4box/main.c:5977
    #8 0x4416c3 in main /path_to_gpac/applications/mp4box/main.c:6594
    #9 0x7f61f308983f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)
    #10 0x40fd28 in _start (/path_to_gpac/build-ASAN/bin/MP4Box+0x40fd28)

0x60600001c200 is located 0 bytes to the right of 64-byte region [0x60600001c1c0,0x60600001c200)
allocated by thread T0 here:
    #0 0x7f61fb586961 in realloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98961)
    #1 0x7f61f644565c in gf_realloc utils/alloc.c:160
    #2 0x7f61f6ce95b6 in gf_isom_add_sample_aux_info_internal isomedia/isom_write.c:8506
    #3 0x7f61f6daffc3 in MergeTrack isomedia/track.c:1208
    #4 0x7f61f6bfe1d7 in MergeFragment isomedia/isom_intern.c:92
    #5 0x7f61f6c089ae in gf_isom_parse_movie_boxes_internal isomedia/isom_intern.c:713
    #6 0x7f61f6c0a80f in gf_isom_parse_movie_boxes isomedia/isom_intern.c:859
    #7 0x7f61f6c0b31c in gf_isom_open_file isomedia/isom_intern.c:979
    #8 0x7f61f6c175da in gf_isom_open isomedia/isom_read.c:520
    #9 0x43ea06 in mp4boxMain /path_to_gpac/applications/mp4box/main.c:5977
    #10 0x4416c3 in main /path_to_gpac/applications/mp4box/main.c:6594
    #11 0x7f61f308983f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)

SUMMARY: AddressSanitizer: heap-buffer-overflow isomedia/isom_write.c:8515 gf_isom_add_sample_aux_info_internal
```
When `sampleNumber=76` and `saiz->sample_alloc=32`, `saiz->sample_alloc` will double to 64 at line 8505. Therefore, `saiz->sample_info_size` points to a heap chunk of **64** bytes ( line 8506 ).

On lines 8514-8515, the loop is controlled by `sampleNumber`, which accesses the data in `saiz->sample_info_size` up to the **75th** byte, causing a heap buffer overflow vulnerability. 

This is mainly due to the **missing checks** for `sampleNumber` and `saiz->sample_alloc` .

https://github.com/gpac/gpac/blob/1dc48009a49bc495c119377a40a1226a1e480564/src/isomedia/isom_write.c#L8503-L8515

AddressSanitizer: heap-buffer-overflow in gf_isom_add_sample_aux_info_internal, isomedia/isom_write.c:8515
This is a GitHub Issue
repo:gpac
owner:gpac
Title : AddressSanitizer: heap-buffer-overflow in gf_isom_add_sample_aux_info_internal, isomedia/isom_write.c:8515
Issue date:

--- start body ---
**version info:**
```
root@d8a714203f6e:# ./MP4Box -version
MP4Box - GPAC version 2.1-DEV-rev87-g053aae8-master
(c) 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
        GPAC Filters: https://doi.org/10.1145/3339825.3394929
        GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --prefix=/path_to_gpac/build --enable-debug --enable-sanitizer
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SSL GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_FAAD GPAC_HAS_MAD GPAC_HAS_LIBA52 GPAC_HAS_JPEG GPAC_HAS_PNG GPAC_HAS_FFMPEG GPAC_HAS_JP2 GPAC_HAS_THEORA GPAC_HAS_VORBIS GPAC_HAS_XVID GPAC_HAS_LINUX_DVB
```
**poc:** [poc]()
**command:** MP4Box -hint -out /dev/null $poc$

Here is the trace reported by ASAN:
```
root@d8a714203f6e:# ./MP4Box -hint -out /dev/null poc
==27771==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60600001c200 at pc 0x7f61f6ce996d bp 0x7ffc4d4c1900 sp 0x7ffc4d4c18f0
WRITE of size 1 at 0x60600001c200 thread T0
    #0 0x7f61f6ce996c in gf_isom_add_sample_aux_info_internal isomedia/isom_write.c:8515
    #1 0x7f61f6daffc3 in MergeTrack isomedia/track.c:1208
    #2 0x7f61f6bfe1d7 in MergeFragment isomedia/isom_intern.c:92
    #3 0x7f61f6c089ae in gf_isom_parse_movie_boxes_internal isomedia/isom_intern.c:713
    #4 0x7f61f6c0a80f in gf_isom_parse_movie_boxes isomedia/isom_intern.c:859
    #5 0x7f61f6c0b31c in gf_isom_open_file isomedia/isom_intern.c:979
    #6 0x7f61f6c175da in gf_isom_open isomedia/isom_read.c:520
    #7 0x43ea06 in mp4boxMain /path_to_gpac/applications/mp4box/main.c:5977
    #8 0x4416c3 in main /path_to_gpac/applications/mp4box/main.c:6594
    #9 0x7f61f308983f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)
    #10 0x40fd28 in _start (/path_to_gpac/build-ASAN/bin/MP4Box+0x40fd28)

0x60600001c200 is located 0 bytes to the right of 64-byte region [0x60600001c1c0,0x60600001c200)
allocated by thread T0 here:
    #0 0x7f61fb586961 in realloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98961)
    #1 0x7f61f644565c in gf_realloc utils/alloc.c:160
    #2 0x7f61f6ce95b6 in gf_isom_add_sample_aux_info_internal isomedia/isom_write.c:8506
    #3 0x7f61f6daffc3 in MergeTrack isomedia/track.c:1208
    #4 0x7f61f6bfe1d7 in MergeFragment isomedia/isom_intern.c:92
    #5 0x7f61f6c089ae in gf_isom_parse_movie_boxes_internal isomedia/isom_intern.c:713
    #6 0x7f61f6c0a80f in gf_isom_parse_movie_boxes isomedia/isom_intern.c:859
    #7 0x7f61f6c0b31c in gf_isom_open_file isomedia/isom_intern.c:979
    #8 0x7f61f6c175da in gf_isom_open isomedia/isom_read.c:520
    #9 0x43ea06 in mp4boxMain /path_to_gpac/applications/mp4box/main.c:5977
    #10 0x4416c3 in main /path_to_gpac/applications/mp4box/main.c:6594
    #11 0x7f61f308983f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)

SUMMARY: AddressSanitizer: heap-buffer-overflow isomedia/isom_write.c:8515 gf_isom_add_sample_aux_info_internal
```
When `sampleNumber=76` and `saiz->sample_alloc=32`, `saiz->sample_alloc` will double to 64 at line 8505. Therefore, `saiz->sample_info_size` points to a heap chunk of **64** bytes ( line 8506 ).

On lines 8514-8515, the loop is controlled by `sampleNumber`, which accesses the data in `saiz->sample_info_size` up to the **75th** byte, causing a heap buffer overflow vulnerability. 

This is mainly due to the **missing checks** for `sampleNumber` and `saiz->sample_alloc` .

https://github.com/gpac/gpac/blob/1dc48009a49bc495c119377a40a1226a1e480564/src/isomedia/isom_write.c#L8503-L8515

--- end body ---
