Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [X] I looked for a similar issue and couldn't find any.
- [X] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [X] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/

# Description

heap-buffer-overflow filters/reframe_nalu.c:3235 in naludmx_process

# Version info

```
MP4Box - GPAC version 2.1-DEV-rev587-gff923ef56-master
(c) 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
	GPAC Filters: https://doi.org/10.1145/3339825.3394929
	GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --enable-sanitizer
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SSL GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D
```

# Reproduce

compile and run

```
./configure --enable-sanitizer
make
./MP4Box import -add poc_hof.mov
```

Crash reported by sanitizer

```
[VVC] Error parsing NAL unit type 2
[VVC] Error parsing NAL unit type 16
[VVC] wrong num tile rows 43 in PPS
[VVC] Error parsing NAL unit type 16
[VVC] Error parsing Picture Param Set
[Core] exp-golomb read failed, not enough bits in bitstream !
[VVC] Error parsing NAL unit type 15
[VVC] Error parsing NAL unit type 8
Track Importing VVC - Width 4 Height 1 FPS 218971581/226394117
[VVC] wrong num tile rows 43 in PPS
[VVC] Error parsing NAL unit type 16
[VVC] Error parsing Picture Param Set
[VVC] Error parsing NAL unit type 0
[Core] exp-golomb read failed, not enough bits in bitstream !
[VVC] Error parsing NAL unit type 15
[VVC] Error parsing NAL unit type 8
[VVC] wrong num tile rows 43 in PPS
[VVC] Error parsing NAL unit type 16
[VVC] Error parsing Picture Param Set
=================================================================
==834991==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61700001065d at pc 0x7f732dd65152 bp 0x7ffd2c2cd4d0 sp 0x7ffd2c2cd4c0
READ of size 1 at 0x61700001065d thread T0
    #0 0x7f732dd65151 in naludmx_process filters/reframe_nalu.c:3235
    #1 0x7f732d91b9dc in gf_filter_process_task filter_core/filter.c:2760
    #2 0x7f732d8db663 in gf_fs_thread_proc filter_core/filter_session.c:1859
    #3 0x7f732d8e7f5e in gf_fs_run filter_core/filter_session.c:2120
    #4 0x7f732d32b0d1 in gf_media_import media_tools/media_import.c:1551
    #5 0x55f5fd358aec in import_file /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/fileimport.c:1498
    #6 0x55f5fd30d3db in do_add_cat /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/mp4box.c:4508
    #7 0x55f5fd30d3db in mp4box_main /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/mp4box.c:6124
    #8 0x7f732a8b6d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #9 0x7f732a8b6e3f in __libc_start_main_impl ../csu/libc-start.c:392
    #10 0x55f5fd2e9cb4 in _start (/home/sumuchuan/Desktop/gpac_fuzz/gpac/bin/gcc/MP4Box+0xabcb4)

0x61700001065d is located 1 bytes to the right of 732-byte region [0x617000010380,0x61700001065c)
allocated by thread T0 here:
    #0 0x7f7330410c18 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164
    #1 0x7f732dd622d8 in naludmx_process filters/reframe_nalu.c:3079
    #2 0x7f732d91b9dc in gf_filter_process_task filter_core/filter.c:2760
    #3 0x7f732d8db663 in gf_fs_thread_proc filter_core/filter_session.c:1859
    #4 0x7f732d8e7f5e in gf_fs_run filter_core/filter_session.c:2120
    #5 0x7f732d32b0d1 in gf_media_import media_tools/media_import.c:1551
    #6 0x55f5fd358aec in import_file /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/fileimport.c:1498
    #7 0x55f5fd30d3db in do_add_cat /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/mp4box.c:4508
    #8 0x55f5fd30d3db in mp4box_main /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/mp4box.c:6124
    #9 0x7f732a8b6d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-buffer-overflow filters/reframe_nalu.c:3235 in naludmx_process
Shadow bytes around the buggy address:
  0x0c2e7fffa070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e7fffa080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e7fffa090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e7fffa0a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e7fffa0b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c2e7fffa0c0: 00 00 00 00 00 00 00 00 00 00 00[04]fa fa fa fa
  0x0c2e7fffa0d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e7fffa0e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e7fffa0f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e7fffa100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e7fffa110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==834991==ABORTING
```

# POC

[poc_hof.zip](https://github.com/gpac/gpac/files/10208161/poc_hof.zip)


# Impact

Potentially causing DoS and RCE

# Credit 

Xdchase
heap-buffer-overflow filters/reframe_nalu.c:3235 in naludmx_process
This is a GitHub Issue
repo:gpac
owner:gpac
Title : heap-buffer-overflow filters/reframe_nalu.c:3235 in naludmx_process
Issue date:

--- start body ---
Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [X] I looked for a similar issue and couldn't find any.
- [X] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [X] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/

# Description

heap-buffer-overflow filters/reframe_nalu.c:3235 in naludmx_process

# Version info

```
MP4Box - GPAC version 2.1-DEV-rev587-gff923ef56-master
(c) 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
	GPAC Filters: https://doi.org/10.1145/3339825.3394929
	GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --enable-sanitizer
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SSL GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D
```

# Reproduce

compile and run

```
./configure --enable-sanitizer
make
./MP4Box import -add poc_hof.mov
```

Crash reported by sanitizer

```
[VVC] Error parsing NAL unit type 2
[VVC] Error parsing NAL unit type 16
[VVC] wrong num tile rows 43 in PPS
[VVC] Error parsing NAL unit type 16
[VVC] Error parsing Picture Param Set
[Core] exp-golomb read failed, not enough bits in bitstream !
[VVC] Error parsing NAL unit type 15
[VVC] Error parsing NAL unit type 8
Track Importing VVC - Width 4 Height 1 FPS 218971581/226394117
[VVC] wrong num tile rows 43 in PPS
[VVC] Error parsing NAL unit type 16
[VVC] Error parsing Picture Param Set
[VVC] Error parsing NAL unit type 0
[Core] exp-golomb read failed, not enough bits in bitstream !
[VVC] Error parsing NAL unit type 15
[VVC] Error parsing NAL unit type 8
[VVC] wrong num tile rows 43 in PPS
[VVC] Error parsing NAL unit type 16
[VVC] Error parsing Picture Param Set
=================================================================
==834991==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61700001065d at pc 0x7f732dd65152 bp 0x7ffd2c2cd4d0 sp 0x7ffd2c2cd4c0
READ of size 1 at 0x61700001065d thread T0
    #0 0x7f732dd65151 in naludmx_process filters/reframe_nalu.c:3235
    #1 0x7f732d91b9dc in gf_filter_process_task filter_core/filter.c:2760
    #2 0x7f732d8db663 in gf_fs_thread_proc filter_core/filter_session.c:1859
    #3 0x7f732d8e7f5e in gf_fs_run filter_core/filter_session.c:2120
    #4 0x7f732d32b0d1 in gf_media_import media_tools/media_import.c:1551
    #5 0x55f5fd358aec in import_file /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/fileimport.c:1498
    #6 0x55f5fd30d3db in do_add_cat /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/mp4box.c:4508
    #7 0x55f5fd30d3db in mp4box_main /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/mp4box.c:6124
    #8 0x7f732a8b6d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #9 0x7f732a8b6e3f in __libc_start_main_impl ../csu/libc-start.c:392
    #10 0x55f5fd2e9cb4 in _start (/home/sumuchuan/Desktop/gpac_fuzz/gpac/bin/gcc/MP4Box+0xabcb4)

0x61700001065d is located 1 bytes to the right of 732-byte region [0x617000010380,0x61700001065c)
allocated by thread T0 here:
    #0 0x7f7330410c18 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164
    #1 0x7f732dd622d8 in naludmx_process filters/reframe_nalu.c:3079
    #2 0x7f732d91b9dc in gf_filter_process_task filter_core/filter.c:2760
    #3 0x7f732d8db663 in gf_fs_thread_proc filter_core/filter_session.c:1859
    #4 0x7f732d8e7f5e in gf_fs_run filter_core/filter_session.c:2120
    #5 0x7f732d32b0d1 in gf_media_import media_tools/media_import.c:1551
    #6 0x55f5fd358aec in import_file /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/fileimport.c:1498
    #7 0x55f5fd30d3db in do_add_cat /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/mp4box.c:4508
    #8 0x55f5fd30d3db in mp4box_main /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/mp4box.c:6124
    #9 0x7f732a8b6d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-buffer-overflow filters/reframe_nalu.c:3235 in naludmx_process
Shadow bytes around the buggy address:
  0x0c2e7fffa070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e7fffa080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e7fffa090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e7fffa0a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e7fffa0b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c2e7fffa0c0: 00 00 00 00 00 00 00 00 00 00 00[04]fa fa fa fa
  0x0c2e7fffa0d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e7fffa0e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e7fffa0f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e7fffa100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e7fffa110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==834991==ABORTING
```

# POC

[poc_hof.zip](https://github.com/gpac/gpac/files/10208161/poc_hof.zip)


# Impact

Potentially causing DoS and RCE

# Credit 

Xdchase
--- end body ---
