https://github.com/Janette88/test_pocs/blob/main/sbo3

MP4Box -dash 1000 /home/fuzz/crashes/sbo3

```
Description

stack-buffer-overflow in gf_text_get_utf8_line at filters/load_text.c:381.

#Version

git log
commit 7edc40feef23efd8c9948292d269eae76fa475af (HEAD -> master, origin/master, origin/HEAD)
Author: jeanlf <jeanlf@gpac.io>
Date:   Thu Oct 12 16:58:53 2023 +0200

./bin/gcc/MP4Box -version
MP4Box - GPAC version 2.3-DEV-rev588-g7edc40fee-master
(c) 2000-2023 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Proof of Concept

./bin/gcc/MP4Box -dash 1000 /home/fuzz/crashes/sbo3
[Dasher] No template assigned, using $File$_dash$FS$$Number$
[Dasher] No bitrate property assigned to PID sbo_381, computing from bitstream
[TXTIn] Bad SRT formatting - expecting number got "m[ññ<?xml versi0"A217Z" minimumU.(17Z --> wi"
[TXTIn] Corrupted SRT frame 0 after frame 0
[TXTIn] Error scanning SRT frame 0 timing
[TXTIn] Corrupted SRT frame 0 after frame 0
[TXTIn] Error scanning SRT frame 0 timing
[TXTIn] Corrupted SRT frame 0 after frame 0
[TXTIn] Error scanning SRT frame 0 timing
[TXTIn] Corrupted SRT frame 0 after frame 0
[TXTIn] Error scanning SRT frame 0 timing
[TXTIn] Corrupted SRT frame 0 after frame 0
[TXTIn] Error scanning SRT frame 0 timing
[TXTIn] Corrupted SRT frame 0 after frame 0
[TXTIn] Error scanning SRT frame 0 timing
[TXTIn] Corrupted SRT frame 0 after frame 0
[TXTIn] Error scanning SRT frame 0 timing
[TXTIn] Corrupted SRT frame 0 after frame 0
[TXTIn] Error scanning SRT frame 0 timing
[TXTIn] Corrupted SRT frame -1 after frame 0
=================================================================
==59407==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffffffed310 at pc 0x7ffff761f16d bp 0x7ffffffebfe0 sp 0x7ffffffeb788
WRITE of size 2048 at 0x7ffffffed310 thread T0
    #0 0x7ffff761f16c in __interceptor_strcpy ../../../../src/libsanitizer/asan/asan_interceptors.cc:431
    #1 0x7ffff4d52d1c in strcpy /usr/include/x86_64-linux-gnu/bits/string_fortified.h:90
    #2 0x7ffff4d52d1c in gf_text_get_utf8_line filters/load_text.c:381
    #3 0x7ffff4d71af3 in txtin_process_srt filters/load_text.c:996
    #4 0x7ffff4d6b4f3 in txtin_process filters/load_text.c:4015
    #5 0x7ffff4a5d4ae in gf_filter_process_task filter_core/filter.c:2971
    #6 0x7ffff4a2ab11 in gf_fs_thread_proc filter_core/filter_session.c:2105
    #7 0x7ffff4a2f8b6 in gf_fs_run filter_core/filter_session.c:2405
    #8 0x7ffff43bc0bd in gf_dasher_process media_tools/dash_segmenter.c:1236
    #9 0x555555621d26 in do_dash /home/fuzz/gpac/applications/mp4box/mp4box.c:4831
    #10 0x555555621d26 in mp4box_main /home/fuzz/gpac/applications/mp4box/mp4box.c:6245
    #11 0x7ffff164c082 in __libc_start_main ../csu/libc-start.c:308
    #12 0x5555555fa05d in _start (/home/fuzz/gpac/bin/gcc/MP4Box+0xa605d)

Address 0x7ffffffed310 is located in stack of thread T0 at offset 2336 in frame
    #0 0x7ffff4d708ef in txtin_process_srt filters/load_text.c:949

  This frame has 14 object(s):
    [32, 36) 'sh' (line 950)
    [48, 52) 'sm' (line 950)
    [64, 68) 'ss' (line 950)
    [80, 84) 'sms' (line 950)
    [96, 100) 'eh' (line 950)
    [112, 116) 'em' (line 950)
    [128, 132) 'es' (line 950)
    [144, 148) 'ems' (line 950)
    [160, 164) 'char_len' (line 950)
    [176, 180) 'set_start_char' (line 951)
    [192, 196) 'set_end_char' (line 951)
    [208, 212) 'line' (line 952)
    [224, 248) '<unknown>'
    [288, 2336) 'szLine' (line 953) <== Memory access at offset 2336 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow ../../../../src/libsanitizer/asan/asan_interceptors.cc:431 in __interceptor_strcpy
Shadow bytes around the buggy address:
  0x10007fff5a10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff5a20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff5a30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff5a40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff5a50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10007fff5a60: 00 00[f3]f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3
  0x10007fff5a70: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff5a80: 00 00 00 00 00 00 f1 f1 f1 f1 04 f2 04 f2 04 f2
  0x10007fff5a90: 04 f2 00 00 00 f2 f2 f2 f2 f2 00 00 00 f3 f3 f3
  0x10007fff5aa0: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff5ab0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==59407==ABORTING

Impact

This is capable of causing crashes and allowing modification of stack memory which could lead to remote code execution.
Occurrences

load_text.c L381
```
stack-buffer-overflow in gf_text_get_utf8_line
This is a GitHub Issue
repo:gpac
owner:gpac
Title : stack-buffer-overflow in gf_text_get_utf8_line
Issue date:

--- start body ---
https://github.com/Janette88/test_pocs/blob/main/sbo3

MP4Box -dash 1000 /home/fuzz/crashes/sbo3

```
Description

stack-buffer-overflow in gf_text_get_utf8_line at filters/load_text.c:381.

#Version

git log
commit 7edc40feef23efd8c9948292d269eae76fa475af (HEAD -> master, origin/master, origin/HEAD)
Author: jeanlf <jeanlf@gpac.io>
Date:   Thu Oct 12 16:58:53 2023 +0200

./bin/gcc/MP4Box -version
MP4Box - GPAC version 2.3-DEV-rev588-g7edc40fee-master
(c) 2000-2023 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Proof of Concept

./bin/gcc/MP4Box -dash 1000 /home/fuzz/crashes/sbo3
[Dasher] No template assigned, using $File$_dash$FS$$Number$
[Dasher] No bitrate property assigned to PID sbo_381, computing from bitstream
[TXTIn] Bad SRT formatting - expecting number got "m[ññ<?xml versi0"A217Z" minimumU.(17Z --> wi"
[TXTIn] Corrupted SRT frame 0 after frame 0
[TXTIn] Error scanning SRT frame 0 timing
[TXTIn] Corrupted SRT frame 0 after frame 0
[TXTIn] Error scanning SRT frame 0 timing
[TXTIn] Corrupted SRT frame 0 after frame 0
[TXTIn] Error scanning SRT frame 0 timing
[TXTIn] Corrupted SRT frame 0 after frame 0
[TXTIn] Error scanning SRT frame 0 timing
[TXTIn] Corrupted SRT frame 0 after frame 0
[TXTIn] Error scanning SRT frame 0 timing
[TXTIn] Corrupted SRT frame 0 after frame 0
[TXTIn] Error scanning SRT frame 0 timing
[TXTIn] Corrupted SRT frame 0 after frame 0
[TXTIn] Error scanning SRT frame 0 timing
[TXTIn] Corrupted SRT frame 0 after frame 0
[TXTIn] Error scanning SRT frame 0 timing
[TXTIn] Corrupted SRT frame -1 after frame 0
=================================================================
==59407==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffffffed310 at pc 0x7ffff761f16d bp 0x7ffffffebfe0 sp 0x7ffffffeb788
WRITE of size 2048 at 0x7ffffffed310 thread T0
    #0 0x7ffff761f16c in __interceptor_strcpy ../../../../src/libsanitizer/asan/asan_interceptors.cc:431
    #1 0x7ffff4d52d1c in strcpy /usr/include/x86_64-linux-gnu/bits/string_fortified.h:90
    #2 0x7ffff4d52d1c in gf_text_get_utf8_line filters/load_text.c:381
    #3 0x7ffff4d71af3 in txtin_process_srt filters/load_text.c:996
    #4 0x7ffff4d6b4f3 in txtin_process filters/load_text.c:4015
    #5 0x7ffff4a5d4ae in gf_filter_process_task filter_core/filter.c:2971
    #6 0x7ffff4a2ab11 in gf_fs_thread_proc filter_core/filter_session.c:2105
    #7 0x7ffff4a2f8b6 in gf_fs_run filter_core/filter_session.c:2405
    #8 0x7ffff43bc0bd in gf_dasher_process media_tools/dash_segmenter.c:1236
    #9 0x555555621d26 in do_dash /home/fuzz/gpac/applications/mp4box/mp4box.c:4831
    #10 0x555555621d26 in mp4box_main /home/fuzz/gpac/applications/mp4box/mp4box.c:6245
    #11 0x7ffff164c082 in __libc_start_main ../csu/libc-start.c:308
    #12 0x5555555fa05d in _start (/home/fuzz/gpac/bin/gcc/MP4Box+0xa605d)

Address 0x7ffffffed310 is located in stack of thread T0 at offset 2336 in frame
    #0 0x7ffff4d708ef in txtin_process_srt filters/load_text.c:949

  This frame has 14 object(s):
    [32, 36) 'sh' (line 950)
    [48, 52) 'sm' (line 950)
    [64, 68) 'ss' (line 950)
    [80, 84) 'sms' (line 950)
    [96, 100) 'eh' (line 950)
    [112, 116) 'em' (line 950)
    [128, 132) 'es' (line 950)
    [144, 148) 'ems' (line 950)
    [160, 164) 'char_len' (line 950)
    [176, 180) 'set_start_char' (line 951)
    [192, 196) 'set_end_char' (line 951)
    [208, 212) 'line' (line 952)
    [224, 248) '<unknown>'
    [288, 2336) 'szLine' (line 953) <== Memory access at offset 2336 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow ../../../../src/libsanitizer/asan/asan_interceptors.cc:431 in __interceptor_strcpy
Shadow bytes around the buggy address:
  0x10007fff5a10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff5a20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff5a30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff5a40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff5a50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10007fff5a60: 00 00[f3]f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3
  0x10007fff5a70: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff5a80: 00 00 00 00 00 00 f1 f1 f1 f1 04 f2 04 f2 04 f2
  0x10007fff5a90: 04 f2 00 00 00 f2 f2 f2 f2 f2 00 00 00 f3 f3 f3
  0x10007fff5aa0: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff5ab0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==59407==ABORTING

Impact

This is capable of causing crashes and allowing modification of stack memory which could lead to remote code execution.
Occurrences

load_text.c L381
```
--- end body ---
