Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [x] I looked for a similar issue and couldn't find any.
- [x] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [x] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/

Version:

```shell
/home/hankle/Testing/source/gpac/bin/gcc/MP4Box -version                                                                                                        
MP4Box - GPAC version 1.1.0-DEV-rev1574-g8b22f0912-master
(c) 2000-2021 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io
        MINI build (encoders, decoders, audio and video output disabled)

Please cite our work in your research:
        GPAC Filters: https://doi.org/10.1145/3339825.3394929
        GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --static-mp4box --enable-debug --prefix=/home/hankle/Testing/source/gpac/cmakebuild
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_FREETYPE GPAC_HAS_JPEG GPAC_HAS_PNG  GPAC_DISABLE_3D 
```

command:

```shell
/home/hankle/Testing/source/gpac/bin/gcc/MP4Box -bt poc
```

POC
[poc.zip](https://github.com/gpac/gpac/files/7792709/poc.zip)

Result:

```
segmentation fault
```

bt

```shell
Program received signal SIGSEGV, Segmentation fault.
0x000000000047a687 in gf_node_get_graph (node=0x10fa810) at scenegraph/base_scenegraph.c:1184
1184            return (node ? node->sgprivate->scenegraph : NULL);
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
──────────────────────────────────────────────────────────────────────────────────────────────────[ REGISTERS ]──────────────────────────────────────────────────────────────────────────────────────────────────
 RAX  0x0
 RBX  0x10ebcc0 ◂— 0x0
 RCX  0x10de218 ◂— 0x100030003
 RDX  0x0
 RDI  0x10fa810 ◂— 0x0
 RSI  0x0
 R8   0x10fa010 —▸ 0x10f97f0 —▸ 0x10f8a60 —▸ 0x10f8ab0 ◂— 0x8000000100010075 /* 'u' */
 R9   0x0
 R10  0x10cbfa0 (main_arena+96) —▸ 0x10fab50 ◂— 0x0
 R11  0x10cbfa0 (main_arena+96) —▸ 0x10fab50 ◂— 0x0
 R12  0xd0a0b0 (__libc_csu_fini) ◂— endbr64 
 R13  0x0
 R14  0x10a6018 (_GLOBAL_OFFSET_TABLE_+24) —▸ 0xd80bb0 (__memmove_avx_unaligned_erms) ◂— endbr64 
 R15  0x0
 RBP  0x7fffffff7c20 —▸ 0x7fffffff7c80 —▸ 0x7fffffff8140 —▸ 0x7fffffff8600 —▸ 0x7fffffff8650 ◂— ...
 RSP  0x7fffffff7c20 —▸ 0x7fffffff7c80 —▸ 0x7fffffff8140 —▸ 0x7fffffff8600 —▸ 0x7fffffff8650 ◂— ...
 RIP  0x47a687 (gf_node_get_graph+26) ◂— mov    rax, qword ptr [rax + 8]
───────────────────────────────────────────────────────────────────────────────────────────────────[ DISASM ]────────────────────────────────────────────────────────────────────────────────────────────────────
 ► 0x47a687 <gf_node_get_graph+26>    mov    rax, qword ptr [rax + 8]
   0x47a68b <gf_node_get_graph+30>    jmp    gf_node_get_graph+37                      <gf_node_get_graph+37>
    ↓
   0x47a692 <gf_node_get_graph+37>    pop    rbp
   0x47a693 <gf_node_get_graph+38>    ret    
 
   0x47a694 <gf_sg_find_node>         endbr64 
   0x47a698 <gf_sg_find_node+4>       push   rbp
   0x47a699 <gf_sg_find_node+5>       mov    rbp, rsp
   0x47a69c <gf_sg_find_node+8>       mov    qword ptr [rbp - 0x18], rdi
   0x47a6a0 <gf_sg_find_node+12>      mov    dword ptr [rbp - 0x1c], esi
   0x47a6a3 <gf_sg_find_node+15>      mov    rax, qword ptr [rbp - 0x18]
   0x47a6a7 <gf_sg_find_node+19>      mov    rax, qword ptr [rax + 8]
────────────────────────────────────────────────────────────────────────────────────────────────[ SOURCE (CODE) ]────────────────────────────────────────────────────────────────────────────────────────────────
In file: /home/zxq/CVE_testing/source/gpac/src/scenegraph/base_scenegraph.c
   1179 
   1180 
   1181 GF_EXPORT
   1182 GF_SceneGraph *gf_node_get_graph(GF_Node *node)
   1183 {
 ► 1184         return (node ? node->sgprivate->scenegraph : NULL);
   1185 }
   1186 
   1187 GF_EXPORT
   1188 GF_Node *gf_sg_find_node(GF_SceneGraph *sg, u32 nodeID)
   1189 {
────────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]────────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rbp rsp 0x7fffffff7c20 —▸ 0x7fffffff7c80 —▸ 0x7fffffff8140 —▸ 0x7fffffff8600 —▸ 0x7fffffff8650 ◂— ...
01:0008│         0x7fffffff7c28 —▸ 0x56cb85 (gf_bifs_flush_command_list+115) ◂— mov    rdx, qword ptr [rbp - 0x48]
02:0010│         0x7fffffff7c30 —▸ 0x10f8110 ◂— 0x999
03:0018│         0x7fffffff7c38 —▸ 0x10f56a0 ◂— 0xfffffffa
04:0020│         0x7fffffff7c40 ◂— 0xfffffffaffff7c80
05:0028│         0x7fffffff7c48 ◂— 0x1
06:0030│         0x7fffffff7c50 —▸ 0x10f99c0 —▸ 0x10fa010 —▸ 0x10f97f0 —▸ 0x10f8a60 ◂— ...
07:0038│         0x7fffffff7c58 —▸ 0x10fa8c0 —▸ 0x10fa810 ◂— 0x0
──────────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]──────────────────────────────────────────────────────────────────────────────────────────────────
 ► f 0         0x47a687 gf_node_get_graph+26
   f 1         0x56cb85 gf_bifs_flush_command_list+115
   f 2         0x55c9bc gf_bifs_dec_proto_list+1697
   f 3         0x55c8fb gf_bifs_dec_proto_list+1504
   f 4         0x55d2ca BD_DecSceneReplace+111
   f 5         0x56c81d BM_SceneReplace+153
   f 6         0x56ca9e BM_ParseCommand+216
   f 7         0x56cf48 gf_bifs_decode_command_list+307
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> bt
#0  0x000000000047a687 in gf_node_get_graph (node=0x10fa810) at scenegraph/base_scenegraph.c:1184
#1  0x000000000056cb85 in gf_bifs_flush_command_list (codec=0x10f56a0) at bifs/memory_decoder.c:939
#2  0x000000000055c9bc in gf_bifs_dec_proto_list (codec=0x10f56a0, bs=0x10e9fe0, proto_list=0x0) at bifs/com_dec.c:1145
#3  0x000000000055c8fb in gf_bifs_dec_proto_list (codec=0x10f56a0, bs=0x10e9fe0, proto_list=0x10f7c30) at bifs/com_dec.c:1124
#4  0x000000000055d2ca in BD_DecSceneReplace (codec=0x10f56a0, bs=0x10e9fe0, proto_list=0x10f7c30) at bifs/com_dec.c:1322
#5  0x000000000056c81d in BM_SceneReplace (codec=0x10f56a0, bs=0x10e9fe0, com_list=0x10f5a60) at bifs/memory_decoder.c:860
#6  0x000000000056ca9e in BM_ParseCommand (codec=0x10f56a0, bs=0x10e9fe0, com_list=0x10f5a60) at bifs/memory_decoder.c:908
#7  0x000000000056cf48 in gf_bifs_decode_command_list (codec=0x10f56a0, ESID=8, data=0x10f5ae0 '\314' <repeats 199 times>, <incomplete sequence \314>..., data_length=8208, com_list=0x10f5a60) at bifs/memory_decoder.c:1009
#8  0x00000000006be0e9 in gf_sm_load_run_isom (load=0x7fffffff88b0) at scene_manager/loader_isom.c:303
#9  0x00000000006a2059 in gf_sm_load_run (load=0x7fffffff88b0) at scene_manager/scene_manager.c:719
#10 0x000000000041786e in dump_isom_scene (file=0x7fffffffe618 "gf_node_get_graph-gf_bifs_flush_command_list/id:000458,sig:11,src:014159,op:havoc,rep:32", inName=0x10da460 <outfile> "gf_node_get_graph-gf_bifs_flush_command_list/id:000458,sig:11,src:014159,op:havoc,rep:32", is_final_name=GF_FALSE, dump_mode=GF_SM_DUMP_BT, do_log=GF_FALSE, no_odf_conv=GF_FALSE) at filedump.c:199
#11 0x000000000041521f in mp4boxMain (argc=3, argv=0x7fffffffe338) at main.c:6044
#12 0x000000000041719b in main (argc=3, argv=0x7fffffffe338) at main.c:6496
#13 0x0000000000d09840 in __libc_start_main ()
#14 0x000000000040211e in _start ()
pwndbg> 
```
Untrusted pointer dereference in gf_node_get_graph()
This is a GitHub Issue
repo:gpac
owner:gpac
Title : Untrusted pointer dereference in gf_node_get_graph()
Issue date:

--- start body ---
Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [x] I looked for a similar issue and couldn't find any.
- [x] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [x] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/

Version:

```shell
/home/hankle/Testing/source/gpac/bin/gcc/MP4Box -version                                                                                                        
MP4Box - GPAC version 1.1.0-DEV-rev1574-g8b22f0912-master
(c) 2000-2021 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io
        MINI build (encoders, decoders, audio and video output disabled)

Please cite our work in your research:
        GPAC Filters: https://doi.org/10.1145/3339825.3394929
        GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --static-mp4box --enable-debug --prefix=/home/hankle/Testing/source/gpac/cmakebuild
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_FREETYPE GPAC_HAS_JPEG GPAC_HAS_PNG  GPAC_DISABLE_3D 
```

command:

```shell
/home/hankle/Testing/source/gpac/bin/gcc/MP4Box -bt poc
```

POC
[poc.zip](https://github.com/gpac/gpac/files/7792709/poc.zip)

Result:

```
segmentation fault
```

bt

```shell
Program received signal SIGSEGV, Segmentation fault.
0x000000000047a687 in gf_node_get_graph (node=0x10fa810) at scenegraph/base_scenegraph.c:1184
1184            return (node ? node->sgprivate->scenegraph : NULL);
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
──────────────────────────────────────────────────────────────────────────────────────────────────[ REGISTERS ]──────────────────────────────────────────────────────────────────────────────────────────────────
 RAX  0x0
 RBX  0x10ebcc0 ◂— 0x0
 RCX  0x10de218 ◂— 0x100030003
 RDX  0x0
 RDI  0x10fa810 ◂— 0x0
 RSI  0x0
 R8   0x10fa010 —▸ 0x10f97f0 —▸ 0x10f8a60 —▸ 0x10f8ab0 ◂— 0x8000000100010075 /* 'u' */
 R9   0x0
 R10  0x10cbfa0 (main_arena+96) —▸ 0x10fab50 ◂— 0x0
 R11  0x10cbfa0 (main_arena+96) —▸ 0x10fab50 ◂— 0x0
 R12  0xd0a0b0 (__libc_csu_fini) ◂— endbr64 
 R13  0x0
 R14  0x10a6018 (_GLOBAL_OFFSET_TABLE_+24) —▸ 0xd80bb0 (__memmove_avx_unaligned_erms) ◂— endbr64 
 R15  0x0
 RBP  0x7fffffff7c20 —▸ 0x7fffffff7c80 —▸ 0x7fffffff8140 —▸ 0x7fffffff8600 —▸ 0x7fffffff8650 ◂— ...
 RSP  0x7fffffff7c20 —▸ 0x7fffffff7c80 —▸ 0x7fffffff8140 —▸ 0x7fffffff8600 —▸ 0x7fffffff8650 ◂— ...
 RIP  0x47a687 (gf_node_get_graph+26) ◂— mov    rax, qword ptr [rax + 8]
───────────────────────────────────────────────────────────────────────────────────────────────────[ DISASM ]────────────────────────────────────────────────────────────────────────────────────────────────────
 ► 0x47a687 <gf_node_get_graph+26>    mov    rax, qword ptr [rax + 8]
   0x47a68b <gf_node_get_graph+30>    jmp    gf_node_get_graph+37                      <gf_node_get_graph+37>
    ↓
   0x47a692 <gf_node_get_graph+37>    pop    rbp
   0x47a693 <gf_node_get_graph+38>    ret    
 
   0x47a694 <gf_sg_find_node>         endbr64 
   0x47a698 <gf_sg_find_node+4>       push   rbp
   0x47a699 <gf_sg_find_node+5>       mov    rbp, rsp
   0x47a69c <gf_sg_find_node+8>       mov    qword ptr [rbp - 0x18], rdi
   0x47a6a0 <gf_sg_find_node+12>      mov    dword ptr [rbp - 0x1c], esi
   0x47a6a3 <gf_sg_find_node+15>      mov    rax, qword ptr [rbp - 0x18]
   0x47a6a7 <gf_sg_find_node+19>      mov    rax, qword ptr [rax + 8]
────────────────────────────────────────────────────────────────────────────────────────────────[ SOURCE (CODE) ]────────────────────────────────────────────────────────────────────────────────────────────────
In file: /home/zxq/CVE_testing/source/gpac/src/scenegraph/base_scenegraph.c
   1179 
   1180 
   1181 GF_EXPORT
   1182 GF_SceneGraph *gf_node_get_graph(GF_Node *node)
   1183 {
 ► 1184         return (node ? node->sgprivate->scenegraph : NULL);
   1185 }
   1186 
   1187 GF_EXPORT
   1188 GF_Node *gf_sg_find_node(GF_SceneGraph *sg, u32 nodeID)
   1189 {
────────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]────────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rbp rsp 0x7fffffff7c20 —▸ 0x7fffffff7c80 —▸ 0x7fffffff8140 —▸ 0x7fffffff8600 —▸ 0x7fffffff8650 ◂— ...
01:0008│         0x7fffffff7c28 —▸ 0x56cb85 (gf_bifs_flush_command_list+115) ◂— mov    rdx, qword ptr [rbp - 0x48]
02:0010│         0x7fffffff7c30 —▸ 0x10f8110 ◂— 0x999
03:0018│         0x7fffffff7c38 —▸ 0x10f56a0 ◂— 0xfffffffa
04:0020│         0x7fffffff7c40 ◂— 0xfffffffaffff7c80
05:0028│         0x7fffffff7c48 ◂— 0x1
06:0030│         0x7fffffff7c50 —▸ 0x10f99c0 —▸ 0x10fa010 —▸ 0x10f97f0 —▸ 0x10f8a60 ◂— ...
07:0038│         0x7fffffff7c58 —▸ 0x10fa8c0 —▸ 0x10fa810 ◂— 0x0
──────────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]──────────────────────────────────────────────────────────────────────────────────────────────────
 ► f 0         0x47a687 gf_node_get_graph+26
   f 1         0x56cb85 gf_bifs_flush_command_list+115
   f 2         0x55c9bc gf_bifs_dec_proto_list+1697
   f 3         0x55c8fb gf_bifs_dec_proto_list+1504
   f 4         0x55d2ca BD_DecSceneReplace+111
   f 5         0x56c81d BM_SceneReplace+153
   f 6         0x56ca9e BM_ParseCommand+216
   f 7         0x56cf48 gf_bifs_decode_command_list+307
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> bt
#0  0x000000000047a687 in gf_node_get_graph (node=0x10fa810) at scenegraph/base_scenegraph.c:1184
#1  0x000000000056cb85 in gf_bifs_flush_command_list (codec=0x10f56a0) at bifs/memory_decoder.c:939
#2  0x000000000055c9bc in gf_bifs_dec_proto_list (codec=0x10f56a0, bs=0x10e9fe0, proto_list=0x0) at bifs/com_dec.c:1145
#3  0x000000000055c8fb in gf_bifs_dec_proto_list (codec=0x10f56a0, bs=0x10e9fe0, proto_list=0x10f7c30) at bifs/com_dec.c:1124
#4  0x000000000055d2ca in BD_DecSceneReplace (codec=0x10f56a0, bs=0x10e9fe0, proto_list=0x10f7c30) at bifs/com_dec.c:1322
#5  0x000000000056c81d in BM_SceneReplace (codec=0x10f56a0, bs=0x10e9fe0, com_list=0x10f5a60) at bifs/memory_decoder.c:860
#6  0x000000000056ca9e in BM_ParseCommand (codec=0x10f56a0, bs=0x10e9fe0, com_list=0x10f5a60) at bifs/memory_decoder.c:908
#7  0x000000000056cf48 in gf_bifs_decode_command_list (codec=0x10f56a0, ESID=8, data=0x10f5ae0 '\314' <repeats 199 times>, <incomplete sequence \314>..., data_length=8208, com_list=0x10f5a60) at bifs/memory_decoder.c:1009
#8  0x00000000006be0e9 in gf_sm_load_run_isom (load=0x7fffffff88b0) at scene_manager/loader_isom.c:303
#9  0x00000000006a2059 in gf_sm_load_run (load=0x7fffffff88b0) at scene_manager/scene_manager.c:719
#10 0x000000000041786e in dump_isom_scene (file=0x7fffffffe618 "gf_node_get_graph-gf_bifs_flush_command_list/id:000458,sig:11,src:014159,op:havoc,rep:32", inName=0x10da460 <outfile> "gf_node_get_graph-gf_bifs_flush_command_list/id:000458,sig:11,src:014159,op:havoc,rep:32", is_final_name=GF_FALSE, dump_mode=GF_SM_DUMP_BT, do_log=GF_FALSE, no_odf_conv=GF_FALSE) at filedump.c:199
#11 0x000000000041521f in mp4boxMain (argc=3, argv=0x7fffffffe338) at main.c:6044
#12 0x000000000041719b in main (argc=3, argv=0x7fffffffe338) at main.c:6496
#13 0x0000000000d09840 in __libc_start_main ()
#14 0x000000000040211e in _start ()
pwndbg> 
```
--- end body ---
