Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [X] I looked for a similar issue and couldn't find any.
- [X] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [X] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/

# Description

Heap use after free in gf_node_get_tag scenegraph/base_scenegraph.c:1265

# System info

Ubuntu 22.04 lts

# Version info

```
MP4Box - GPAC version 2.0-revUNKNOWN_REV
(c) 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
	GPAC Filters: https://doi.org/10.1145/3339825.3394929
	GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --enable-sanitizer
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SSL GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D
```

# compile 

```
./configure --enable-sanitizer --static-bin
make
```

# crash command

```
MP4Box -mp4 -carousel 0x1000 POC.svg
```

# POC

[POC-uaf.zip](https://github.com/gpac/gpac/files/9931710/POC-uaf.zip)

# Crash output

```
[Parser] SVG Scene Parsing: /home/x1do0/Desktop/share/gpac-2.0.0/crash_bugs/126.svg
[SVG Parsing] Error in parsing number (expecting digits):�<| (00/100)
[SVG Parsing] Error in parsing: �<%[��<
[SVG Parsing] line 1 - Missing attributeName attribute on (null)
[Parser] Scene parsed and Scene Graph built in 21 ms                        
=================================================================
==1769514==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000000310 at pc 0x7f811180f217 bp 0x7ffd2e0ec430 sp 0x7ffd2e0ec420
READ of size 8 at 0x604000000310 thread T0
    #0 0x7f811180f216 in gf_node_get_tag scenegraph/base_scenegraph.c:1265
    #1 0x7f8112127772 in svg_parse_animation scene_manager/loader_svg.c:372
    #2 0x7f8112128f0f in svg_flush_animations scene_manager/loader_svg.c:2015
    #3 0x7f8112128f0f in svg_flush_animations scene_manager/loader_svg.c:2010
    #4 0x7f8112128f0f in load_svg_run scene_manager/loader_svg.c:2118
    #5 0x5645ad5eda3f in EncodeFile /home/x1do0/Desktop/app_fuzzing/asan-gpac-2.0.0/applications/mp4box/fileimport.c:3114
    #6 0x5645ad5b5eb0 in do_scene_encode /home/x1do0/Desktop/app_fuzzing/asan-gpac-2.0.0/applications/mp4box/main.c:4463
    #7 0x5645ad5b5eb0 in mp4boxMain /home/x1do0/Desktop/app_fuzzing/asan-gpac-2.0.0/applications/mp4box/main.c:5893
    #8 0x7f810f58fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #9 0x7f810f58fe3f in __libc_start_main_impl ../csu/libc-start.c:392
    #10 0x5645ad58eb64 in _start (/home/x1do0/Desktop/app_fuzzing/asan-gpac-2.0.0/bin/gcc/MP4Box+0xa7b64)

0x604000000310 is located 0 bytes inside of 48-byte region [0x604000000310,0x604000000340)
freed by thread T0 here:
    #0 0x7f8114f2a517 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127
    #1 0x7f8111a6ceeb in gf_svg_node_del scenegraph/svg_types.c:126
    #2 0x7f81118138ed in gf_node_unregister scenegraph/base_scenegraph.c:761
    #3 0x7f81121316b9 in svg_node_start scene_manager/loader_svg.c:1756
    #4 0x7f81117a5295 in xml_sax_node_start utils/xml_parser.c:306
    #5 0x7f81117a8721 in xml_sax_parse_attribute utils/xml_parser.c:395
    #6 0x7f81117a8721 in xml_sax_parse utils/xml_parser.c:904
    #7 0x7f81117aac20 in gf_xml_sax_parse_intern utils/xml_parser.c:1065
    #8 0x7f81117ab007 in gf_xml_sax_parse utils/xml_parser.c:1093
    #9 0x7f81117ab2d8 in xml_sax_read_file utils/xml_parser.c:1180
    #10 0x7f81117ac60f in gf_xml_sax_parse_file utils/xml_parser.c:1292
    #11 0x7f8112128e26 in load_svg_run scene_manager/loader_svg.c:2112
    #12 0x5645ad5eda3f in EncodeFile /home/x1do0/Desktop/app_fuzzing/asan-gpac-2.0.0/applications/mp4box/fileimport.c:3114
    #13 0x5645ad5b5eb0 in do_scene_encode /home/x1do0/Desktop/app_fuzzing/asan-gpac-2.0.0/applications/mp4box/main.c:4463
    #14 0x5645ad5b5eb0 in mp4boxMain /home/x1do0/Desktop/app_fuzzing/asan-gpac-2.0.0/applications/mp4box/main.c:5893
    #15 0x7f810f58fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

previously allocated by thread T0 here:
    #0 0x7f8114f2a867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x7f8111a6c9d1 in gf_svg_create_node scenegraph/svg_types.c:58
    #2 0x7f81118156f9 in gf_node_new scenegraph/base_scenegraph.c:2014
    #3 0x7f811212d13a in svg_parse_element scene_manager/loader_svg.c:712
    #4 0x7f811212d13a in svg_node_start scene_manager/loader_svg.c:1706
    #5 0x7f81117a5295 in xml_sax_node_start utils/xml_parser.c:306
    #6 0x7f81117a8721 in xml_sax_parse_attribute utils/xml_parser.c:395
    #7 0x7f81117a8721 in xml_sax_parse utils/xml_parser.c:904
    #8 0x7f81117aac20 in gf_xml_sax_parse_intern utils/xml_parser.c:1065
    #9 0x7f81117ab007 in gf_xml_sax_parse utils/xml_parser.c:1093
    #10 0x7f81117ab2d8 in xml_sax_read_file utils/xml_parser.c:1180
    #11 0x7f81117ac60f in gf_xml_sax_parse_file utils/xml_parser.c:1292
    #12 0x7f8112128e26 in load_svg_run scene_manager/loader_svg.c:2112
    #13 0x5645ad5eda3f in EncodeFile /home/x1do0/Desktop/app_fuzzing/asan-gpac-2.0.0/applications/mp4box/fileimport.c:3114
    #14 0x5645ad5b5eb0 in do_scene_encode /home/x1do0/Desktop/app_fuzzing/asan-gpac-2.0.0/applications/mp4box/main.c:4463
    #15 0x5645ad5b5eb0 in mp4boxMain /home/x1do0/Desktop/app_fuzzing/asan-gpac-2.0.0/applications/mp4box/main.c:5893
    #16 0x7f810f58fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-use-after-free scenegraph/base_scenegraph.c:1265 in gf_node_get_tag
Shadow bytes around the buggy address:
  0x0c087fff8010: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c087fff8020: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 01
  0x0c087fff8030: fa fa 00 00 00 00 04 fa fa fa 00 00 00 00 05 fa
  0x0c087fff8040: fa fa 00 00 00 00 00 06 fa fa 00 00 00 00 00 00
  0x0c087fff8050: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 00 00
=>0x0c087fff8060: fa fa[fd]fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x0c087fff8070: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c087fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==1769514==ABORTING
```

# Impact 

can cause a program to crash, use unexpected values, or execute code.
ps: this crash still happens on the newest mp4box+asan.







GPAC-2.0.0 MP4Box: heap-use-after-free in gf_node_get_tag
This is a GitHub Issue
repo:gpac
owner:gpac
Title : GPAC-2.0.0 MP4Box: heap-use-after-free in gf_node_get_tag
Issue date:

--- start body ---
Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [X] I looked for a similar issue and couldn't find any.
- [X] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [X] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/

# Description

Heap use after free in gf_node_get_tag scenegraph/base_scenegraph.c:1265

# System info

Ubuntu 22.04 lts

# Version info

```
MP4Box - GPAC version 2.0-revUNKNOWN_REV
(c) 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
	GPAC Filters: https://doi.org/10.1145/3339825.3394929
	GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --enable-sanitizer
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SSL GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D
```

# compile 

```
./configure --enable-sanitizer --static-bin
make
```

# crash command

```
MP4Box -mp4 -carousel 0x1000 POC.svg
```

# POC

[POC-uaf.zip](https://github.com/gpac/gpac/files/9931710/POC-uaf.zip)

# Crash output

```
[Parser] SVG Scene Parsing: /home/x1do0/Desktop/share/gpac-2.0.0/crash_bugs/126.svg
[SVG Parsing] Error in parsing number (expecting digits):�<| (00/100)
[SVG Parsing] Error in parsing: �<%[��<
[SVG Parsing] line 1 - Missing attributeName attribute on (null)
[Parser] Scene parsed and Scene Graph built in 21 ms                        
=================================================================
==1769514==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000000310 at pc 0x7f811180f217 bp 0x7ffd2e0ec430 sp 0x7ffd2e0ec420
READ of size 8 at 0x604000000310 thread T0
    #0 0x7f811180f216 in gf_node_get_tag scenegraph/base_scenegraph.c:1265
    #1 0x7f8112127772 in svg_parse_animation scene_manager/loader_svg.c:372
    #2 0x7f8112128f0f in svg_flush_animations scene_manager/loader_svg.c:2015
    #3 0x7f8112128f0f in svg_flush_animations scene_manager/loader_svg.c:2010
    #4 0x7f8112128f0f in load_svg_run scene_manager/loader_svg.c:2118
    #5 0x5645ad5eda3f in EncodeFile /home/x1do0/Desktop/app_fuzzing/asan-gpac-2.0.0/applications/mp4box/fileimport.c:3114
    #6 0x5645ad5b5eb0 in do_scene_encode /home/x1do0/Desktop/app_fuzzing/asan-gpac-2.0.0/applications/mp4box/main.c:4463
    #7 0x5645ad5b5eb0 in mp4boxMain /home/x1do0/Desktop/app_fuzzing/asan-gpac-2.0.0/applications/mp4box/main.c:5893
    #8 0x7f810f58fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #9 0x7f810f58fe3f in __libc_start_main_impl ../csu/libc-start.c:392
    #10 0x5645ad58eb64 in _start (/home/x1do0/Desktop/app_fuzzing/asan-gpac-2.0.0/bin/gcc/MP4Box+0xa7b64)

0x604000000310 is located 0 bytes inside of 48-byte region [0x604000000310,0x604000000340)
freed by thread T0 here:
    #0 0x7f8114f2a517 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127
    #1 0x7f8111a6ceeb in gf_svg_node_del scenegraph/svg_types.c:126
    #2 0x7f81118138ed in gf_node_unregister scenegraph/base_scenegraph.c:761
    #3 0x7f81121316b9 in svg_node_start scene_manager/loader_svg.c:1756
    #4 0x7f81117a5295 in xml_sax_node_start utils/xml_parser.c:306
    #5 0x7f81117a8721 in xml_sax_parse_attribute utils/xml_parser.c:395
    #6 0x7f81117a8721 in xml_sax_parse utils/xml_parser.c:904
    #7 0x7f81117aac20 in gf_xml_sax_parse_intern utils/xml_parser.c:1065
    #8 0x7f81117ab007 in gf_xml_sax_parse utils/xml_parser.c:1093
    #9 0x7f81117ab2d8 in xml_sax_read_file utils/xml_parser.c:1180
    #10 0x7f81117ac60f in gf_xml_sax_parse_file utils/xml_parser.c:1292
    #11 0x7f8112128e26 in load_svg_run scene_manager/loader_svg.c:2112
    #12 0x5645ad5eda3f in EncodeFile /home/x1do0/Desktop/app_fuzzing/asan-gpac-2.0.0/applications/mp4box/fileimport.c:3114
    #13 0x5645ad5b5eb0 in do_scene_encode /home/x1do0/Desktop/app_fuzzing/asan-gpac-2.0.0/applications/mp4box/main.c:4463
    #14 0x5645ad5b5eb0 in mp4boxMain /home/x1do0/Desktop/app_fuzzing/asan-gpac-2.0.0/applications/mp4box/main.c:5893
    #15 0x7f810f58fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

previously allocated by thread T0 here:
    #0 0x7f8114f2a867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x7f8111a6c9d1 in gf_svg_create_node scenegraph/svg_types.c:58
    #2 0x7f81118156f9 in gf_node_new scenegraph/base_scenegraph.c:2014
    #3 0x7f811212d13a in svg_parse_element scene_manager/loader_svg.c:712
    #4 0x7f811212d13a in svg_node_start scene_manager/loader_svg.c:1706
    #5 0x7f81117a5295 in xml_sax_node_start utils/xml_parser.c:306
    #6 0x7f81117a8721 in xml_sax_parse_attribute utils/xml_parser.c:395
    #7 0x7f81117a8721 in xml_sax_parse utils/xml_parser.c:904
    #8 0x7f81117aac20 in gf_xml_sax_parse_intern utils/xml_parser.c:1065
    #9 0x7f81117ab007 in gf_xml_sax_parse utils/xml_parser.c:1093
    #10 0x7f81117ab2d8 in xml_sax_read_file utils/xml_parser.c:1180
    #11 0x7f81117ac60f in gf_xml_sax_parse_file utils/xml_parser.c:1292
    #12 0x7f8112128e26 in load_svg_run scene_manager/loader_svg.c:2112
    #13 0x5645ad5eda3f in EncodeFile /home/x1do0/Desktop/app_fuzzing/asan-gpac-2.0.0/applications/mp4box/fileimport.c:3114
    #14 0x5645ad5b5eb0 in do_scene_encode /home/x1do0/Desktop/app_fuzzing/asan-gpac-2.0.0/applications/mp4box/main.c:4463
    #15 0x5645ad5b5eb0 in mp4boxMain /home/x1do0/Desktop/app_fuzzing/asan-gpac-2.0.0/applications/mp4box/main.c:5893
    #16 0x7f810f58fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-use-after-free scenegraph/base_scenegraph.c:1265 in gf_node_get_tag
Shadow bytes around the buggy address:
  0x0c087fff8010: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c087fff8020: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 01
  0x0c087fff8030: fa fa 00 00 00 00 04 fa fa fa 00 00 00 00 05 fa
  0x0c087fff8040: fa fa 00 00 00 00 00 06 fa fa 00 00 00 00 00 00
  0x0c087fff8050: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 00 00
=>0x0c087fff8060: fa fa[fd]fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x0c087fff8070: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c087fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==1769514==ABORTING
```

# Impact 

can cause a program to crash, use unexpected values, or execute code.
ps: this crash still happens on the newest mp4box+asan.







--- end body ---
