POC:  ./MP4Box -dash 1000 POC8
LINK: https://drive.google.com/file/d/1hEKZtbUJi2V4euDl3oWbIAX-amnG29H9/view?usp=share_link

```
The vulnerability seems to be located in the gf_swf_read_header function, as indicated by the AddressSanitizer report showing a heap-buffer-overflow error.

Here are the details:

==2451549==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000004e51 at pc 0x7f7dd3979c23 bp 0x7ffe4fe10840 sp 0x7ffe4fe0ffe8
WRITE of size 8 at 0x602000004e51 thread T0
#0 0x7f7dd3979c22 in __interceptor_memset ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:799
#1 0x7f7dd07731d2 in gf_swf_read_header (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x26111d2)
#2 0x7f7dd0f72a10 in gf_text_process_swf (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2e10a10)
#3 0x7f7dd0f637ef in txtin_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2e017ef)
#4 0x7f7dd0ca097c in gf_filter_process_task (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b3e97c)
#5 0x7f7dd0c5c00a in gf_fs_thread_proc (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2afa00a)
#6 0x7f7dd0c6992e in gf_fs_run (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b0792e)
#7 0x7f7dd04da0ce in gf_dasher_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x23780ce)
#8 0x5572a9ad2338 in do_dash /root/gpac2/gpac/applications/mp4box/mp4box.c:4807
#9 0x5572a9ad2338 in mp4box_main /root/gpac2/gpac/applications/mp4box/mp4box.c:6184
#10 0x7f7dcd92ed8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#11 0x7f7dcd92ee3f in __libc_start_main_impl ../csu/libc-start.c:392
#12 0x5572a9aa8cb4 in _start (/root/gpac2/gpac/bin/gcc/MP4Box+0xabcb4)

0x602000004e51 is located 0 bytes to the right of 1-byte region [0x602000004e50,0x602000004e51)
allocated by thread T0 here:
#0 0x7f7dd39f4867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x7f7dd07731ba in gf_swf_read_header (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x26111ba)
#2 0x7f7dd0f72a10 in gf_text_process_swf (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2e10a10)
#3 0x7f7dd0f637ef in txtin_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2e017ef)
#4 0x7f7dd0ca097c in gf_filter_process_task (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b3e97c)
#5 0x7f7dd0c5c00a in gf_fs_thread_proc (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2afa00a)
#6 0x7f7dd0c6992e in gf_fs_run (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b0792e)
#7 0x7f7dd04da0ce in gf_dasher_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x23780ce)
#8 0x5572a9ad2338 in do_dash /root/gpac2/gpac/applications/mp4box/mp4box.c:4807
#9 0x5572a9ad2338 in mp4box_main /root/gpac2/gpac/applications/mp4box/mp4box.c:6184
#10 0x7f7dcd92ed8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:799 in __interceptor_memset
Shadow bytes around the buggy address:
0x0c047fff8970: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
0x0c047fff8980: fa fa 00 00 fa fa fd fd fa fa fd fd fa fa 06 fa
0x0c047fff8990: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
0x0c047fff89a0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
0x0c047fff89b0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
=>0x0c047fff89c0: fa fa 00 00 fa fa 00 00 fa fa[01]fa fa fa fa fa
0x0c047fff89d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff89e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff89f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8a10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable:           00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone:       fa
Freed heap region:       fd
Stack left redzone:      f1
Stack mid redzone:       f2
Stack right redzone:     f3
Stack after return:      f5
Stack use after scope:   f8
Global redzone:          f9
Global init order:       f6
Poisoned by user:        f7
Container overflow:      fc
Array cookie:            ac
Intra object redzone:    bb
ASan internal:           fe
Left alloca redzone:     ca
Right alloca redzone:    cb
Shadow gap:              cc
==2451549==ABORTING
```
heap-buffer-overflow error in gf_swf_read_header()
This is a GitHub Issue
repo:gpac
owner:gpac
Title : heap-buffer-overflow error in gf_swf_read_header()
Issue date:

--- start body ---
POC:  ./MP4Box -dash 1000 POC8
LINK: https://drive.google.com/file/d/1hEKZtbUJi2V4euDl3oWbIAX-amnG29H9/view?usp=share_link

```
The vulnerability seems to be located in the gf_swf_read_header function, as indicated by the AddressSanitizer report showing a heap-buffer-overflow error.

Here are the details:

==2451549==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000004e51 at pc 0x7f7dd3979c23 bp 0x7ffe4fe10840 sp 0x7ffe4fe0ffe8
WRITE of size 8 at 0x602000004e51 thread T0
#0 0x7f7dd3979c22 in __interceptor_memset ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:799
#1 0x7f7dd07731d2 in gf_swf_read_header (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x26111d2)
#2 0x7f7dd0f72a10 in gf_text_process_swf (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2e10a10)
#3 0x7f7dd0f637ef in txtin_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2e017ef)
#4 0x7f7dd0ca097c in gf_filter_process_task (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b3e97c)
#5 0x7f7dd0c5c00a in gf_fs_thread_proc (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2afa00a)
#6 0x7f7dd0c6992e in gf_fs_run (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b0792e)
#7 0x7f7dd04da0ce in gf_dasher_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x23780ce)
#8 0x5572a9ad2338 in do_dash /root/gpac2/gpac/applications/mp4box/mp4box.c:4807
#9 0x5572a9ad2338 in mp4box_main /root/gpac2/gpac/applications/mp4box/mp4box.c:6184
#10 0x7f7dcd92ed8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#11 0x7f7dcd92ee3f in __libc_start_main_impl ../csu/libc-start.c:392
#12 0x5572a9aa8cb4 in _start (/root/gpac2/gpac/bin/gcc/MP4Box+0xabcb4)

0x602000004e51 is located 0 bytes to the right of 1-byte region [0x602000004e50,0x602000004e51)
allocated by thread T0 here:
#0 0x7f7dd39f4867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x7f7dd07731ba in gf_swf_read_header (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x26111ba)
#2 0x7f7dd0f72a10 in gf_text_process_swf (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2e10a10)
#3 0x7f7dd0f637ef in txtin_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2e017ef)
#4 0x7f7dd0ca097c in gf_filter_process_task (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b3e97c)
#5 0x7f7dd0c5c00a in gf_fs_thread_proc (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2afa00a)
#6 0x7f7dd0c6992e in gf_fs_run (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b0792e)
#7 0x7f7dd04da0ce in gf_dasher_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x23780ce)
#8 0x5572a9ad2338 in do_dash /root/gpac2/gpac/applications/mp4box/mp4box.c:4807
#9 0x5572a9ad2338 in mp4box_main /root/gpac2/gpac/applications/mp4box/mp4box.c:6184
#10 0x7f7dcd92ed8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:799 in __interceptor_memset
Shadow bytes around the buggy address:
0x0c047fff8970: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
0x0c047fff8980: fa fa 00 00 fa fa fd fd fa fa fd fd fa fa 06 fa
0x0c047fff8990: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
0x0c047fff89a0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
0x0c047fff89b0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
=>0x0c047fff89c0: fa fa 00 00 fa fa 00 00 fa fa[01]fa fa fa fa fa
0x0c047fff89d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff89e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff89f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8a10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable:           00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone:       fa
Freed heap region:       fd
Stack left redzone:      f1
Stack mid redzone:       f2
Stack right redzone:     f3
Stack after return:      f5
Stack use after scope:   f8
Global redzone:          f9
Global init order:       f6
Poisoned by user:        f7
Container overflow:      fc
Array cookie:            ac
Intra object redzone:    bb
ASan internal:           fe
Left alloca redzone:     ca
Right alloca redzone:    cb
Shadow gap:              cc
==2451549==ABORTING
```
--- end body ---
