Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [x] I looked for a similar issue and couldn't find any.
- [x] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [x] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/bug-reporting/

Step to reproduce:

1.get latest commit code (gpac - GPAC command line filter engine - version 2.3-DEV-rev621-g3edb48d2b-master)
2.compile with --enable-sanitizer
3.run MP4Box -bt poc.swf
Env:
Ubunut 20.04 , clang 16.0.1

ASAN report


==86785==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f72652deea0 at pc 0x7f7269cf869a bp 0x7ffc978dbe90 sp 0x7ffc978db638
READ of size 1400 at 0x7f72652deea0 thread T0
    #0 0x7f7269cf8699 in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823
    #1 0x7f72682bd2da in png_write_row (/lib/x86_64-linux-gnu/libpng16.so.16+0x232da)
    #2 0x7f72682bd6af in png_write_image (/lib/x86_64-linux-gnu/libpng16.so.16+0x236af)
    #3 0x7f7268f507ce in [poc.swf.zip](https://github.com/gpac/gpac/files/13362023/poc.swf.zip) media_tools/img.c:700
    #4 0x7f72690d8e61 in swf_def_bits_jpeg scene_manager/swf_parse.c:2175
    #5 0x7f72690d96b4 in swf_process_tag scene_manager/swf_parse.c:2381
    #6 0x7f72690d98d3 in swf_parse_tag scene_manager/swf_parse.c:2408
    #7 0x7f72690d9fc6 in gf_sm_load_run_swf scene_manager/swf_parse.c:2479
    #8 0x5555cc7f078f in dump_isom_scene /home/lly/pro/gpac/applications/mp4box/filedump.c:209
    #9 0x5555cc7dcf1d in mp4box_main /home/lly/pro/gpac/applications/mp4box/mp4box.c:6467
    #10 0x7f7268528082 in __libc_start_main ../csu/libc-start.c:308
    #11 0x5555cc7c0dbd in _start (/home/lly/pro/gpac/bin/gcc/MP4Box+0x4edbd)

0x7f72652deea0 is located 0 bytes to the right of 509600-byte region [0x7f7265262800,0x7f72652deea0)
allocated by thread T0 here:
    #0 0x7f7269d6e157 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x7f72690d8763 in swf_def_bits_jpeg scene_manager/swf_parse.c:2139
    #2 0x7f72690d96b4 in swf_process_tag scene_manager/swf_parse.c:2381
    #3 0x7f72690d98d3 in swf_parse_tag scene_manager/swf_parse.c:2408
    #4 0x7f72690d9fc6 in gf_sm_load_run_swf scene_manager/swf_parse.c:2479
    #5 0x5555cc7f078f in dump_isom_scene /home/lly/pro/gpac/applications/mp4box/filedump.c:209
    #6 0x5555cc7dcf1d in mp4box_main /home/lly/pro/gpac/applications/mp4box/mp4box.c:6467
    #7 0x7f7268528082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 in __interceptor_memcpy
Shadow bytes around the buggy address:
  0x0feecca53d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0feecca53d90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0feecca53da0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0feecca53db0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0feecca53dc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0feecca53dd0: 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa
  0x0feecca53de0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0feecca53df0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0feecca53e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0feecca53e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0feecca53e20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb


seems that para stride to gf_img_png_enc error, makes libpng write out of scope memory.
2173:
gf_img_png_enc(raw, w, h, h*4, GF_PIXEL_RGBA, (char *)buf, &osize);

should it be h*4 or w*4?
Here's some debug info i print:  width = 350,heigth = 364,
and i've print the 4*stride value : 1456(4*364)  while the step in libpng is 1400(4*350).
May it help.

[poc.swf.zip](https://github.com/gpac/gpac/files/13362027/poc.swf.zip)


heap-buffer-overflow   in gf_img_png_enc at media_tools/img.c
This is a GitHub Issue
repo:gpac
owner:gpac
Title : heap-buffer-overflow   in gf_img_png_enc at media_tools/img.c
Issue date:

--- start body ---
Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [x] I looked for a similar issue and couldn't find any.
- [x] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [x] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/bug-reporting/

Step to reproduce:

1.get latest commit code (gpac - GPAC command line filter engine - version 2.3-DEV-rev621-g3edb48d2b-master)
2.compile with --enable-sanitizer
3.run MP4Box -bt poc.swf
Env:
Ubunut 20.04 , clang 16.0.1

ASAN report


==86785==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f72652deea0 at pc 0x7f7269cf869a bp 0x7ffc978dbe90 sp 0x7ffc978db638
READ of size 1400 at 0x7f72652deea0 thread T0
    #0 0x7f7269cf8699 in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823
    #1 0x7f72682bd2da in png_write_row (/lib/x86_64-linux-gnu/libpng16.so.16+0x232da)
    #2 0x7f72682bd6af in png_write_image (/lib/x86_64-linux-gnu/libpng16.so.16+0x236af)
    #3 0x7f7268f507ce in [poc.swf.zip](https://github.com/gpac/gpac/files/13362023/poc.swf.zip) media_tools/img.c:700
    #4 0x7f72690d8e61 in swf_def_bits_jpeg scene_manager/swf_parse.c:2175
    #5 0x7f72690d96b4 in swf_process_tag scene_manager/swf_parse.c:2381
    #6 0x7f72690d98d3 in swf_parse_tag scene_manager/swf_parse.c:2408
    #7 0x7f72690d9fc6 in gf_sm_load_run_swf scene_manager/swf_parse.c:2479
    #8 0x5555cc7f078f in dump_isom_scene /home/lly/pro/gpac/applications/mp4box/filedump.c:209
    #9 0x5555cc7dcf1d in mp4box_main /home/lly/pro/gpac/applications/mp4box/mp4box.c:6467
    #10 0x7f7268528082 in __libc_start_main ../csu/libc-start.c:308
    #11 0x5555cc7c0dbd in _start (/home/lly/pro/gpac/bin/gcc/MP4Box+0x4edbd)

0x7f72652deea0 is located 0 bytes to the right of 509600-byte region [0x7f7265262800,0x7f72652deea0)
allocated by thread T0 here:
    #0 0x7f7269d6e157 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x7f72690d8763 in swf_def_bits_jpeg scene_manager/swf_parse.c:2139
    #2 0x7f72690d96b4 in swf_process_tag scene_manager/swf_parse.c:2381
    #3 0x7f72690d98d3 in swf_parse_tag scene_manager/swf_parse.c:2408
    #4 0x7f72690d9fc6 in gf_sm_load_run_swf scene_manager/swf_parse.c:2479
    #5 0x5555cc7f078f in dump_isom_scene /home/lly/pro/gpac/applications/mp4box/filedump.c:209
    #6 0x5555cc7dcf1d in mp4box_main /home/lly/pro/gpac/applications/mp4box/mp4box.c:6467
    #7 0x7f7268528082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:823 in __interceptor_memcpy
Shadow bytes around the buggy address:
  0x0feecca53d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0feecca53d90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0feecca53da0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0feecca53db0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0feecca53dc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0feecca53dd0: 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa
  0x0feecca53de0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0feecca53df0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0feecca53e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0feecca53e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0feecca53e20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb


seems that para stride to gf_img_png_enc error, makes libpng write out of scope memory.
2173:
gf_img_png_enc(raw, w, h, h*4, GF_PIXEL_RGBA, (char *)buf, &osize);

should it be h*4 or w*4?
Here's some debug info i print:  width = 350,heigth = 364,
and i've print the 4*stride value : 1456(4*364)  while the step in libpng is 1400(4*350).
May it help.

[poc.swf.zip](https://github.com/gpac/gpac/files/13362027/poc.swf.zip)


--- end body ---
