- [X] I looked for a similar issue and couldn't find any.
- [X] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [X] I give enough information for contributors to reproduce my issue (meaningful title, github labels, 

# Description

heap-use-after-free media_tools/mpegts.c:2625 in gf_m2ts_process_packet

# Version info

```
MP4Box - GPAC version 2.1-DEV-rev649-ga8f438d20-master
(c) 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
	GPAC Filters: https://doi.org/10.1145/3339825.3394929
	GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --enable-sanitizer
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SSL GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D
```

# Reproduce

compile and run

```
./configure --enable-sanitizer
make
./MP4Box import -catx poc_uaf2.mp4
```

Crash reported by sanitizer

```
=================================================================
==1412408==ERROR: AddressSanitizer: heap-use-after-free on address 0x613000000748 at pc 0x7f5b0a36245f bp 0x7ffc9e3b02d0 sp 0x7ffc9e3b02c0
READ of size 4 at 0x613000000748 thread T0
    #0 0x7f5b0a36245e in gf_m2ts_process_packet media_tools/mpegts.c:2625
    #1 0x7f5b0a365758 in gf_m2ts_process_data media_tools/mpegts.c:2813
    #2 0x7f5b0aa739c0 in m2tsdmx_process filters/dmx_m2ts.c:1420
    #3 0x7f5b0a941f1d in gf_filter_process_task filter_core/filter.c:2815
    #4 0x7f5b0a9015a3 in gf_fs_thread_proc filter_core/filter_session.c:1859
    #5 0x7f5b0a90dece in gf_fs_run filter_core/filter_session.c:2120
    #6 0x7f5b0a3509c1 in gf_media_import media_tools/media_import.c:1551
    #7 0x559a9079cb4c in import_file /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/fileimport.c:1498
    #8 0x559a907a75d7 in cat_isomedia_file /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/fileimport.c:2536
    #9 0x559a90751130 in do_add_cat /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/mp4box.c:4562
    #10 0x559a90751130 in mp4box_main /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/mp4box.c:6124
    #11 0x7f5b078d7d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #12 0x7f5b078d7e3f in __libc_start_main_impl ../csu/libc-start.c:392
    #13 0x559a9072dcb4 in _start (/home/sumuchuan/Desktop/gpac_fuzz/gpac/bin/gcc/MP4Box+0xabcb4)

0x613000000748 is located 8 bytes inside of 360-byte region [0x613000000740,0x6130000008a8)
freed by thread T0 here:
    #0 0x7f5b0d440517 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127
    #1 0x7f5b0a36a917 in gf_m2ts_process_pmt media_tools/mpegts.c:1707
    #2 0x7f5b0a36a917 in gf_m2ts_process_pmt media_tools/mpegts.c:1132
    #3 0x7f5b0a35b3a6 in gf_m2ts_section_complete media_tools/mpegts.c:624
    #4 0x7f5b0a35cc9f in gf_m2ts_gather_section media_tools/mpegts.c:755
    #5 0x7f5b0a361f22 in gf_m2ts_process_packet media_tools/mpegts.c:2721
    #6 0x7f5b0a365758 in gf_m2ts_process_data media_tools/mpegts.c:2813
    #7 0x7f5b0aa739c0 in m2tsdmx_process filters/dmx_m2ts.c:1420
    #8 0x7f5b0a941f1d in gf_filter_process_task filter_core/filter.c:2815
    #9 0x7f5b0a9015a3 in gf_fs_thread_proc filter_core/filter_session.c:1859
    #10 0x7f5b0a90dece in gf_fs_run filter_core/filter_session.c:2120
    #11 0x7f5b0a3509c1 in gf_media_import media_tools/media_import.c:1551
    #12 0x559a9079cb4c in import_file /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/fileimport.c:1498
    #13 0x559a907a75d7 in cat_isomedia_file /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/fileimport.c:2536
    #14 0x559a90751130 in do_add_cat /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/mp4box.c:4562
    #15 0x559a90751130 in mp4box_main /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/mp4box.c:6124
    #16 0x7f5b078d7d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

previously allocated by thread T0 here:
    #0 0x7f5b0d440867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x7f5b0a3684e7 in gf_m2ts_process_pmt media_tools/mpegts.c:1374
    #2 0x7f5b0a3684e7 in gf_m2ts_process_pmt media_tools/mpegts.c:1132
    #3 0x7f5b0a35b3a6 in gf_m2ts_section_complete media_tools/mpegts.c:624
    #4 0x7f5b0a35cc9f in gf_m2ts_gather_section media_tools/mpegts.c:755
    #5 0x7f5b0a361f22 in gf_m2ts_process_packet media_tools/mpegts.c:2721
    #6 0x7f5b0a365758 in gf_m2ts_process_data media_tools/mpegts.c:2813
    #7 0x7f5b0aa739c0 in m2tsdmx_process filters/dmx_m2ts.c:1420
    #8 0x7f5b0a941f1d in gf_filter_process_task filter_core/filter.c:2815
    #9 0x7f5b0a9015a3 in gf_fs_thread_proc filter_core/filter_session.c:1859
    #10 0x7f5b0a90dece in gf_fs_run filter_core/filter_session.c:2120
    #11 0x7f5b0a3509c1 in gf_media_import media_tools/media_import.c:1551
    #12 0x559a9079cb4c in import_file /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/fileimport.c:1498
    #13 0x559a907a75d7 in cat_isomedia_file /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/fileimport.c:2536
    #14 0x559a90751130 in do_add_cat /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/mp4box.c:4562
    #15 0x559a90751130 in mp4box_main /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/mp4box.c:6124
    #16 0x7f5b078d7d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-use-after-free media_tools/mpegts.c:2625 in gf_m2ts_process_packet
Shadow bytes around the buggy address:
  0x0c267fff8090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c267fff80a0: 00 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c267fff80b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c267fff80c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c267fff80d0: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa
=>0x0c267fff80e0: fa fa fa fa fa fa fa fa fd[fd]fd fd fd fd fd fd
  0x0c267fff80f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c267fff8100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c267fff8110: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa
  0x0c267fff8120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c267fff8130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==1412408==ABORTING
```

# POC

[poc_uaf2.zip](https://github.com/gpac/gpac/files/10258882/poc_uaf2.zip)

# Impact

Potentially causing DoS and RCE

# Credit 

Xdchase

heap-use-after-free media_tools/mpegts.c:2625 in gf_m2ts_process_packet
This is a GitHub Issue
repo:gpac
owner:gpac
Title : heap-use-after-free media_tools/mpegts.c:2625 in gf_m2ts_process_packet
Issue date:

--- start body ---
- [X] I looked for a similar issue and couldn't find any.
- [X] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [X] I give enough information for contributors to reproduce my issue (meaningful title, github labels, 

# Description

heap-use-after-free media_tools/mpegts.c:2625 in gf_m2ts_process_packet

# Version info

```
MP4Box - GPAC version 2.1-DEV-rev649-ga8f438d20-master
(c) 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
	GPAC Filters: https://doi.org/10.1145/3339825.3394929
	GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --enable-sanitizer
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SSL GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D
```

# Reproduce

compile and run

```
./configure --enable-sanitizer
make
./MP4Box import -catx poc_uaf2.mp4
```

Crash reported by sanitizer

```
=================================================================
==1412408==ERROR: AddressSanitizer: heap-use-after-free on address 0x613000000748 at pc 0x7f5b0a36245f bp 0x7ffc9e3b02d0 sp 0x7ffc9e3b02c0
READ of size 4 at 0x613000000748 thread T0
    #0 0x7f5b0a36245e in gf_m2ts_process_packet media_tools/mpegts.c:2625
    #1 0x7f5b0a365758 in gf_m2ts_process_data media_tools/mpegts.c:2813
    #2 0x7f5b0aa739c0 in m2tsdmx_process filters/dmx_m2ts.c:1420
    #3 0x7f5b0a941f1d in gf_filter_process_task filter_core/filter.c:2815
    #4 0x7f5b0a9015a3 in gf_fs_thread_proc filter_core/filter_session.c:1859
    #5 0x7f5b0a90dece in gf_fs_run filter_core/filter_session.c:2120
    #6 0x7f5b0a3509c1 in gf_media_import media_tools/media_import.c:1551
    #7 0x559a9079cb4c in import_file /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/fileimport.c:1498
    #8 0x559a907a75d7 in cat_isomedia_file /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/fileimport.c:2536
    #9 0x559a90751130 in do_add_cat /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/mp4box.c:4562
    #10 0x559a90751130 in mp4box_main /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/mp4box.c:6124
    #11 0x7f5b078d7d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #12 0x7f5b078d7e3f in __libc_start_main_impl ../csu/libc-start.c:392
    #13 0x559a9072dcb4 in _start (/home/sumuchuan/Desktop/gpac_fuzz/gpac/bin/gcc/MP4Box+0xabcb4)

0x613000000748 is located 8 bytes inside of 360-byte region [0x613000000740,0x6130000008a8)
freed by thread T0 here:
    #0 0x7f5b0d440517 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127
    #1 0x7f5b0a36a917 in gf_m2ts_process_pmt media_tools/mpegts.c:1707
    #2 0x7f5b0a36a917 in gf_m2ts_process_pmt media_tools/mpegts.c:1132
    #3 0x7f5b0a35b3a6 in gf_m2ts_section_complete media_tools/mpegts.c:624
    #4 0x7f5b0a35cc9f in gf_m2ts_gather_section media_tools/mpegts.c:755
    #5 0x7f5b0a361f22 in gf_m2ts_process_packet media_tools/mpegts.c:2721
    #6 0x7f5b0a365758 in gf_m2ts_process_data media_tools/mpegts.c:2813
    #7 0x7f5b0aa739c0 in m2tsdmx_process filters/dmx_m2ts.c:1420
    #8 0x7f5b0a941f1d in gf_filter_process_task filter_core/filter.c:2815
    #9 0x7f5b0a9015a3 in gf_fs_thread_proc filter_core/filter_session.c:1859
    #10 0x7f5b0a90dece in gf_fs_run filter_core/filter_session.c:2120
    #11 0x7f5b0a3509c1 in gf_media_import media_tools/media_import.c:1551
    #12 0x559a9079cb4c in import_file /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/fileimport.c:1498
    #13 0x559a907a75d7 in cat_isomedia_file /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/fileimport.c:2536
    #14 0x559a90751130 in do_add_cat /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/mp4box.c:4562
    #15 0x559a90751130 in mp4box_main /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/mp4box.c:6124
    #16 0x7f5b078d7d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

previously allocated by thread T0 here:
    #0 0x7f5b0d440867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x7f5b0a3684e7 in gf_m2ts_process_pmt media_tools/mpegts.c:1374
    #2 0x7f5b0a3684e7 in gf_m2ts_process_pmt media_tools/mpegts.c:1132
    #3 0x7f5b0a35b3a6 in gf_m2ts_section_complete media_tools/mpegts.c:624
    #4 0x7f5b0a35cc9f in gf_m2ts_gather_section media_tools/mpegts.c:755
    #5 0x7f5b0a361f22 in gf_m2ts_process_packet media_tools/mpegts.c:2721
    #6 0x7f5b0a365758 in gf_m2ts_process_data media_tools/mpegts.c:2813
    #7 0x7f5b0aa739c0 in m2tsdmx_process filters/dmx_m2ts.c:1420
    #8 0x7f5b0a941f1d in gf_filter_process_task filter_core/filter.c:2815
    #9 0x7f5b0a9015a3 in gf_fs_thread_proc filter_core/filter_session.c:1859
    #10 0x7f5b0a90dece in gf_fs_run filter_core/filter_session.c:2120
    #11 0x7f5b0a3509c1 in gf_media_import media_tools/media_import.c:1551
    #12 0x559a9079cb4c in import_file /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/fileimport.c:1498
    #13 0x559a907a75d7 in cat_isomedia_file /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/fileimport.c:2536
    #14 0x559a90751130 in do_add_cat /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/mp4box.c:4562
    #15 0x559a90751130 in mp4box_main /home/sumuchuan/Desktop/gpac_fuzz/gpac/applications/mp4box/mp4box.c:6124
    #16 0x7f5b078d7d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-use-after-free media_tools/mpegts.c:2625 in gf_m2ts_process_packet
Shadow bytes around the buggy address:
  0x0c267fff8090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c267fff80a0: 00 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c267fff80b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c267fff80c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c267fff80d0: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa
=>0x0c267fff80e0: fa fa fa fa fa fa fa fa fd[fd]fd fd fd fd fd fd
  0x0c267fff80f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c267fff8100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c267fff8110: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa
  0x0c267fff8120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c267fff8130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==1412408==ABORTING
```

# POC

[poc_uaf2.zip](https://github.com/gpac/gpac/files/10258882/poc_uaf2.zip)

# Impact

Potentially causing DoS and RCE

# Credit 

Xdchase

--- end body ---
