Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [ ] I looked for a similar issue and couldn't find any.
- [x] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [x] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/

**Description:**
`In Gpac 2.1 (current commit) ,there is a heap-use-after-free vulnerability which occurs in  function gf_node_try_destroy() at scenegraph/base_scenegraph.c:668.`  

**Version info:**
git log
```
commit b9c5a244b73e57216bd4ba7ac76359ea0fda12e4 (grafted, HEAD -> master, origin/master, origin/HEAD)
Author: Romain Bouqueau <romain.bouqueau.pro@gmail.com>
Date:   Tue Jul 12 23:04:57 2022 +0200
 fix string comparison

```
./MP4Box -version
```
MP4Box - GPAC version 2.1-DEV-revUNKNOWN-master
(c) 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io
Please cite our work in your research:
	GPAC Filters: https://doi.org/10.1145/3339825.3394929
	GPAC: https://doi.org/10.1145/1291233.1291452
GPAC Configuration: --enable-sanitizer
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D 

```
**crash command:**
./MP4Box -xmt poc

**crash output**
```

[iso file] Unknown box type url@ in parent dref
[iso file] Unknown box type mp1Dv in parent stsd
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type t0E18 in parent trak
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type 80rak in parent moov
[iso file] Incomplete box mdat - start 11495 size 803698
[iso file] Incomplete file while reading for dump - aborting parsing
[iso file] Unknown box type url@ in parent dref
[iso file] Unknown box type mp1Dv in parent stsd
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type t0E18 in parent trak
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type 80rak in parent moov
[iso file] Incomplete box mdat - start 11495 size 803698
[iso file] Incomplete file while reading for dump - aborting parsing
MPEG-4 BIFS Scene Parsing
[ODF] Reading bifs config: shift in sizes (not supported)
Scene loaded - dumping 1 systems streams           
=================================================================
==9431==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000005ad0 at pc 0x7fdf63587e63 bp 0x7fffa63615f0 sp 0x7fffa63615e0
READ of size 8 at 0x604000005ad0 thread T0
    #0 0x7fdf63587e62 in gf_node_try_destroy scenegraph/base_scenegraph.c:668
    #1 0x7fdf63599519 in gf_sg_command_del scenegraph/commands.c:120
    #2 0x7fdf63e3fd1f in gf_sm_au_del scene_manager/scene_manager.c:113
    #3 0x7fdf63e3fd1f in gf_sm_reset_stream scene_manager/scene_manager.c:126
    #4 0x7fdf63e3fd1f in gf_sm_delete_stream scene_manager/scene_manager.c:133
    #5 0x7fdf63e3fd1f in gf_sm_del scene_manager/scene_manager.c:147
    #6 0x55cdaef071f0 in dump_isom_scene /home/fuzz/gpac2.1/gpac/applications/mp4box/filedump.c:220
    #7 0x55cdaeef0b00 in mp4box_main /home/fuzz/gpac2.1/gpac/applications/mp4box/mp4box.c:6344
    #8 0x7fdf60fdb082 in __libc_start_main ../csu/libc-start.c:308
    #9 0x55cdaeecaafd in _start (/home/fuzz/gpac2.1/gpac/bin/gcc/MP4Box+0xa2afd)

0x604000005ad0 is located 0 bytes inside of 48-byte region [0x604000005ad0,0x604000005b00)
freed by thread T0 here:
    #0 0x7fdf66d4540f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
    #1 0x7fdf6358734d in gf_node_unregister scenegraph/base_scenegraph.c:763
    #2 0x7fdf63599519 in gf_sg_command_del scenegraph/commands.c:120
    #3 0x7fdf63e3fd1f in gf_sm_au_del scene_manager/scene_manager.c:113
    #4 0x7fdf63e3fd1f in gf_sm_reset_stream scene_manager/scene_manager.c:126
    #5 0x7fdf63e3fd1f in gf_sm_delete_stream scene_manager/scene_manager.c:133
    #6 0x7fdf63e3fd1f in gf_sm_del scene_manager/scene_manager.c:147
    #7 0x55cdaef071f0 in dump_isom_scene /home/fuzz/gpac2.1/gpac/applications/mp4box/filedump.c:220
    #8 0x55cdaeef0b00 in mp4box_main /home/fuzz/gpac2.1/gpac/applications/mp4box/mp4box.c:6344
    #9 0x7fdf60fdb082 in __libc_start_main ../csu/libc-start.c:308

previously allocated by thread T0 here:
    #0 0x7fdf66d45808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
    #1 0x7fdf63653321 in Group_Create scenegraph/mpeg4_nodes.c:7579
    #2 0x7fdf63653321 in gf_sg_mpeg4_node_new scenegraph/mpeg4_nodes.c:36809
    #3 0x7fdf63589266 in gf_node_new scenegraph/base_scenegraph.c:1996
    #4 0x7fdf638d7b05 in gf_bifs_dec_node bifs/field_decode.c:900
    #5 0x7fdf638c415a in BD_DecSceneReplace bifs/com_dec.c:1357
    #6 0x7fdf638c415a in BD_DecSceneReplace bifs/com_dec.c:1336
    #7 0x7fdf638edbca in BM_SceneReplace bifs/memory_decoder.c:866
    #8 0x7fdf638ee5ae in BM_ParseCommand bifs/memory_decoder.c:916
    #9 0x7fdf638ef28c in gf_bifs_decode_command_list bifs/memory_decoder.c:1037
    #10 0x7fdf63e9d9dc in gf_sm_load_run_isom scene_manager/loader_isom.c:303
    #11 0x55cdaef0729b in dump_isom_scene /home/fuzz/gpac2.1/gpac/applications/mp4box/filedump.c:203
    #12 0x55cdaeef0b00 in mp4box_main /home/fuzz/gpac2.1/gpac/applications/mp4box/mp4box.c:6344
    #13 0x7fdf60fdb082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-use-after-free scenegraph/base_scenegraph.c:668 in gf_node_try_destroy
Shadow bytes around the buggy address:
  0x0c087fff8b00: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x0c087fff8b10: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x0c087fff8b20: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x0c087fff8b30: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x0c087fff8b40: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
=>0x0c087fff8b50: fa fa 00 00 00 00 01 fa fa fa[fd]fd fd fd fd fd
  0x0c087fff8b60: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa
  0x0c087fff8b70: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa
  0x0c087fff8b80: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c087fff8b90: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c087fff8ba0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==9431==ABORTING

```
**poc:**
[poc.zip](https://github.com/gpac/gpac/files/9099701/poc.zip)

PS: The bug is similar with https://github.com/gpac/gpac/issues/2194 . i submit the bug report again because the vulnerability is not fixed under the newest version (the current commit) . Pls check again :-)



(unpatched)  heap-use-after-free in gf_node_try_destroy() in gpac2.1 (the newest commit)
This is a GitHub Issue
repo:gpac
owner:gpac
Title : (unpatched)  heap-use-after-free in gf_node_try_destroy() in gpac2.1 (the newest commit)
Issue date:

--- start body ---
Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [ ] I looked for a similar issue and couldn't find any.
- [x] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [x] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/

**Description:**
`In Gpac 2.1 (current commit) ,there is a heap-use-after-free vulnerability which occurs in  function gf_node_try_destroy() at scenegraph/base_scenegraph.c:668.`  

**Version info:**
git log
```
commit b9c5a244b73e57216bd4ba7ac76359ea0fda12e4 (grafted, HEAD -> master, origin/master, origin/HEAD)
Author: Romain Bouqueau <romain.bouqueau.pro@gmail.com>
Date:   Tue Jul 12 23:04:57 2022 +0200
 fix string comparison

```
./MP4Box -version
```
MP4Box - GPAC version 2.1-DEV-revUNKNOWN-master
(c) 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io
Please cite our work in your research:
	GPAC Filters: https://doi.org/10.1145/3339825.3394929
	GPAC: https://doi.org/10.1145/1291233.1291452
GPAC Configuration: --enable-sanitizer
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D 

```
**crash command:**
./MP4Box -xmt poc

**crash output**
```

[iso file] Unknown box type url@ in parent dref
[iso file] Unknown box type mp1Dv in parent stsd
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type t0E18 in parent trak
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type 80rak in parent moov
[iso file] Incomplete box mdat - start 11495 size 803698
[iso file] Incomplete file while reading for dump - aborting parsing
[iso file] Unknown box type url@ in parent dref
[iso file] Unknown box type mp1Dv in parent stsd
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type t0E18 in parent trak
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type 80rak in parent moov
[iso file] Incomplete box mdat - start 11495 size 803698
[iso file] Incomplete file while reading for dump - aborting parsing
MPEG-4 BIFS Scene Parsing
[ODF] Reading bifs config: shift in sizes (not supported)
Scene loaded - dumping 1 systems streams           
=================================================================
==9431==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000005ad0 at pc 0x7fdf63587e63 bp 0x7fffa63615f0 sp 0x7fffa63615e0
READ of size 8 at 0x604000005ad0 thread T0
    #0 0x7fdf63587e62 in gf_node_try_destroy scenegraph/base_scenegraph.c:668
    #1 0x7fdf63599519 in gf_sg_command_del scenegraph/commands.c:120
    #2 0x7fdf63e3fd1f in gf_sm_au_del scene_manager/scene_manager.c:113
    #3 0x7fdf63e3fd1f in gf_sm_reset_stream scene_manager/scene_manager.c:126
    #4 0x7fdf63e3fd1f in gf_sm_delete_stream scene_manager/scene_manager.c:133
    #5 0x7fdf63e3fd1f in gf_sm_del scene_manager/scene_manager.c:147
    #6 0x55cdaef071f0 in dump_isom_scene /home/fuzz/gpac2.1/gpac/applications/mp4box/filedump.c:220
    #7 0x55cdaeef0b00 in mp4box_main /home/fuzz/gpac2.1/gpac/applications/mp4box/mp4box.c:6344
    #8 0x7fdf60fdb082 in __libc_start_main ../csu/libc-start.c:308
    #9 0x55cdaeecaafd in _start (/home/fuzz/gpac2.1/gpac/bin/gcc/MP4Box+0xa2afd)

0x604000005ad0 is located 0 bytes inside of 48-byte region [0x604000005ad0,0x604000005b00)
freed by thread T0 here:
    #0 0x7fdf66d4540f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
    #1 0x7fdf6358734d in gf_node_unregister scenegraph/base_scenegraph.c:763
    #2 0x7fdf63599519 in gf_sg_command_del scenegraph/commands.c:120
    #3 0x7fdf63e3fd1f in gf_sm_au_del scene_manager/scene_manager.c:113
    #4 0x7fdf63e3fd1f in gf_sm_reset_stream scene_manager/scene_manager.c:126
    #5 0x7fdf63e3fd1f in gf_sm_delete_stream scene_manager/scene_manager.c:133
    #6 0x7fdf63e3fd1f in gf_sm_del scene_manager/scene_manager.c:147
    #7 0x55cdaef071f0 in dump_isom_scene /home/fuzz/gpac2.1/gpac/applications/mp4box/filedump.c:220
    #8 0x55cdaeef0b00 in mp4box_main /home/fuzz/gpac2.1/gpac/applications/mp4box/mp4box.c:6344
    #9 0x7fdf60fdb082 in __libc_start_main ../csu/libc-start.c:308

previously allocated by thread T0 here:
    #0 0x7fdf66d45808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
    #1 0x7fdf63653321 in Group_Create scenegraph/mpeg4_nodes.c:7579
    #2 0x7fdf63653321 in gf_sg_mpeg4_node_new scenegraph/mpeg4_nodes.c:36809
    #3 0x7fdf63589266 in gf_node_new scenegraph/base_scenegraph.c:1996
    #4 0x7fdf638d7b05 in gf_bifs_dec_node bifs/field_decode.c:900
    #5 0x7fdf638c415a in BD_DecSceneReplace bifs/com_dec.c:1357
    #6 0x7fdf638c415a in BD_DecSceneReplace bifs/com_dec.c:1336
    #7 0x7fdf638edbca in BM_SceneReplace bifs/memory_decoder.c:866
    #8 0x7fdf638ee5ae in BM_ParseCommand bifs/memory_decoder.c:916
    #9 0x7fdf638ef28c in gf_bifs_decode_command_list bifs/memory_decoder.c:1037
    #10 0x7fdf63e9d9dc in gf_sm_load_run_isom scene_manager/loader_isom.c:303
    #11 0x55cdaef0729b in dump_isom_scene /home/fuzz/gpac2.1/gpac/applications/mp4box/filedump.c:203
    #12 0x55cdaeef0b00 in mp4box_main /home/fuzz/gpac2.1/gpac/applications/mp4box/mp4box.c:6344
    #13 0x7fdf60fdb082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-use-after-free scenegraph/base_scenegraph.c:668 in gf_node_try_destroy
Shadow bytes around the buggy address:
  0x0c087fff8b00: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x0c087fff8b10: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x0c087fff8b20: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x0c087fff8b30: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x0c087fff8b40: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
=>0x0c087fff8b50: fa fa 00 00 00 00 01 fa fa fa[fd]fd fd fd fd fd
  0x0c087fff8b60: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa
  0x0c087fff8b70: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa
  0x0c087fff8b80: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c087fff8b90: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c087fff8ba0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==9431==ABORTING

```
**poc:**
[poc.zip](https://github.com/gpac/gpac/files/9099701/poc.zip)

PS: The bug is similar with https://github.com/gpac/gpac/issues/2194 . i submit the bug report again because the vulnerability is not fixed under the newest version (the current commit) . Pls check again :-)



--- end body ---
