Hello,I use the fuzzer(AFL) to fuzz binary gpac and got some crashes.
The following is the details.

Title: SEGV on unknown address 0x000000000000
1. Description

SEGV on unknown address 0x000000000000 has occurred in functionin import_file gpac/applications/mp4box/fileimport.c:1528:7
when running program MP4Box, this can reproduce on the lattest commit.

2. Software version info

$ ./MP4Box -version
MP4Box - GPAC version 2.3-DEV-rev423-g609cba674-master
(c) 2000-2023 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

3. System version info

./uname -a
Linux ppg-X10DRi 5.11.0-49-generic #55-Ubuntu SMP Wed Jan 12 17:36:34 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
4. Command

./MP4Box -add poc -new /tmp/output.mp4 -ab 1024
5. Result
```
Unrecognized import option 000012,sig, ignoring
Unrecognized import option 11,src, ignoring
Unrecognized import option 014377,argv, ignoring
Unrecognized import option 000005,time, ignoring
Unrecognized import option 43079354,execs, ignoring
Unrecognized import option 2518437,op, ignoring
Unrecognized import option havoc,rep, ignoring
Unrecognized import option 8, ignoring
[iso file] Box "saiz" (start 987) has 10 extra bytes
[iso file] Unknown box type senc in parent stbl
[iso file] Read Box type 00000000 (0x00000000) at position 1312 has size 0 but is not at root/file level. Forbidden, skipping end of parent box !
[iso file] Box "moov" (start 32) has 1447 extra bytes
[iso file] Unknown top-level box type 1D02~W
[iso file] Incomplete box 1D02~W - start 2767 size 486632918
[iso file] Incomplete file while reading for dump - aborting parsing
IsoMedia import id:000012,sig:11,src:014377,argv:000005,time:43079354,execs:2518437,op:havoc,rep:8 - track ID 1 - Video (size 320 x 240)
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3835627==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fe7765c86b7 bp 0x000000000000 sp 0x7ffdb9c8c330 T0)
==3835627==The signal is caused by a READ memory access.
==3835627==Hint: address points to the zero page.
    #0 0x7fe7765c86b7 in gf_isom_copy_sample_info (/home/ppg/fuzz_carpet/gpac/build_carpet/lib/libgpac.so.12+0x3a96b7)
    #1 0x7fe7766c0179 in gf_import_isomedia_track (/home/ppg/fuzz_carpet/gpac/build_carpet/lib/libgpac.so.12+0x4a1179)
    #2 0x7fe7766bbb29 in gf_media_import (/home/ppg/fuzz_carpet/gpac/build_carpet/lib/libgpac.so.12+0x49cb29)
    #3 0x51f5a3 in import_file /home/ppg/fuzz_carpet/gpac/applications/mp4box/fileimport.c:1528:7
    #4 0x4eeb44 in do_add_cat /home/ppg/fuzz_carpet/gpac/applications/mp4box/mp4box.c
    #5 0x4e89a8 in mp4box_main /home/ppg/fuzz_carpet/gpac/applications/mp4box/mp4box.c:6190:13
    #6 0x7fe775ead564 in __libc_start_main csu/../csu/libc-start.c:332:16
    #7 0x42ad1d in _start (/home/ppg/fuzz_carpet/gpac/build_carpet/bin/MP4Box+0x42ad1d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/home/ppg/fuzz_carpet/gpac/build_carpet/lib/libgpac.so.12+0x3a96b7) in gf_isom_copy_sample_info
==3835627==ABORTING
```



6. Impact

This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution.

7. POC

[poc02.zip](https://github.com/gpac/gpac/files/11990711/poc02.zip)



SEGV on unknown address 0x000000000000
This is a GitHub Issue
repo:gpac
owner:gpac
Title : SEGV on unknown address 0x000000000000
Issue date:

--- start body ---
Hello,I use the fuzzer(AFL) to fuzz binary gpac and got some crashes.
The following is the details.

Title: SEGV on unknown address 0x000000000000
1. Description

SEGV on unknown address 0x000000000000 has occurred in functionin import_file gpac/applications/mp4box/fileimport.c:1528:7
when running program MP4Box, this can reproduce on the lattest commit.

2. Software version info

$ ./MP4Box -version
MP4Box - GPAC version 2.3-DEV-rev423-g609cba674-master
(c) 2000-2023 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

3. System version info

./uname -a
Linux ppg-X10DRi 5.11.0-49-generic #55-Ubuntu SMP Wed Jan 12 17:36:34 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
4. Command

./MP4Box -add poc -new /tmp/output.mp4 -ab 1024
5. Result
```
Unrecognized import option 000012,sig, ignoring
Unrecognized import option 11,src, ignoring
Unrecognized import option 014377,argv, ignoring
Unrecognized import option 000005,time, ignoring
Unrecognized import option 43079354,execs, ignoring
Unrecognized import option 2518437,op, ignoring
Unrecognized import option havoc,rep, ignoring
Unrecognized import option 8, ignoring
[iso file] Box "saiz" (start 987) has 10 extra bytes
[iso file] Unknown box type senc in parent stbl
[iso file] Read Box type 00000000 (0x00000000) at position 1312 has size 0 but is not at root/file level. Forbidden, skipping end of parent box !
[iso file] Box "moov" (start 32) has 1447 extra bytes
[iso file] Unknown top-level box type 1D02~W
[iso file] Incomplete box 1D02~W - start 2767 size 486632918
[iso file] Incomplete file while reading for dump - aborting parsing
IsoMedia import id:000012,sig:11,src:014377,argv:000005,time:43079354,execs:2518437,op:havoc,rep:8 - track ID 1 - Video (size 320 x 240)
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3835627==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fe7765c86b7 bp 0x000000000000 sp 0x7ffdb9c8c330 T0)
==3835627==The signal is caused by a READ memory access.
==3835627==Hint: address points to the zero page.
    #0 0x7fe7765c86b7 in gf_isom_copy_sample_info (/home/ppg/fuzz_carpet/gpac/build_carpet/lib/libgpac.so.12+0x3a96b7)
    #1 0x7fe7766c0179 in gf_import_isomedia_track (/home/ppg/fuzz_carpet/gpac/build_carpet/lib/libgpac.so.12+0x4a1179)
    #2 0x7fe7766bbb29 in gf_media_import (/home/ppg/fuzz_carpet/gpac/build_carpet/lib/libgpac.so.12+0x49cb29)
    #3 0x51f5a3 in import_file /home/ppg/fuzz_carpet/gpac/applications/mp4box/fileimport.c:1528:7
    #4 0x4eeb44 in do_add_cat /home/ppg/fuzz_carpet/gpac/applications/mp4box/mp4box.c
    #5 0x4e89a8 in mp4box_main /home/ppg/fuzz_carpet/gpac/applications/mp4box/mp4box.c:6190:13
    #6 0x7fe775ead564 in __libc_start_main csu/../csu/libc-start.c:332:16
    #7 0x42ad1d in _start (/home/ppg/fuzz_carpet/gpac/build_carpet/bin/MP4Box+0x42ad1d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/home/ppg/fuzz_carpet/gpac/build_carpet/lib/libgpac.so.12+0x3a96b7) in gf_isom_copy_sample_info
==3835627==ABORTING
```



6. Impact

This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution.

7. POC

[poc02.zip](https://github.com/gpac/gpac/files/11990711/poc02.zip)



--- end body ---
