LINK:https://drive.google.com/file/d/1noz9KXlnqrxFkO593-DM6I81FV1kVSuY/view?usp=share_link

POC:  ./MP4Box -dash 1000 POC7

```
stack overflow vulnerability in the code:

==2451518==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffc878aab58 at pc 0x7f191a430790 bp 0x7ffc878a9570 sp 0x7ffc878a9560
WRITE of size 4 at 0x7ffc878aab58 thread T0

This issue occurs in the swf_def_button function and may cause unexpected behavior or crashes. Developers should investigate this vulnerability to ensure the stability and security of the software.

==2451518==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffc878aab58 at pc 0x7f191a430790 bp 0x7ffc878a9570 sp 0x7ffc878a9560
WRITE of size 4 at 0x7ffc878aab58 thread T0
#0 0x7f191a43078f in swf_def_button (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x260378f)
#1 0x7f191a439274 in swf_parse_tag (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x260c274)
#2 0x7f191ac3d8d9 in gf_text_process_swf (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2e108d9)
#3 0x7f191ac2e7ef in txtin_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2e017ef)
#4 0x7f191a96b97c in gf_filter_process_task (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b3e97c)
#5 0x7f191a92700a in gf_fs_thread_proc (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2afa00a)
#6 0x7f191a93492e in gf_fs_run (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b0792e)
#7 0x7f191a1a50ce in gf_dasher_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x23780ce)
#8 0x55819bea3338 in do_dash /root/gpac2/gpac/applications/mp4box/mp4box.c:4807
#9 0x55819bea3338 in mp4box_main /root/gpac2/gpac/applications/mp4box/mp4box.c:6184
#10 0x7f19175f9d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#11 0x7f19175f9e3f in __libc_start_main_impl ../csu/libc-start.c:392
#12 0x55819be79cb4 in _start (/root/gpac2/gpac/bin/gcc/MP4Box+0xabcb4)

Address 0x7ffc878aab58 is located in stack of thread T0 at offset 5496 in frame
#0 0x7f191a42fdcf in swf_def_button (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2602dcf)

This frame has 1 object(s):
[48, 5496) 'button' (line 1182) <== Memory access at offset 5496 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
(longjmp and C++ exceptions are supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x260378f) in swf_def_button
Shadow bytes around the buggy address:
0x100010f0d510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100010f0d520: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100010f0d530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100010f0d540: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100010f0d550: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x100010f0d560: 00 00 00 00 00 00 00 00 00 00 00[f3]f3 f3 f3 f3
0x100010f0d570: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3
0x100010f0d580: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 00 00 00 00
0x100010f0d590: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100010f0d5a0: 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f2
0x100010f0d5b0: 04 f2 04 f2 00 00 f2 f2 00 00 f2 f2 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable:           00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone:       fa
Freed heap region:       fd
Stack left redzone:      f1
Stack mid redzone:       f2
Stack right redzone:     f3
Stack after return:      f5
Stack use after scope:   f8
Global redzone:          f9
Global init order:       f6
Poisoned by user:        f7
Container overflow:      fc
Array cookie:            ac
Intra object redzone:    bb
ASan internal:           fe
Left alloca redzone:     ca
Right alloca redzone:    cb
Shadow gap:              cc
==2451518==ABORTING
```
Stack Buffer Overflow in GPAC MP4Box SWF Text Processing (2)
This is a GitHub Issue
repo:gpac
owner:gpac
Title : Stack Buffer Overflow in GPAC MP4Box SWF Text Processing (2)
Issue date:

--- start body ---
LINK:https://drive.google.com/file/d/1noz9KXlnqrxFkO593-DM6I81FV1kVSuY/view?usp=share_link

POC:  ./MP4Box -dash 1000 POC7

```
stack overflow vulnerability in the code:

==2451518==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffc878aab58 at pc 0x7f191a430790 bp 0x7ffc878a9570 sp 0x7ffc878a9560
WRITE of size 4 at 0x7ffc878aab58 thread T0

This issue occurs in the swf_def_button function and may cause unexpected behavior or crashes. Developers should investigate this vulnerability to ensure the stability and security of the software.

==2451518==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffc878aab58 at pc 0x7f191a430790 bp 0x7ffc878a9570 sp 0x7ffc878a9560
WRITE of size 4 at 0x7ffc878aab58 thread T0
#0 0x7f191a43078f in swf_def_button (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x260378f)
#1 0x7f191a439274 in swf_parse_tag (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x260c274)
#2 0x7f191ac3d8d9 in gf_text_process_swf (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2e108d9)
#3 0x7f191ac2e7ef in txtin_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2e017ef)
#4 0x7f191a96b97c in gf_filter_process_task (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b3e97c)
#5 0x7f191a92700a in gf_fs_thread_proc (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2afa00a)
#6 0x7f191a93492e in gf_fs_run (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b0792e)
#7 0x7f191a1a50ce in gf_dasher_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x23780ce)
#8 0x55819bea3338 in do_dash /root/gpac2/gpac/applications/mp4box/mp4box.c:4807
#9 0x55819bea3338 in mp4box_main /root/gpac2/gpac/applications/mp4box/mp4box.c:6184
#10 0x7f19175f9d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#11 0x7f19175f9e3f in __libc_start_main_impl ../csu/libc-start.c:392
#12 0x55819be79cb4 in _start (/root/gpac2/gpac/bin/gcc/MP4Box+0xabcb4)

Address 0x7ffc878aab58 is located in stack of thread T0 at offset 5496 in frame
#0 0x7f191a42fdcf in swf_def_button (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2602dcf)

This frame has 1 object(s):
[48, 5496) 'button' (line 1182) <== Memory access at offset 5496 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
(longjmp and C++ exceptions are supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x260378f) in swf_def_button
Shadow bytes around the buggy address:
0x100010f0d510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100010f0d520: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100010f0d530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100010f0d540: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100010f0d550: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x100010f0d560: 00 00 00 00 00 00 00 00 00 00 00[f3]f3 f3 f3 f3
0x100010f0d570: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3
0x100010f0d580: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 00 00 00 00
0x100010f0d590: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100010f0d5a0: 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f2
0x100010f0d5b0: 04 f2 04 f2 00 00 f2 f2 00 00 f2 f2 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable:           00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone:       fa
Freed heap region:       fd
Stack left redzone:      f1
Stack mid redzone:       f2
Stack right redzone:     f3
Stack after return:      f5
Stack use after scope:   f8
Global redzone:          f9
Global init order:       f6
Poisoned by user:        f7
Container overflow:      fc
Array cookie:            ac
Intra object redzone:    bb
ASan internal:           fe
Left alloca redzone:     ca
Right alloca redzone:    cb
Shadow gap:              cc
==2451518==ABORTING
```
--- end body ---
