### Description
This is a typical stack buffer overflow. It used dangerous function sprintf without limitation of dsi_size so the bug is easily exploited by a malicious attacker. 
stack-buffer-overflow in gf_rtp_builder_format_sdp at ietf/rtp_packetizer.c:578.
### Version info
```
git log
commit bd1a8e9906c2628d9fd340b17b08f4f9c6e58823 (grafted, HEAD -> master, origin/master, origin/HEAD)
Author: Jean Le Feuvre <jeanlf@gpac.io>
Date:   Mon Nov 21 09:16:07 2022 +0100

    Merge pull request #2318 from thowat/master
    
    Update configure, aarch64 build

./MP4Box -version
MP4Box - GPAC version 2.1-DEV-revUNKNOWN-master
(c) 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io
```
compile
./configure --enable-sanitizer
make

crash command:
./MP4Box -hint poc3_sbo

poc download url:
https://github.com/Janette88/test_pocs/blob/main/poc3_sbo

ASAN log:
```
./MP4Box -hint poc3_sbo 
[iso file] Unknown top-level box type EDFFFF7F
[AV1] AV1 config misses 16355 bytes to fit the entire OBU
[ISOBMFF] AV1ConfigurationBox overflow read 16371 bytes, of box size 16.
[iso file] Box "av1C" size 24 (start 729) invalid (read 16379)
[iso file] Read Box type av01 (0x61763031) at position 850 has size 0 but is not at root/file level. Forbidden, skipping end of parent box !
[iso file] Box "stsd" (start 627) has 102 extra bytes
[iso file] default sample description set to 134217730 but only 1 sample description(s), likely broken ! Fixing to 1
Hinting track ID 1 - Type "encv:encv" (mpeg4-generic) - BW 0 kbps
=================================================================
==32224==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fffebed07e0 at pc 0x7fe5f15d7725 bp 0x7fffebecb840 sp 0x7fffebecafd0
WRITE of size 3 at 0x7fffebed07e0 thread T0
    #0 0x7fe5f15d7724 in __interceptor_vsprintf ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:1627
    #1 0x7fe5f15d7ce6 in __interceptor___sprintf_chk ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:1675
    #2 0x7fe5ee0e8142 in sprintf /usr/include/x86_64-linux-gnu/bits/stdio2.h:36
    #3 0x7fe5ee0e8142 in gf_rtp_builder_format_sdp ietf/rtp_packetizer.c:598
    #4 0x7fe5ee6bd7b6 in gf_hinter_track_finalize media_tools/isom_hinter.c:1030
    #5 0x560b3cf7847d in HintFile /home/fuzz/gpac/applications/mp4box/mp4box.c:3776
    #6 0x560b3cf7df47 in mp4box_main /home/fuzz/gpac/applications/mp4box/mp4box.c:6707
    #7 0x7fe5eb821082 in __libc_start_main ../csu/libc-start.c:308
    #8 0x560b3cf55cbd in _start (/home/fuzz/gpac/bin/gcc/MP4Box+0xa3cbd)

Address 0x7fffebed07e0 is located in stack of thread T0 at offset 20048 in frame
    #0 0x7fe5ee0e7d9f in gf_rtp_builder_format_sdp ietf/rtp_packetizer.c:578

  This frame has 2 object(s):
    [48, 20048) 'dsiString' (line 579) <== Memory access at offset 20048 overflows this variable
    [20304, 40404) 'buffer' (line 579)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:1627 in __interceptor_vsprintf
Shadow bytes around the buggy address:
  0x10007d7d20a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007d7d20b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007d7d20c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007d7d20d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007d7d20e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10007d7d20f0: 00 00 00 00 00 00 00 00 00 00 00 00[f2]f2 f2 f2
  0x10007d7d2100: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2
  0x10007d7d2110: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00
  0x10007d7d2120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007d7d2130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007d7d2140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==32224==ABORTING

```
### code location

GF_Err gf_rtp_builder_format_sdp(GP_RTPPacketizer *builder, char *payload_name, char *sdpLine, char *dsi, u32 dsi_size)  
{
	**char buffer[20100], dsiString[20000];**        //definition length of char arrary (buffer and dsiString)
	u32 i, k;
	Bool is_first = GF_TRUE;

	if ((builder->rtp_payt!=GF_RTP_PAYT_MPEG4) && (builder->rtp_payt!=GF_RTP_PAYT_LATM) ) return GF_BAD_PARAM;

#define SDP_ADD_INT(_name, _val) { if (!is_first) strcat(sdpLine, "; "); sprintf(buffer, "%s=%d", _name, _val); strcat(sdpLine, buffer); is_first = 0;}
#define SDP_ADD_STR(_name, _val) { if (!is_first) strcat(sdpLine, "; "); sprintf(buffer, "%s=%s", _name, _val); strcat(sdpLine, buffer); is_first = 0;}

	sprintf(sdpLine, "a=fmtp:%d ", builder->PayloadType);

	/*mandatory fields*/
	if (builder->slMap.PL_ID) SDP_ADD_INT("profile-level-id", builder->slMap.PL_ID);

	if (builder->rtp_payt == GF_RTP_PAYT_LATM) SDP_ADD_INT("cpresent", 0);

	if (dsi && dsi_size) {
		k = 0;
		for (i=0; i<dsi_size; i++) {                                                                //dsi_size ????
			**sprintf(&dsiString[k], "%02x", (unsigned char) dsi[i]);**      //here use sprintf ()  trigger vulnerability
			k+=2;
		}
		dsiString[k] = 0;
		SDP_ADD_STR("config", dsiString);
	}
```

### Impact
This is capable of causing crashes and allowing modification of stack memory which could lead to remote code execution.
stack-buffer-overflow in gf_rtp_builder_format_sdp 
This is a GitHub Issue
repo:gpac
owner:gpac
Title : stack-buffer-overflow in gf_rtp_builder_format_sdp 
Issue date:

--- start body ---
### Description
This is a typical stack buffer overflow. It used dangerous function sprintf without limitation of dsi_size so the bug is easily exploited by a malicious attacker. 
stack-buffer-overflow in gf_rtp_builder_format_sdp at ietf/rtp_packetizer.c:578.
### Version info
```
git log
commit bd1a8e9906c2628d9fd340b17b08f4f9c6e58823 (grafted, HEAD -> master, origin/master, origin/HEAD)
Author: Jean Le Feuvre <jeanlf@gpac.io>
Date:   Mon Nov 21 09:16:07 2022 +0100

    Merge pull request #2318 from thowat/master
    
    Update configure, aarch64 build

./MP4Box -version
MP4Box - GPAC version 2.1-DEV-revUNKNOWN-master
(c) 2000-2022 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io
```
compile
./configure --enable-sanitizer
make

crash command:
./MP4Box -hint poc3_sbo

poc download url:
https://github.com/Janette88/test_pocs/blob/main/poc3_sbo

ASAN log:
```
./MP4Box -hint poc3_sbo 
[iso file] Unknown top-level box type EDFFFF7F
[AV1] AV1 config misses 16355 bytes to fit the entire OBU
[ISOBMFF] AV1ConfigurationBox overflow read 16371 bytes, of box size 16.
[iso file] Box "av1C" size 24 (start 729) invalid (read 16379)
[iso file] Read Box type av01 (0x61763031) at position 850 has size 0 but is not at root/file level. Forbidden, skipping end of parent box !
[iso file] Box "stsd" (start 627) has 102 extra bytes
[iso file] default sample description set to 134217730 but only 1 sample description(s), likely broken ! Fixing to 1
Hinting track ID 1 - Type "encv:encv" (mpeg4-generic) - BW 0 kbps
=================================================================
==32224==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fffebed07e0 at pc 0x7fe5f15d7725 bp 0x7fffebecb840 sp 0x7fffebecafd0
WRITE of size 3 at 0x7fffebed07e0 thread T0
    #0 0x7fe5f15d7724 in __interceptor_vsprintf ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:1627
    #1 0x7fe5f15d7ce6 in __interceptor___sprintf_chk ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:1675
    #2 0x7fe5ee0e8142 in sprintf /usr/include/x86_64-linux-gnu/bits/stdio2.h:36
    #3 0x7fe5ee0e8142 in gf_rtp_builder_format_sdp ietf/rtp_packetizer.c:598
    #4 0x7fe5ee6bd7b6 in gf_hinter_track_finalize media_tools/isom_hinter.c:1030
    #5 0x560b3cf7847d in HintFile /home/fuzz/gpac/applications/mp4box/mp4box.c:3776
    #6 0x560b3cf7df47 in mp4box_main /home/fuzz/gpac/applications/mp4box/mp4box.c:6707
    #7 0x7fe5eb821082 in __libc_start_main ../csu/libc-start.c:308
    #8 0x560b3cf55cbd in _start (/home/fuzz/gpac/bin/gcc/MP4Box+0xa3cbd)

Address 0x7fffebed07e0 is located in stack of thread T0 at offset 20048 in frame
    #0 0x7fe5ee0e7d9f in gf_rtp_builder_format_sdp ietf/rtp_packetizer.c:578

  This frame has 2 object(s):
    [48, 20048) 'dsiString' (line 579) <== Memory access at offset 20048 overflows this variable
    [20304, 40404) 'buffer' (line 579)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:1627 in __interceptor_vsprintf
Shadow bytes around the buggy address:
  0x10007d7d20a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007d7d20b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007d7d20c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007d7d20d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007d7d20e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10007d7d20f0: 00 00 00 00 00 00 00 00 00 00 00 00[f2]f2 f2 f2
  0x10007d7d2100: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2
  0x10007d7d2110: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00
  0x10007d7d2120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007d7d2130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007d7d2140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==32224==ABORTING

```
### code location

GF_Err gf_rtp_builder_format_sdp(GP_RTPPacketizer *builder, char *payload_name, char *sdpLine, char *dsi, u32 dsi_size)  
{
	**char buffer[20100], dsiString[20000];**        //definition length of char arrary (buffer and dsiString)
	u32 i, k;
	Bool is_first = GF_TRUE;

	if ((builder->rtp_payt!=GF_RTP_PAYT_MPEG4) && (builder->rtp_payt!=GF_RTP_PAYT_LATM) ) return GF_BAD_PARAM;

#define SDP_ADD_INT(_name, _val) { if (!is_first) strcat(sdpLine, "; "); sprintf(buffer, "%s=%d", _name, _val); strcat(sdpLine, buffer); is_first = 0;}
#define SDP_ADD_STR(_name, _val) { if (!is_first) strcat(sdpLine, "; "); sprintf(buffer, "%s=%s", _name, _val); strcat(sdpLine, buffer); is_first = 0;}

	sprintf(sdpLine, "a=fmtp:%d ", builder->PayloadType);

	/*mandatory fields*/
	if (builder->slMap.PL_ID) SDP_ADD_INT("profile-level-id", builder->slMap.PL_ID);

	if (builder->rtp_payt == GF_RTP_PAYT_LATM) SDP_ADD_INT("cpresent", 0);

	if (dsi && dsi_size) {
		k = 0;
		for (i=0; i<dsi_size; i++) {                                                                //dsi_size ????
			**sprintf(&dsiString[k], "%02x", (unsigned char) dsi[i]);**      //here use sprintf ()  trigger vulnerability
			k+=2;
		}
		dsiString[k] = 0;
		SDP_ADD_STR("config", dsiString);
	}
```

### Impact
This is capable of causing crashes and allowing modification of stack memory which could lead to remote code execution.
--- end body ---
