POC: ./MP4Box -dash 1000 POC6
LINK: https://drive.google.com/file/d/1_bgcSCPG1Wcft9ZcY6xlbeIyUW40SOJ3/view?usp=share_link

```
A heap buffer overflow vulnerability has been detected in the GPAC multimedia framework. The issue occurs during the processing of AVI input files, leading to a potential compromise of the application's memory and possible remote code execution.

The vulnerability is caused by an incorrect boundary check when copying memory using the memcpy function (__interceptor_memcpy). This results in a read operation of size 352,321,536 bytes at address 0x625000018bc6, which is located at the edge of the allocated memory region.

The overflow occurs within the following GPAC library functions:

avi_parse_input_file
AVI_open_input_file
avidmx_process
gf_filter_process_task
gf_fs_thread_proc
gf_fs_run
gf_dasher_process


Additionally, the MP4Box application is also affected, as it relies on the vulnerable GPAC library functions.

=================================================================
==2451508==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x625000018bc6 at pc 0x7f6d287b3397 bp 0x7ffffa4cad80 sp 0x7ffffa4ca528
READ of size 352321536 at 0x625000018bc6 thread T0
#0 0x7f6d287b3396 in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827
#1 0x7f6d254d3e44 in avi_parse_input_file (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2538e44)
#2 0x7f6d254e049d in AVI_open_input_file (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x254549d)
#3 0x7f6d25bdd260 in avidmx_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2c42260)
#4 0x7f6d25ad997c in gf_filter_process_task (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b3e97c)
#5 0x7f6d25a9500a in gf_fs_thread_proc (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2afa00a)
#6 0x7f6d25aa292e in gf_fs_run (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b0792e)
#7 0x7f6d253130ce in gf_dasher_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x23780ce)
#8 0x556b6c48a338 in do_dash /root/gpac2/gpac/applications/mp4box/mp4box.c:4807
#9 0x556b6c48a338 in mp4box_main /root/gpac2/gpac/applications/mp4box/mp4box.c:6184
#10 0x7f6d22767d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#11 0x7f6d22767e3f in __libc_start_main_impl ../csu/libc-start.c:392
#12 0x556b6c460cb4 in _start (/root/gpac2/gpac/bin/gcc/MP4Box+0xabcb4)

0x625000018bc6 is located 0 bytes to the right of 8902-byte region [0x625000016900,0x625000018bc6)
allocated by thread T0 here:
#0 0x7f6d2882d867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x7f6d254d2716 in avi_parse_input_file (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2537716)
#2 0x7f6d254e049d in AVI_open_input_file (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x254549d)
#3 0x7f6d25bdd260 in avidmx_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2c42260)
#4 0x7f6d25ad997c in gf_filter_process_task (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b3e97c)
#5 0x7f6d25a9500a in gf_fs_thread_proc (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2afa00a)
#6 0x7f6d25aa292e in gf_fs_run (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b0792e)
#7 0x7f6d253130ce in gf_dasher_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x23780ce)
#8 0x556b6c48a338 in do_dash /root/gpac2/gpac/applications/mp4box/mp4box.c:4807
#9 0x556b6c48a338 in mp4box_main /root/gpac2/gpac/applications/mp4box/mp4box.c:6184
#10 0x7f6d22767d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827 in __interceptor_memcpy
Shadow bytes around the buggy address:
0x0c4a7fffb120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c4a7fffb130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c4a7fffb140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c4a7fffb150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c4a7fffb160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c4a7fffb170: 00 00 00 00 00 00 00 00[06]fa fa fa fa fa fa fa
0x0c4a7fffb180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c4a7fffb190: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c4a7fffb1a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c4a7fffb1b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c4a7fffb1c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable:           00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone:       fa
Freed heap region:       fd
Stack left redzone:      f1
Stack mid redzone:       f2
Stack right redzone:     f3
Stack after return:      f5
Stack use after scope:   f8
Global redzone:          f9
Global init order:       f6
Poisoned by user:        f7
Container overflow:      fc
Array cookie:            ac
Intra object redzone:    bb
ASan internal:           fe
Left alloca redzone:     ca
Right alloca redzone:    cb
Shadow gap:              cc
==2451508==ABORTING
```
eap buffer overflow vulnerability
This is a GitHub Issue
repo:gpac
owner:gpac
Title : eap buffer overflow vulnerability
Issue date:

--- start body ---
POC: ./MP4Box -dash 1000 POC6
LINK: https://drive.google.com/file/d/1_bgcSCPG1Wcft9ZcY6xlbeIyUW40SOJ3/view?usp=share_link

```
A heap buffer overflow vulnerability has been detected in the GPAC multimedia framework. The issue occurs during the processing of AVI input files, leading to a potential compromise of the application's memory and possible remote code execution.

The vulnerability is caused by an incorrect boundary check when copying memory using the memcpy function (__interceptor_memcpy). This results in a read operation of size 352,321,536 bytes at address 0x625000018bc6, which is located at the edge of the allocated memory region.

The overflow occurs within the following GPAC library functions:

avi_parse_input_file
AVI_open_input_file
avidmx_process
gf_filter_process_task
gf_fs_thread_proc
gf_fs_run
gf_dasher_process


Additionally, the MP4Box application is also affected, as it relies on the vulnerable GPAC library functions.

=================================================================
==2451508==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x625000018bc6 at pc 0x7f6d287b3397 bp 0x7ffffa4cad80 sp 0x7ffffa4ca528
READ of size 352321536 at 0x625000018bc6 thread T0
#0 0x7f6d287b3396 in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827
#1 0x7f6d254d3e44 in avi_parse_input_file (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2538e44)
#2 0x7f6d254e049d in AVI_open_input_file (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x254549d)
#3 0x7f6d25bdd260 in avidmx_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2c42260)
#4 0x7f6d25ad997c in gf_filter_process_task (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b3e97c)
#5 0x7f6d25a9500a in gf_fs_thread_proc (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2afa00a)
#6 0x7f6d25aa292e in gf_fs_run (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b0792e)
#7 0x7f6d253130ce in gf_dasher_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x23780ce)
#8 0x556b6c48a338 in do_dash /root/gpac2/gpac/applications/mp4box/mp4box.c:4807
#9 0x556b6c48a338 in mp4box_main /root/gpac2/gpac/applications/mp4box/mp4box.c:6184
#10 0x7f6d22767d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#11 0x7f6d22767e3f in __libc_start_main_impl ../csu/libc-start.c:392
#12 0x556b6c460cb4 in _start (/root/gpac2/gpac/bin/gcc/MP4Box+0xabcb4)

0x625000018bc6 is located 0 bytes to the right of 8902-byte region [0x625000016900,0x625000018bc6)
allocated by thread T0 here:
#0 0x7f6d2882d867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x7f6d254d2716 in avi_parse_input_file (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2537716)
#2 0x7f6d254e049d in AVI_open_input_file (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x254549d)
#3 0x7f6d25bdd260 in avidmx_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2c42260)
#4 0x7f6d25ad997c in gf_filter_process_task (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b3e97c)
#5 0x7f6d25a9500a in gf_fs_thread_proc (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2afa00a)
#6 0x7f6d25aa292e in gf_fs_run (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b0792e)
#7 0x7f6d253130ce in gf_dasher_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x23780ce)
#8 0x556b6c48a338 in do_dash /root/gpac2/gpac/applications/mp4box/mp4box.c:4807
#9 0x556b6c48a338 in mp4box_main /root/gpac2/gpac/applications/mp4box/mp4box.c:6184
#10 0x7f6d22767d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827 in __interceptor_memcpy
Shadow bytes around the buggy address:
0x0c4a7fffb120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c4a7fffb130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c4a7fffb140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c4a7fffb150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c4a7fffb160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c4a7fffb170: 00 00 00 00 00 00 00 00[06]fa fa fa fa fa fa fa
0x0c4a7fffb180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c4a7fffb190: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c4a7fffb1a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c4a7fffb1b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c4a7fffb1c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable:           00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone:       fa
Freed heap region:       fd
Stack left redzone:      f1
Stack mid redzone:       f2
Stack right redzone:     f3
Stack after return:      f5
Stack use after scope:   f8
Global redzone:          f9
Global init order:       f6
Poisoned by user:        f7
Container overflow:      fc
Array cookie:            ac
Intra object redzone:    bb
ASan internal:           fe
Left alloca redzone:     ca
Right alloca redzone:    cb
Shadow gap:              cc
==2451508==ABORTING
```
--- end body ---
