Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [x] I looked for a similar issue and couldn't find any.
- [x] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [x] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/


Hi GPAC Team,

I found a heap UAF bug in GPAC version 1.1.0-DEV-rev561-g2c13bbf42-master 

System info: Ubuntu 20.04.1 LTS, x64 , gcc 9.3.0 

### Compile Command:
```
$ CC="gcc -fsanitize=address -g" CXX="g++ -fsanitize=address -g" ./configure
$ make
```

### Run Command:
```
$ MP4Box -p poc.mp4 -out /dev/null
```
### poc file:
[poc.mp4.zip](https://github.com/gpac/gpac/files/6112348/poc.mp4.zip)




### gdb info:
```
Program received signal SIGSEGV, Segmentation fault.
__GI___libc_free (mem=0x10002) at malloc.c:3102
3102	malloc.c: No such file or directory.
(gdb) bt
#0  __GI___libc_free (mem=0x10002) at malloc.c:3102
#1  0x00007ffff6ffa551 in gf_list_del () from /home/topsec/Downloads/gpac/bin/gcc/libgpac.so.10
#2  0x00007ffff700a98d in gf_cfg_clear () from /home/topsec/Downloads/gpac/bin/gcc/libgpac.so.10
#3  0x00007ffff700aa38 in gf_cfg_new () from /home/topsec/Downloads/gpac/bin/gcc/libgpac.so.10
#4  0x00007ffff701b719 in gf_init_global_config () from /home/topsec/Downloads/gpac/bin/gcc/libgpac.so.10
#5  0x00007ffff6ff6d2a in gf_sys_init () from /home/topsec/Downloads/gpac/bin/gcc/libgpac.so.10
#6  0x0000000000422b0e in mp4boxMain (argc=3, argv=0x7fffffffe488) at main.c:5428
#7  0x00007ffff6d780b3 in __libc_start_main (main=0x4362a0 <main>, argc=3, argv=0x7fffffffe488, init=<optimized out>, 
    fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe478) at ../csu/libc-start.c:308
#8  0x000000000040e98e in _start ()

```

### ASAN info:
```
=================================================================
==42473==ERROR: AddressSanitizer: heap-use-after-free on address 0x603000000558 at pc 0x7f47c9fd6cc6 bp 0x7ffc04633140 sp 0x7ffc04633138
READ of size 8 at 0x603000000558 thread T0
    #0 0x7f47c9fd6cc5 in gf_cfg_clear /home/topsec/Downloads/gpac/src/utils/configfile.c:76:15
    #1 0x7f47c9fd6e35 in gf_cfg_new /home/topsec/Downloads/gpac/src/utils/configfile.c:282:3
    #2 0x7f47ca03d1bd in gf_cfg_init /home/topsec/Downloads/gpac/src/utils/os_config_init.c:902:9
    #3 0x7f47ca03d1bd in gf_init_global_config /home/topsec/Downloads/gpac/src/utils/os_config_init.c:1004:24
    #4 0x7f47c9f7935e in gf_sys_init /home/topsec/Downloads/gpac/src/utils/os_divers.c:1348:3
    #5 0x4e9319 in mp4boxMain /home/topsec/Downloads/gpac/applications/mp4box/main.c:5428:2
    #6 0x7f47c98230b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
    #7 0x4289ed in _start (/home/topsec/Downloads/gpac/afl_build/bin/gcc/MP4Box+0x4289ed)

0x603000000558 is located 8 bytes inside of 24-byte region [0x603000000550,0x603000000568)
freed by thread T0 here:
    #0 0x4a0ead in free (/home/topsec/Downloads/gpac/afl_build/bin/gcc/MP4Box+0x4a0ead)
    #1 0x7f47c9fd6895 in gf_cfg_parse_config_file /home/topsec/Downloads/gpac/src/utils/configfile.c:198:5
    #2 0x7f47c9fd6e29 in gf_cfg_new /home/topsec/Downloads/gpac/src/utils/configfile.c:281:6
    #3 0x7f47c9f7935e in gf_sys_init /home/topsec/Downloads/gpac/src/utils/os_divers.c:1348:3
    #4 0x4e9319 in mp4boxMain /home/topsec/Downloads/gpac/applications/mp4box/main.c:5428:2
    #5 0x7f47c98230b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16

previously allocated by thread T0 here:
    #0 0x4a112d in malloc (/home/topsec/Downloads/gpac/afl_build/bin/gcc/MP4Box+0x4a112d)
    #1 0x7f47c9fd6daf in gf_cfg_new /home/topsec/Downloads/gpac/src/utils/configfile.c:274:32
    #2 0x7f47c9f7935e in gf_sys_init /home/topsec/Downloads/gpac/src/utils/os_divers.c:1348:3
    #3 0x4e9319 in mp4boxMain /home/topsec/Downloads/gpac/applications/mp4box/main.c:5428:2
    #4 0x7f47c98230b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-use-after-free /home/topsec/Downloads/gpac/src/utils/configfile.c:76:15 in gf_cfg_clear
Shadow bytes around the buggy address:
  0x0c067fff8050: 00 00 06 fa fa fa 00 00 00 02 fa fa 00 00 05 fa
  0x0c067fff8060: fa fa 00 00 02 fa fa fa 00 00 05 fa fa fa 00 00
  0x0c067fff8070: 04 fa fa fa 00 00 00 01 fa fa 00 00 06 fa fa fa
  0x0c067fff8080: 00 00 01 fa fa fa 00 00 02 fa fa fa 00 00 00 01
  0x0c067fff8090: fa fa 00 00 05 fa fa fa 00 00 04 fa fa fa 00 00
=>0x0c067fff80a0: 02 fa fa fa 00 00 00 03 fa fa fd[fd]fd fa fa fa
  0x0c067fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff80e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==42473==ABORTING

```
heap-use-after-free utils/configfile.c:76:15 in gf_cfg_clear
This is a GitHub Issue
repo:gpac
owner:gpac
Title : heap-use-after-free utils/configfile.c:76:15 in gf_cfg_clear
Issue date:

--- start body ---
Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [x] I looked for a similar issue and couldn't find any.
- [x] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [x] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/


Hi GPAC Team,

I found a heap UAF bug in GPAC version 1.1.0-DEV-rev561-g2c13bbf42-master 

System info: Ubuntu 20.04.1 LTS, x64 , gcc 9.3.0 

### Compile Command:
```
$ CC="gcc -fsanitize=address -g" CXX="g++ -fsanitize=address -g" ./configure
$ make
```

### Run Command:
```
$ MP4Box -p poc.mp4 -out /dev/null
```
### poc file:
[poc.mp4.zip](https://github.com/gpac/gpac/files/6112348/poc.mp4.zip)




### gdb info:
```
Program received signal SIGSEGV, Segmentation fault.
__GI___libc_free (mem=0x10002) at malloc.c:3102
3102	malloc.c: No such file or directory.
(gdb) bt
#0  __GI___libc_free (mem=0x10002) at malloc.c:3102
#1  0x00007ffff6ffa551 in gf_list_del () from /home/topsec/Downloads/gpac/bin/gcc/libgpac.so.10
#2  0x00007ffff700a98d in gf_cfg_clear () from /home/topsec/Downloads/gpac/bin/gcc/libgpac.so.10
#3  0x00007ffff700aa38 in gf_cfg_new () from /home/topsec/Downloads/gpac/bin/gcc/libgpac.so.10
#4  0x00007ffff701b719 in gf_init_global_config () from /home/topsec/Downloads/gpac/bin/gcc/libgpac.so.10
#5  0x00007ffff6ff6d2a in gf_sys_init () from /home/topsec/Downloads/gpac/bin/gcc/libgpac.so.10
#6  0x0000000000422b0e in mp4boxMain (argc=3, argv=0x7fffffffe488) at main.c:5428
#7  0x00007ffff6d780b3 in __libc_start_main (main=0x4362a0 <main>, argc=3, argv=0x7fffffffe488, init=<optimized out>, 
    fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe478) at ../csu/libc-start.c:308
#8  0x000000000040e98e in _start ()

```

### ASAN info:
```
=================================================================
==42473==ERROR: AddressSanitizer: heap-use-after-free on address 0x603000000558 at pc 0x7f47c9fd6cc6 bp 0x7ffc04633140 sp 0x7ffc04633138
READ of size 8 at 0x603000000558 thread T0
    #0 0x7f47c9fd6cc5 in gf_cfg_clear /home/topsec/Downloads/gpac/src/utils/configfile.c:76:15
    #1 0x7f47c9fd6e35 in gf_cfg_new /home/topsec/Downloads/gpac/src/utils/configfile.c:282:3
    #2 0x7f47ca03d1bd in gf_cfg_init /home/topsec/Downloads/gpac/src/utils/os_config_init.c:902:9
    #3 0x7f47ca03d1bd in gf_init_global_config /home/topsec/Downloads/gpac/src/utils/os_config_init.c:1004:24
    #4 0x7f47c9f7935e in gf_sys_init /home/topsec/Downloads/gpac/src/utils/os_divers.c:1348:3
    #5 0x4e9319 in mp4boxMain /home/topsec/Downloads/gpac/applications/mp4box/main.c:5428:2
    #6 0x7f47c98230b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
    #7 0x4289ed in _start (/home/topsec/Downloads/gpac/afl_build/bin/gcc/MP4Box+0x4289ed)

0x603000000558 is located 8 bytes inside of 24-byte region [0x603000000550,0x603000000568)
freed by thread T0 here:
    #0 0x4a0ead in free (/home/topsec/Downloads/gpac/afl_build/bin/gcc/MP4Box+0x4a0ead)
    #1 0x7f47c9fd6895 in gf_cfg_parse_config_file /home/topsec/Downloads/gpac/src/utils/configfile.c:198:5
    #2 0x7f47c9fd6e29 in gf_cfg_new /home/topsec/Downloads/gpac/src/utils/configfile.c:281:6
    #3 0x7f47c9f7935e in gf_sys_init /home/topsec/Downloads/gpac/src/utils/os_divers.c:1348:3
    #4 0x4e9319 in mp4boxMain /home/topsec/Downloads/gpac/applications/mp4box/main.c:5428:2
    #5 0x7f47c98230b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16

previously allocated by thread T0 here:
    #0 0x4a112d in malloc (/home/topsec/Downloads/gpac/afl_build/bin/gcc/MP4Box+0x4a112d)
    #1 0x7f47c9fd6daf in gf_cfg_new /home/topsec/Downloads/gpac/src/utils/configfile.c:274:32
    #2 0x7f47c9f7935e in gf_sys_init /home/topsec/Downloads/gpac/src/utils/os_divers.c:1348:3
    #3 0x4e9319 in mp4boxMain /home/topsec/Downloads/gpac/applications/mp4box/main.c:5428:2
    #4 0x7f47c98230b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-use-after-free /home/topsec/Downloads/gpac/src/utils/configfile.c:76:15 in gf_cfg_clear
Shadow bytes around the buggy address:
  0x0c067fff8050: 00 00 06 fa fa fa 00 00 00 02 fa fa 00 00 05 fa
  0x0c067fff8060: fa fa 00 00 02 fa fa fa 00 00 05 fa fa fa 00 00
  0x0c067fff8070: 04 fa fa fa 00 00 00 01 fa fa 00 00 06 fa fa fa
  0x0c067fff8080: 00 00 01 fa fa fa 00 00 02 fa fa fa 00 00 00 01
  0x0c067fff8090: fa fa 00 00 05 fa fa fa 00 00 04 fa fa fa 00 00
=>0x0c067fff80a0: 02 fa fa fa 00 00 00 03 fa fa fd[fd]fd fa fa fa
  0x0c067fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff80e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==42473==ABORTING

```
--- end body ---
