Hello,
A heap-buffer-overflow has occurred when running program MP4Box,this can reproduce on the lattest commit.
System info：
Ubuntu 20.04.1 : clang 10.0.0 , gcc 9.3.0



[poc (2).zip](https://github.com/gpac/gpac/files/6768309/poc.2.zip)






Verification steps：
1.Get the source code of gpac
2.Compile 

```
cd gpac-master
CC=gcc CXX=g++ CFLAGS="-fsanitize=address" CXXFLAGS="-fsanitize=address" ./configure
make
``` 
3.run MP4Box

```
./MP4Box -hint poc -out /dev/null
```

asan info

```
=================================================================
==1181205==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000001a10 at pc 0x7fe374470ab9 bp 0x7ffc088fb3a0 sp 0x7ffc088fb390
READ of size 2 at 0x602000001a10 thread T0
    #0 0x7fe374470ab8 in gp_rtp_builder_do_tx3g ietf/rtp_pck_3gpp.c:581
    #1 0x7fe374d2848a in gf_hinter_track_process media_tools/isom_hinter.c:808
    #2 0x5562fc957e2b in HintFile /home/dh/.../gpac/gpac-master/applications/mp4box/main.c:3499
    #3 0x5562fc96ed54 in mp4boxMain /home/dh/.../gpac/gpac-master/applications/mp4box/main.c:6297
    #4 0x7fe3739600b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #5 0x5562fc921f1d in _start (/home/dh/.../gpac/gpac-master/bin/gcc/MP4Box+0x48f1d)

0x602000001a11 is located 0 bytes to the right of 1-byte region [0x602000001a10,0x602000001a11)
allocated by thread T0 here:
    #0 0x7fe37683ebc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
    #1 0x7fe3748646cd in Media_GetSample isomedia/media.c:617

SUMMARY: AddressSanitizer: heap-buffer-overflow ietf/rtp_pck_3gpp.c:581 in gp_rtp_builder_do_tx3g
Shadow bytes around the buggy address:
  0x0c047fff82f0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c047fff8300: fa fa fd fa fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8310: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8320: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8330: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
=>0x0c047fff8340: fa fa[01]fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8350: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8360: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8370: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8390: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==1181205==ABORTING
```

source code
```
567		if (cur_frag==nb_frag) {
568			builder->rtp_header.Marker = 1;
569			builder->OnPacketDone(builder->cbk_obj, &builder->rtp_header);
570			builder->bytesInPacket = 0;
571		} else {
572			builder->rtp_header.Marker = 0;
573			builder->OnPacketDone(builder->cbk_obj, &builder->rtp_header);
574			builder->rtp_header.SequenceNumber += 1;
575			builder->OnNewPacket(builder->cbk_obj, &builder->rtp_header);
576			builder->bytesInPacket = 0;
577		}
578		txt_done += size;
579	}
580	return GF_OK;
581}
```







heap-buffer-overflow in rtp_pck_3gpp.c
This is a GitHub Issue
repo:gpac
owner:gpac
Title : heap-buffer-overflow in rtp_pck_3gpp.c
Issue date:

--- start body ---
Hello,
A heap-buffer-overflow has occurred when running program MP4Box,this can reproduce on the lattest commit.
System info：
Ubuntu 20.04.1 : clang 10.0.0 , gcc 9.3.0



[poc (2).zip](https://github.com/gpac/gpac/files/6768309/poc.2.zip)






Verification steps：
1.Get the source code of gpac
2.Compile 

```
cd gpac-master
CC=gcc CXX=g++ CFLAGS="-fsanitize=address" CXXFLAGS="-fsanitize=address" ./configure
make
``` 
3.run MP4Box

```
./MP4Box -hint poc -out /dev/null
```

asan info

```
=================================================================
==1181205==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000001a10 at pc 0x7fe374470ab9 bp 0x7ffc088fb3a0 sp 0x7ffc088fb390
READ of size 2 at 0x602000001a10 thread T0
    #0 0x7fe374470ab8 in gp_rtp_builder_do_tx3g ietf/rtp_pck_3gpp.c:581
    #1 0x7fe374d2848a in gf_hinter_track_process media_tools/isom_hinter.c:808
    #2 0x5562fc957e2b in HintFile /home/dh/.../gpac/gpac-master/applications/mp4box/main.c:3499
    #3 0x5562fc96ed54 in mp4boxMain /home/dh/.../gpac/gpac-master/applications/mp4box/main.c:6297
    #4 0x7fe3739600b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #5 0x5562fc921f1d in _start (/home/dh/.../gpac/gpac-master/bin/gcc/MP4Box+0x48f1d)

0x602000001a11 is located 0 bytes to the right of 1-byte region [0x602000001a10,0x602000001a11)
allocated by thread T0 here:
    #0 0x7fe37683ebc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
    #1 0x7fe3748646cd in Media_GetSample isomedia/media.c:617

SUMMARY: AddressSanitizer: heap-buffer-overflow ietf/rtp_pck_3gpp.c:581 in gp_rtp_builder_do_tx3g
Shadow bytes around the buggy address:
  0x0c047fff82f0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c047fff8300: fa fa fd fa fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8310: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8320: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8330: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
=>0x0c047fff8340: fa fa[01]fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8350: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8360: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8370: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8390: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==1181205==ABORTING
```

source code
```
567		if (cur_frag==nb_frag) {
568			builder->rtp_header.Marker = 1;
569			builder->OnPacketDone(builder->cbk_obj, &builder->rtp_header);
570			builder->bytesInPacket = 0;
571		} else {
572			builder->rtp_header.Marker = 0;
573			builder->OnPacketDone(builder->cbk_obj, &builder->rtp_header);
574			builder->rtp_header.SequenceNumber += 1;
575			builder->OnNewPacket(builder->cbk_obj, &builder->rtp_header);
576			builder->bytesInPacket = 0;
577		}
578		txt_done += size;
579	}
580	return GF_OK;
581}
```







--- end body ---
