An issue was discovered in gpac 0.8.0. The strdup function in box_code_base.c has a heap-based buffer over-read.
cpe:2.3:a:gpac:gpac:0.8.0:*:*:*:*:*:*:*
93EEFCFD-7417-40E6-84BF-4EA630F2A8A1
OR
Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [ ] I looked for a similar issue and couldn't find any.
- [ ] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [ ] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/

in box_code_base.c [line 8637](https://github.com/gpac/gpac/blob/86d072b6a13baa1a4a90168098a0f8354c24d8cf/src/isomedia/box_code_base.c#L8637) has a heap overflow.
```c
GF_Err txtc_Read(GF_Box *s, GF_BitStream *bs)
{
	u32 size, i;
	char *str;
	GF_TextConfigBox *ptr = (GF_TextConfigBox*)s;

	size = (u32) ptr->size;
	str = (char *)gf_malloc(sizeof(char)*size);

	i=0;

	while (size) {
		str[i] = gf_bs_read_u8(bs);
		size--;
		if (!str[i])
			break;
		i++;
	}
	if (i) ptr->config = gf_strdup(str);
	gf_free(str);

	return GF_OK;
}
```
When str is full without '\x00', strdup will make a heap overflow.

in box_code_base.c line 8637 has a heap overflow
This is a GitHub Issue
repo:gpac
owner:gpac
Title : in box_code_base.c line 8637 has a heap overflow
Issue date:

--- start body ---
Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [ ] I looked for a similar issue and couldn't find any.
- [ ] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [ ] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/

in box_code_base.c [line 8637](https://github.com/gpac/gpac/blob/86d072b6a13baa1a4a90168098a0f8354c24d8cf/src/isomedia/box_code_base.c#L8637) has a heap overflow.
```c
GF_Err txtc_Read(GF_Box *s, GF_BitStream *bs)
{
	u32 size, i;
	char *str;
	GF_TextConfigBox *ptr = (GF_TextConfigBox*)s;

	size = (u32) ptr->size;
	str = (char *)gf_malloc(sizeof(char)*size);

	i=0;

	while (size) {
		str[i] = gf_bs_read_u8(bs);
		size--;
		if (!str[i])
			break;
		i++;
	}
	if (i) ptr->config = gf_strdup(str);
	gf_free(str);

	return GF_OK;
}
```
When str is full without '\x00', strdup will make a heap overflow.

--- end body ---

comments :
--- start comments ---

--- end comments ---