An invalid free vulnerability exists in gpac 1.1.0 via the gf_sg_command_del function, which causes a segmentation fault and application crash.
cpe:2.3:a:gpac:gpac:1.1.0:dev:*:*:*:*:*:*
A713E8C4-E079-4ECB-AF9C-DC0EC80D089D
OR
Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [x] I looked for a similar issue and couldn't find any.
- [x] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [x] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/

An invalid free was discovered in gf_sg_command_del(). The vulnerability causes a segmentation fault and application crash.

**Version:**

```
MP4Box - GPAC version 1.1.0-DEV-revUNKNOWN_REV
(c) 2000-2021 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
        GPAC Filters: https://doi.org/10.1145/3339825.3394929
        GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration:
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_JPEG GPAC_HAS_PNG GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D
```
**System information**
Ubuntu 20.04 focal, AMD EPYC 7742 64-Core @ 16x 2.25GHz

**command:**

```
./MP4Box -bt ./poc/poc_17
```
[poc_17.zip](https://github.com/gpac/gpac/files/7696726/poc_17.zip)

**Result**

```
[iso file] extra box maxr found in hinf, deleting
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type 80rak in parent moov
[iso file] Unknown box type prl  in parent dref
[iso file] Incomplete box mdat - start 11495 size 860323
[iso file] Incomplete file while reading for dump - aborting parsing
[iso file] extra box maxr found in hinf, deleting
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type 80rak in parent moov
[iso file] Unknown box type prl  in parent dref
[iso file] Incomplete box mdat - start 11495 size 860323
[iso file] Incomplete file while reading for dump - aborting parsing
MPEG-4 LASeR Scene Parsing
[LASeR] memory overread - corrupted decoding
[LASeR] memory overread - corrupted decoding
[MP4 Loading] decoding sample 1 from track ID 8 failed
free(): invalid pointer
[1]    3334251 abort      ./MP4Box -bt ./poc/poc_17
```

**gdb**

```
free(): invalid pointer

Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50      ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
───────────────────────────────[ REGISTERS ]────────────────────────────────
 RAX  0x0
 RBX  0x7ffff72bf040 ◂— 0x7ffff72bf040
 RCX  0x7ffff758218b (raise+203) ◂— mov    rax, qword ptr [rsp + 0x108]
 RDX  0x0
 RDI  0x2
 RSI  0x7fffffff6f20 ◂— 0x0
 R8   0x0
 R9   0x7fffffff6f20 ◂— 0x0
 R10  0x8
 R11  0x246
 R12  0x7fffffff7190 ◂— 0x0
 R13  0x10
 R14  0x7ffff7ffb000 ◂— 0x6565726600001000
 R15  0x1
 RBP  0x7fffffff7270 —▸ 0x5555555df1e0 —▸ 0x5555555d4370 ◂— 0x0
 RSP  0x7fffffff6f20 ◂— 0x0
 RIP  0x7ffff758218b (raise+203) ◂— mov    rax, qword ptr [rsp + 0x108]
───────────────────────────────────────[ DISASM ]────────────────────────────────────────
 ► 0x7ffff758218b <raise+203>    mov    rax, qword ptr [rsp + 0x108]
   0x7ffff7582193 <raise+211>    xor    rax, qword ptr fs:[0x28]
   0x7ffff758219c <raise+220>    jne    raise+260                <raise+260>
    ↓
   0x7ffff75821c4 <raise+260>    call   __stack_chk_fail                <__stack_chk_fail>

   0x7ffff75821c9                nop    dword ptr [rax]
   0x7ffff75821d0 <killpg>       endbr64
   0x7ffff75821d4 <killpg+4>     test   edi, edi
   0x7ffff75821d6 <killpg+6>     js     killpg+16                <killpg+16>

   0x7ffff75821d8 <killpg+8>     neg    edi
   0x7ffff75821da <killpg+10>    jmp    kill                <kill>

   0x7ffff75821df <killpg+15>    nop
────────────────────────────────────────[ STACK ]────────────────────────────────────────
00:0000│ rsi r9 rsp 0x7fffffff6f20 ◂— 0x0
01:0008│            0x7fffffff6f28 —▸ 0x7ffff77534c8 ◂— 0xe001200003748 /* 'H7' */
02:0010│            0x7fffffff6f30 —▸ 0x7fffffff72f0 —▸ 0x5555555d47a0 —▸ 0x5555555d4370 ◂— 0x0
03:0018│            0x7fffffff6f38 —▸ 0x7ffff7fe7c2e ◂— mov    r11, rax
04:0020│            0x7fffffff6f40 ◂— 0x0
05:0028│            0x7fffffff6f48 ◂— 0x0
06:0030│            0x7fffffff6f50 —▸ 0x5555555df390 —▸ 0x5555555df3f0 —▸ 0x5555555df0f0 ◂— 0x0
07:0038│            0x7fffffff6f58 ◂— 0x0
──────────────────────────────────────[ BACKTRACE ]──────────────────────────────────────
 ► f 0   0x7ffff758218b raise+203
   f 1   0x7ffff7561859 abort+299
   f 2   0x7ffff75cc3ee __libc_message+670
   f 3   0x7ffff75d447c
   f 4   0x7ffff75d5cac _int_free+748
   f 5   0x7ffff784f461 gf_sg_command_del+353
   f 6   0x7ffff7a88203 gf_sm_del+195
   f 7   0x555555584423 dump_isom_scene+627
─────────────────────────────────────────────────────────────────────────────────────────
```

`break gf_svg_delete_attribute_value`

```
pwndbg>
0x00007ffff784f45c in gf_sg_command_del () from /root/fuckit/test/gpac1210/bin/gcc/libgpac.so.10
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
───────────────────────────────[ REGISTERS ]────────────────────────────────
 RAX  0x0
 RBX  0x0
 RCX  0x5555555df310 ◂— 0x0
*RDX  0x5555555d4370 ◂— 0x0
 RDI  0x0
 RSI  0x5555555df300 ◂— 0x0
 R8   0x2
 R9   0xfffffff6
 R10  0x7ffff775ba72 ◂— 'gf_node_unregister_children'
 R11  0x7ffff784a6d0 (gf_node_unregister_children) ◂— endbr64
 R12  0x5555555df2e0 ◂— 0x0
 R13  0x5555555d47a0 —▸ 0x5555555d4370 ◂— 0x0
 R14  0x5555555d4370 ◂— 0x0
 R15  0x0
 RBP  0x5555555df1e0 —▸ 0x5555555d4370 ◂— 0x0
 RSP  0x7fffffff7310 ◂— 0x1
*RIP  0x7ffff784f45c (gf_sg_command_del+348) ◂— call   0x7ffff78c7fb0
───────────────────────────────────────[ DISASM ]────────────────────────────────────────
   0x7ffff784f449 <gf_sg_command_del+329>    mov    rsi, qword ptr [r12 + 8]
   0x7ffff784f44e <gf_sg_command_del+334>    test   rsi, rsi
   0x7ffff784f451 <gf_sg_command_del+337>    je     gf_sg_command_del+255
<gf_sg_command_del+255>

   0x7ffff784f453 <gf_sg_command_del+339>    mov    edi, dword ptr [r12 + 4]
   0x7ffff784f458 <gf_sg_command_del+344>    mov    rdx, qword ptr [rbp]
 ► 0x7ffff784f45c <gf_sg_command_del+348>    call   gf_svg_delete_attribute_value                <gf_svg_delete_attribute_value>
        rdi: 0x0
        rsi: 0x5555555df300 ◂— 0x0
        rdx: 0x5555555d4370 ◂— 0x0
        rcx: 0x5555555df310 ◂— 0x0

   0x7ffff784f461 <gf_sg_command_del+353>    jmp    gf_sg_command_del+255
<gf_sg_command_del+255>

   0x7ffff784f463 <gf_sg_command_del+355>    nop    dword ptr [rax + rax]
   0x7ffff784f468 <gf_sg_command_del+360>    mov    rdi, qword ptr [r12 + 8]
   0x7ffff784f46d <gf_sg_command_del+365>    test   rdi, rdi
   0x7ffff784f470 <gf_sg_command_del+368>    je     gf_sg_command_del+384
<gf_sg_command_del+384>
────────────────────────────────────────[ STACK ]────────────────────────────────────────
00:0000│ rsp 0x7fffffff7310 ◂— 0x1
01:0008│     0x7fffffff7318 ◂— 0x5cf4ff747866de00
02:0010│     0x7fffffff7320 —▸ 0x7fffffff7340 —▸ 0x5555555df1e0 —▸ 0x5555555d4370 ◂— 0x0
03:0018│     0x7fffffff7328 —▸ 0x5555555defe0 ◂— 0x8
04:0020│     0x7fffffff7330 —▸ 0x5555555df130 ◂— 0x0
05:0028│     0x7fffffff7338 —▸ 0x7ffff7a88203 (gf_sm_del+195) ◂— jmp    0x7ffff7a881c8
06:0030│     0x7fffffff7340 —▸ 0x5555555df1e0 —▸ 0x5555555d4370 ◂— 0x0
07:0038│     0x7fffffff7348 ◂— 0x5cf4ff747866de00
──────────────────────────────────────[ BACKTRACE ]──────────────────────────────────────
 ► f 0   0x7ffff784f45c gf_sg_command_del+348
   f 1   0x7ffff7a88203 gf_sm_del+195
   f 2   0x555555584423 dump_isom_scene+627
   f 3   0x55555557b42c mp4boxMain+9228
   f 4   0x7ffff75630b3 __libc_start_main+243
─────────────────────────────────────────────────────────────────────────────────────────
pwndbg>
free(): invalid pointer

Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50      ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
───────────────────────────────[ REGISTERS ]────────────────────────────────
 RAX  0x0
*RBX  0x7ffff72bf040 ◂— 0x7ffff72bf040
*RCX  0x7ffff758218b (raise+203) ◂— mov    rax, qword ptr [rsp + 0x108]
*RDX  0x0
*RDI  0x2
*RSI  0x7fffffff6f20 ◂— 0x0
*R8   0x0
*R9   0x7fffffff6f20 ◂— 0x0
*R10  0x8
*R11  0x246
*R12  0x7fffffff7190 ◂— 0x0
*R13  0x10
*R14  0x7ffff7ffb000 ◂— 0x6565726600001000
*R15  0x1
*RBP  0x7fffffff7270 —▸ 0x5555555df1e0 —▸ 0x5555555d4370 ◂— 0x0
*RSP  0x7fffffff6f20 ◂— 0x0
*RIP  0x7ffff758218b (raise+203) ◂— mov    rax, qword ptr [rsp + 0x108]
───────────────────────────────────────[ DISASM ]────────────────────────────────────────
 ► 0x7ffff758218b <raise+203>    mov    rax, qword ptr [rsp + 0x108]
   0x7ffff7582193 <raise+211>    xor    rax, qword ptr fs:[0x28]
   0x7ffff758219c <raise+220>    jne    raise+260                <raise+260>
    ↓
   0x7ffff75821c4 <raise+260>    call   __stack_chk_fail                <__stack_chk_fail>

   0x7ffff75821c9                nop    dword ptr [rax]
   0x7ffff75821d0 <killpg>       endbr64
   0x7ffff75821d4 <killpg+4>     test   edi, edi
   0x7ffff75821d6 <killpg+6>     js     killpg+16                <killpg+16>

   0x7ffff75821d8 <killpg+8>     neg    edi
   0x7ffff75821da <killpg+10>    jmp    kill                <kill>

   0x7ffff75821df <killpg+15>    nop
────────────────────────────────────────[ STACK ]────────────────────────────────────────
00:0000│ rsi r9 rsp 0x7fffffff6f20 ◂— 0x0
01:0008│            0x7fffffff6f28 —▸ 0x7ffff77534c8 ◂— 0xe001200003748 /* 'H7' */
02:0010│            0x7fffffff6f30 —▸ 0x7fffffff72f0 —▸ 0x5555555d47a0 —▸ 0x5555555d4370 ◂— 0x0
03:0018│            0x7fffffff6f38 —▸ 0x7ffff7fe7c2e ◂— mov    r11, rax
04:0020│            0x7fffffff6f40 ◂— 0x0
05:0028│            0x7fffffff6f48 ◂— 0x0
06:0030│            0x7fffffff6f50 —▸ 0x5555555df390 —▸ 0x5555555df3f0 —▸ 0x5555555df0f0 ◂— 0x0
07:0038│            0x7fffffff6f58 ◂— 0x0
──────────────────────────────────────[ BACKTRACE ]──────────────────────────────────────
 ► f 0   0x7ffff758218b raise+203
   f 1   0x7ffff7561859 abort+299
   f 2   0x7ffff75cc3ee __libc_message+670
   f 3   0x7ffff75d447c
   f 4   0x7ffff75d5cac _int_free+748
   f 5   0x7ffff784f461 gf_sg_command_del+353
   f 6   0x7ffff7a88203 gf_sm_del+195
   f 7   0x555555584423 dump_isom_scene+627
```


Invalid free in gf_sg_command_del()
This is a GitHub Issue
repo:gpac
owner:gpac
Title : Invalid free in gf_sg_command_del()
Issue date:

--- start body ---
Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [x] I looked for a similar issue and couldn't find any.
- [x] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [x] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/

An invalid free was discovered in gf_sg_command_del(). The vulnerability causes a segmentation fault and application crash.

**Version:**

```
MP4Box - GPAC version 1.1.0-DEV-revUNKNOWN_REV
(c) 2000-2021 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
        GPAC Filters: https://doi.org/10.1145/3339825.3394929
        GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration:
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_JPEG GPAC_HAS_PNG GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D
```
**System information**
Ubuntu 20.04 focal, AMD EPYC 7742 64-Core @ 16x 2.25GHz

**command:**

```
./MP4Box -bt ./poc/poc_17
```
[poc_17.zip](https://github.com/gpac/gpac/files/7696726/poc_17.zip)

**Result**

```
[iso file] extra box maxr found in hinf, deleting
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type 80rak in parent moov
[iso file] Unknown box type prl  in parent dref
[iso file] Incomplete box mdat - start 11495 size 860323
[iso file] Incomplete file while reading for dump - aborting parsing
[iso file] extra box maxr found in hinf, deleting
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type 80rak in parent moov
[iso file] Unknown box type prl  in parent dref
[iso file] Incomplete box mdat - start 11495 size 860323
[iso file] Incomplete file while reading for dump - aborting parsing
MPEG-4 LASeR Scene Parsing
[LASeR] memory overread - corrupted decoding
[LASeR] memory overread - corrupted decoding
[MP4 Loading] decoding sample 1 from track ID 8 failed
free(): invalid pointer
[1]    3334251 abort      ./MP4Box -bt ./poc/poc_17
```

**gdb**

```
free(): invalid pointer

Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50      ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
───────────────────────────────[ REGISTERS ]────────────────────────────────
 RAX  0x0
 RBX  0x7ffff72bf040 ◂— 0x7ffff72bf040
 RCX  0x7ffff758218b (raise+203) ◂— mov    rax, qword ptr [rsp + 0x108]
 RDX  0x0
 RDI  0x2
 RSI  0x7fffffff6f20 ◂— 0x0
 R8   0x0
 R9   0x7fffffff6f20 ◂— 0x0
 R10  0x8
 R11  0x246
 R12  0x7fffffff7190 ◂— 0x0
 R13  0x10
 R14  0x7ffff7ffb000 ◂— 0x6565726600001000
 R15  0x1
 RBP  0x7fffffff7270 —▸ 0x5555555df1e0 —▸ 0x5555555d4370 ◂— 0x0
 RSP  0x7fffffff6f20 ◂— 0x0
 RIP  0x7ffff758218b (raise+203) ◂— mov    rax, qword ptr [rsp + 0x108]
───────────────────────────────────────[ DISASM ]────────────────────────────────────────
 ► 0x7ffff758218b <raise+203>    mov    rax, qword ptr [rsp + 0x108]
   0x7ffff7582193 <raise+211>    xor    rax, qword ptr fs:[0x28]
   0x7ffff758219c <raise+220>    jne    raise+260                <raise+260>
    ↓
   0x7ffff75821c4 <raise+260>    call   __stack_chk_fail                <__stack_chk_fail>

   0x7ffff75821c9                nop    dword ptr [rax]
   0x7ffff75821d0 <killpg>       endbr64
   0x7ffff75821d4 <killpg+4>     test   edi, edi
   0x7ffff75821d6 <killpg+6>     js     killpg+16                <killpg+16>

   0x7ffff75821d8 <killpg+8>     neg    edi
   0x7ffff75821da <killpg+10>    jmp    kill                <kill>

   0x7ffff75821df <killpg+15>    nop
────────────────────────────────────────[ STACK ]────────────────────────────────────────
00:0000│ rsi r9 rsp 0x7fffffff6f20 ◂— 0x0
01:0008│            0x7fffffff6f28 —▸ 0x7ffff77534c8 ◂— 0xe001200003748 /* 'H7' */
02:0010│            0x7fffffff6f30 —▸ 0x7fffffff72f0 —▸ 0x5555555d47a0 —▸ 0x5555555d4370 ◂— 0x0
03:0018│            0x7fffffff6f38 —▸ 0x7ffff7fe7c2e ◂— mov    r11, rax
04:0020│            0x7fffffff6f40 ◂— 0x0
05:0028│            0x7fffffff6f48 ◂— 0x0
06:0030│            0x7fffffff6f50 —▸ 0x5555555df390 —▸ 0x5555555df3f0 —▸ 0x5555555df0f0 ◂— 0x0
07:0038│            0x7fffffff6f58 ◂— 0x0
──────────────────────────────────────[ BACKTRACE ]──────────────────────────────────────
 ► f 0   0x7ffff758218b raise+203
   f 1   0x7ffff7561859 abort+299
   f 2   0x7ffff75cc3ee __libc_message+670
   f 3   0x7ffff75d447c
   f 4   0x7ffff75d5cac _int_free+748
   f 5   0x7ffff784f461 gf_sg_command_del+353
   f 6   0x7ffff7a88203 gf_sm_del+195
   f 7   0x555555584423 dump_isom_scene+627
─────────────────────────────────────────────────────────────────────────────────────────
```

`break gf_svg_delete_attribute_value`

```
pwndbg>
0x00007ffff784f45c in gf_sg_command_del () from /root/fuckit/test/gpac1210/bin/gcc/libgpac.so.10
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
───────────────────────────────[ REGISTERS ]────────────────────────────────
 RAX  0x0
 RBX  0x0
 RCX  0x5555555df310 ◂— 0x0
*RDX  0x5555555d4370 ◂— 0x0
 RDI  0x0
 RSI  0x5555555df300 ◂— 0x0
 R8   0x2
 R9   0xfffffff6
 R10  0x7ffff775ba72 ◂— 'gf_node_unregister_children'
 R11  0x7ffff784a6d0 (gf_node_unregister_children) ◂— endbr64
 R12  0x5555555df2e0 ◂— 0x0
 R13  0x5555555d47a0 —▸ 0x5555555d4370 ◂— 0x0
 R14  0x5555555d4370 ◂— 0x0
 R15  0x0
 RBP  0x5555555df1e0 —▸ 0x5555555d4370 ◂— 0x0
 RSP  0x7fffffff7310 ◂— 0x1
*RIP  0x7ffff784f45c (gf_sg_command_del+348) ◂— call   0x7ffff78c7fb0
───────────────────────────────────────[ DISASM ]────────────────────────────────────────
   0x7ffff784f449 <gf_sg_command_del+329>    mov    rsi, qword ptr [r12 + 8]
   0x7ffff784f44e <gf_sg_command_del+334>    test   rsi, rsi
   0x7ffff784f451 <gf_sg_command_del+337>    je     gf_sg_command_del+255
<gf_sg_command_del+255>

   0x7ffff784f453 <gf_sg_command_del+339>    mov    edi, dword ptr [r12 + 4]
   0x7ffff784f458 <gf_sg_command_del+344>    mov    rdx, qword ptr [rbp]
 ► 0x7ffff784f45c <gf_sg_command_del+348>    call   gf_svg_delete_attribute_value                <gf_svg_delete_attribute_value>
        rdi: 0x0
        rsi: 0x5555555df300 ◂— 0x0
        rdx: 0x5555555d4370 ◂— 0x0
        rcx: 0x5555555df310 ◂— 0x0

   0x7ffff784f461 <gf_sg_command_del+353>    jmp    gf_sg_command_del+255
<gf_sg_command_del+255>

   0x7ffff784f463 <gf_sg_command_del+355>    nop    dword ptr [rax + rax]
   0x7ffff784f468 <gf_sg_command_del+360>    mov    rdi, qword ptr [r12 + 8]
   0x7ffff784f46d <gf_sg_command_del+365>    test   rdi, rdi
   0x7ffff784f470 <gf_sg_command_del+368>    je     gf_sg_command_del+384
<gf_sg_command_del+384>
────────────────────────────────────────[ STACK ]────────────────────────────────────────
00:0000│ rsp 0x7fffffff7310 ◂— 0x1
01:0008│     0x7fffffff7318 ◂— 0x5cf4ff747866de00
02:0010│     0x7fffffff7320 —▸ 0x7fffffff7340 —▸ 0x5555555df1e0 —▸ 0x5555555d4370 ◂— 0x0
03:0018│     0x7fffffff7328 —▸ 0x5555555defe0 ◂— 0x8
04:0020│     0x7fffffff7330 —▸ 0x5555555df130 ◂— 0x0
05:0028│     0x7fffffff7338 —▸ 0x7ffff7a88203 (gf_sm_del+195) ◂— jmp    0x7ffff7a881c8
06:0030│     0x7fffffff7340 —▸ 0x5555555df1e0 —▸ 0x5555555d4370 ◂— 0x0
07:0038│     0x7fffffff7348 ◂— 0x5cf4ff747866de00
──────────────────────────────────────[ BACKTRACE ]──────────────────────────────────────
 ► f 0   0x7ffff784f45c gf_sg_command_del+348
   f 1   0x7ffff7a88203 gf_sm_del+195
   f 2   0x555555584423 dump_isom_scene+627
   f 3   0x55555557b42c mp4boxMain+9228
   f 4   0x7ffff75630b3 __libc_start_main+243
─────────────────────────────────────────────────────────────────────────────────────────
pwndbg>
free(): invalid pointer

Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50      ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
───────────────────────────────[ REGISTERS ]────────────────────────────────
 RAX  0x0
*RBX  0x7ffff72bf040 ◂— 0x7ffff72bf040
*RCX  0x7ffff758218b (raise+203) ◂— mov    rax, qword ptr [rsp + 0x108]
*RDX  0x0
*RDI  0x2
*RSI  0x7fffffff6f20 ◂— 0x0
*R8   0x0
*R9   0x7fffffff6f20 ◂— 0x0
*R10  0x8
*R11  0x246
*R12  0x7fffffff7190 ◂— 0x0
*R13  0x10
*R14  0x7ffff7ffb000 ◂— 0x6565726600001000
*R15  0x1
*RBP  0x7fffffff7270 —▸ 0x5555555df1e0 —▸ 0x5555555d4370 ◂— 0x0
*RSP  0x7fffffff6f20 ◂— 0x0
*RIP  0x7ffff758218b (raise+203) ◂— mov    rax, qword ptr [rsp + 0x108]
───────────────────────────────────────[ DISASM ]────────────────────────────────────────
 ► 0x7ffff758218b <raise+203>    mov    rax, qword ptr [rsp + 0x108]
   0x7ffff7582193 <raise+211>    xor    rax, qword ptr fs:[0x28]
   0x7ffff758219c <raise+220>    jne    raise+260                <raise+260>
    ↓
   0x7ffff75821c4 <raise+260>    call   __stack_chk_fail                <__stack_chk_fail>

   0x7ffff75821c9                nop    dword ptr [rax]
   0x7ffff75821d0 <killpg>       endbr64
   0x7ffff75821d4 <killpg+4>     test   edi, edi
   0x7ffff75821d6 <killpg+6>     js     killpg+16                <killpg+16>

   0x7ffff75821d8 <killpg+8>     neg    edi
   0x7ffff75821da <killpg+10>    jmp    kill                <kill>

   0x7ffff75821df <killpg+15>    nop
────────────────────────────────────────[ STACK ]────────────────────────────────────────
00:0000│ rsi r9 rsp 0x7fffffff6f20 ◂— 0x0
01:0008│            0x7fffffff6f28 —▸ 0x7ffff77534c8 ◂— 0xe001200003748 /* 'H7' */
02:0010│            0x7fffffff6f30 —▸ 0x7fffffff72f0 —▸ 0x5555555d47a0 —▸ 0x5555555d4370 ◂— 0x0
03:0018│            0x7fffffff6f38 —▸ 0x7ffff7fe7c2e ◂— mov    r11, rax
04:0020│            0x7fffffff6f40 ◂— 0x0
05:0028│            0x7fffffff6f48 ◂— 0x0
06:0030│            0x7fffffff6f50 —▸ 0x5555555df390 —▸ 0x5555555df3f0 —▸ 0x5555555df0f0 ◂— 0x0
07:0038│            0x7fffffff6f58 ◂— 0x0
──────────────────────────────────────[ BACKTRACE ]──────────────────────────────────────
 ► f 0   0x7ffff758218b raise+203
   f 1   0x7ffff7561859 abort+299
   f 2   0x7ffff75cc3ee __libc_message+670
   f 3   0x7ffff75d447c
   f 4   0x7ffff75d5cac _int_free+748
   f 5   0x7ffff784f461 gf_sg_command_del+353
   f 6   0x7ffff7a88203 gf_sm_del+195
   f 7   0x555555584423 dump_isom_scene+627
```


--- end body ---

comments :
--- start comments ---

--- end comments ---