An issue in GPAC v.2.2.1 and before allows a local attacker to cause a denial of service (DoS) via the ctts_box_read function of file src/isomedia/box_code_base.c.
cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*
047BC15F-5E51-48D9-B751-9DC9311FEBCF
2.2.1
OR
[Y] I looked for a similar issue and couldn't find any.
[Y] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
[Y] I give enough information for contributors to reproduce my issue

Description
There is a integer overflow issue in isomedia/box_code_base.c:413

System info
Ubuntu 22.04.2 LTS
GPAC-2.2.1

Build command
./configure --enable-sanitizer && make

crash command
/usr/local/bin/MP4Box -saf -diod poc

poc_file:
[poc.zip](https://github.com/gpac/gpac/files/13040344/poc.zip)

Crash output:
isomedia/box_code_base.c:413:29: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself

Integer overflow issue in isomedia/box_code_base.c:413
This is a GitHub Issue
repo:gpac
owner:gpac
Title : Integer overflow issue in isomedia/box_code_base.c:413
Issue date:

--- start body ---
[Y] I looked for a similar issue and couldn't find any.
[Y] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
[Y] I give enough information for contributors to reproduce my issue

Description
There is a integer overflow issue in isomedia/box_code_base.c:413

System info
Ubuntu 22.04.2 LTS
GPAC-2.2.1

Build command
./configure --enable-sanitizer && make

crash command
/usr/local/bin/MP4Box -saf -diod poc

poc_file:
[poc.zip](https://github.com/gpac/gpac/files/13040344/poc.zip)

Crash output:
isomedia/box_code_base.c:413:29: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself

--- end body ---

comments :
--- start comments ---

--- end comments ---