An issue in GPAC GPAC v.2.2.1 and before allows a local attacker to cause a denial of service via the Q_DecCoordOnUnitSphere function of file src/bifs/unquantize.c.
cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*
047BC15F-5E51-48D9-B751-9DC9311FEBCF
2.2.1
OR
Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [Y] I looked for a similar issue and couldn't find any.
- [Y] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [Y] I give enough information for contributors to reproduce my issue

**Description**
There is a integer overflow issue in bifs/unquantize.c:298

**System info**
Ubuntu 22.04.2 LTS
GPAC-2.2.1

**Build command**
./configure --enable-sanitizer && make

**crash command**
/usr/local/bin/MP4Box -xmt poc

**poc_file:**
[poc.zip](https://github.com/gpac/gpac/files/12461532/poc.zip)

**Crash output:**
[iso file] Unknown box type vref in parent dinf
[iso file] Missing dref box in dinf
[iso file] Incomplete box - start 2637
[iso file] Incomplete file while reading for dump - aborting parsing
[iso file] Unknown box type vref in parent dinf
[iso file] Missing dref box in dinf
[iso file] Incomplete box - start 2637
[iso file] Incomplete file while reading for dump - aborting parsing
MPEG-4 BIFS Scene Parsing
bifs/unquantize.c:298:43: runtime error: shift exponent 4294967295 is too large for 32-bit type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior bifs/unquantize.c:298:43 in
Integer overflow issue in bifs/unquantize.c:298
This is a GitHub Issue
repo:gpac
owner:gpac
Title : Integer overflow issue in bifs/unquantize.c:298
Issue date:

--- start body ---
Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [Y] I looked for a similar issue and couldn't find any.
- [Y] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [Y] I give enough information for contributors to reproduce my issue

**Description**
There is a integer overflow issue in bifs/unquantize.c:298

**System info**
Ubuntu 22.04.2 LTS
GPAC-2.2.1

**Build command**
./configure --enable-sanitizer && make

**crash command**
/usr/local/bin/MP4Box -xmt poc

**poc_file:**
[poc.zip](https://github.com/gpac/gpac/files/12461532/poc.zip)

**Crash output:**
[iso file] Unknown box type vref in parent dinf
[iso file] Missing dref box in dinf
[iso file] Incomplete box - start 2637
[iso file] Incomplete file while reading for dump - aborting parsing
[iso file] Unknown box type vref in parent dinf
[iso file] Missing dref box in dinf
[iso file] Incomplete box - start 2637
[iso file] Incomplete file while reading for dump - aborting parsing
MPEG-4 BIFS Scene Parsing
bifs/unquantize.c:298:43: runtime error: shift exponent 4294967295 is too large for 32-bit type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior bifs/unquantize.c:298:43 in
--- end body ---

comments :
--- start comments ---

--- end comments ---