In the adts_dmx_process function in filters/reframe_adts.c in GPAC 1.0.1, a crafted file may cause ctx->hdr.frame_size to be smaller than ctx->hdr.hdr_size, resulting in size to be a negative number and a heap overflow in the memcpy.
cpe:2.3:a:gpac:gpac:1.0.1:*:*:*:*:*:*:*
82DD2D40-0A05-48FD-940D-32B4D8B51AB3
OR
In `filters/reframe_adts.c`, function `adts_dmx_process`.
There is a sub codes like as below:
`
size = ctx->hdr.frame_size - ctx->hdr.hdr_size;
		offset = ctx->hdr.hdr_size;
......
memcpy(output, sync + offset, size);

`
However, with crafted file, ctx->hdr.frame_size  may be smaller than ctx->hdr.hdr_size.
So, the size may be a negative number, which results a heap overflow in memcpy.

In Command line:
gpac -info bug6
![bug6_cmd](https://user-images.githubusercontent.com/44844446/112800680-8d05c780-90a2-11eb-8b87-557d15fc11b4.png)


In gdb:
![bug6](https://user-images.githubusercontent.com/44844446/112800687-8f682180-90a2-11eb-964a-1ace9cba1bff.png)

The crafted file is in the attached zip:
[bug6.zip](https://github.com/gpac/gpac/files/6219966/bug6.zip)


A integer (heap) overflow in function adts_dmx_process
This is a GitHub Issue
repo:gpac
owner:gpac
Title : A integer (heap) overflow in function adts_dmx_process
Issue date:

--- start body ---
In `filters/reframe_adts.c`, function `adts_dmx_process`.
There is a sub codes like as below:
`
size = ctx->hdr.frame_size - ctx->hdr.hdr_size;
		offset = ctx->hdr.hdr_size;
......
memcpy(output, sync + offset, size);

`
However, with crafted file, ctx->hdr.frame_size  may be smaller than ctx->hdr.hdr_size.
So, the size may be a negative number, which results a heap overflow in memcpy.

In Command line:
gpac -info bug6
![bug6_cmd](https://user-images.githubusercontent.com/44844446/112800680-8d05c780-90a2-11eb-8b87-557d15fc11b4.png)


In gdb:
![bug6](https://user-images.githubusercontent.com/44844446/112800687-8f682180-90a2-11eb-964a-1ace9cba1bff.png)

The crafted file is in the attached zip:
[bug6.zip](https://github.com/gpac/gpac/files/6219966/bug6.zip)


--- end body ---

comments :
--- start comments ---

--- end comments ---