In the function gf_hevc_read_pps_bs_internal function in media_tools/av_parsers.c in GPAC 1.0.1 there is a loop, which with crafted file, pps->num_tile_columns may be larger than sizeof(pps->column_width), which results in a heap overflow in the loop.
cpe:2.3:a:gpac:gpac:1.0.1:*:*:*:*:*:*:*
82DD2D40-0A05-48FD-940D-32B4D8B51AB3
OR
In `media_tools/av_parsers.c`, function `gf_hevc_read_pps_bs_internal`.
There is a loop as below:
`

		pps->num_tile_columns = 1 + gf_bs_read_ue_log(bs, "num_tile_columns_minus1");
		pps->num_tile_rows = 1 + gf_bs_read_ue_log(bs, "num_tile_rows_minus1");
		pps->uniform_spacing_flag = gf_bs_read_int_log(bs, 1, "uniform_spacing_flag");
		if (!pps->uniform_spacing_flag) {
			for (i = 0; i < pps->num_tile_columns - 1; i++) {
				pps->column_width[i] = 1 + gf_bs_read_ue_log_idx(bs, "column_width_minus1", i);
			}

`
However, with crafted file, **pps->num_tile_columns** may be larger than sizeof(pps->column_width), which results a heap overflow in the loop.

In Command line:
gpac -info bug5
![bug5_cmd](https://user-images.githubusercontent.com/44844446/112795077-9428d780-909a-11eb-876e-98e1703150b2.png)

In gdb:
![bug5](https://user-images.githubusercontent.com/44844446/112803057-790f9500-90a5-11eb-8d68-f5f040fd8115.png)


The crafted file is in the attached zip:
[bug5.zip](https://github.com/gpac/gpac/files/6219707/bug5.zip)


A heap overflow in function gf_hevc_read_pps_bs_internal
This is a GitHub Issue
repo:gpac
owner:gpac
Title : A heap overflow in function gf_hevc_read_pps_bs_internal
Issue date:

--- start body ---
In `media_tools/av_parsers.c`, function `gf_hevc_read_pps_bs_internal`.
There is a loop as below:
`

		pps->num_tile_columns = 1 + gf_bs_read_ue_log(bs, "num_tile_columns_minus1");
		pps->num_tile_rows = 1 + gf_bs_read_ue_log(bs, "num_tile_rows_minus1");
		pps->uniform_spacing_flag = gf_bs_read_int_log(bs, 1, "uniform_spacing_flag");
		if (!pps->uniform_spacing_flag) {
			for (i = 0; i < pps->num_tile_columns - 1; i++) {
				pps->column_width[i] = 1 + gf_bs_read_ue_log_idx(bs, "column_width_minus1", i);
			}

`
However, with crafted file, **pps->num_tile_columns** may be larger than sizeof(pps->column_width), which results a heap overflow in the loop.

In Command line:
gpac -info bug5
![bug5_cmd](https://user-images.githubusercontent.com/44844446/112795077-9428d780-909a-11eb-876e-98e1703150b2.png)

In gdb:
![bug5](https://user-images.githubusercontent.com/44844446/112803057-790f9500-90a5-11eb-8d68-f5f040fd8115.png)


The crafted file is in the attached zip:
[bug5.zip](https://github.com/gpac/gpac/files/6219707/bug5.zip)


--- end body ---

comments :
--- start comments ---

--- end comments ---