Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [X] I looked for a similar issue and couldn't find any.
- [X] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [X] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/

# Description

An arbitrary free can be triggered in csgp_box_del when doing gf_free

```c
void csgp_box_del(GF_Box *a)
{
	GF_CompactSampleGroupBox *p = (GF_CompactSampleGroupBox *)a;
	if (p->patterns) {
		u32 i;
		for (i=0; i<p->pattern_count; i++) {
			if (p->patterns[i].sample_group_description_indices)
				gf_free(p->patterns[i].sample_group_description_indices);
		}
		gf_free(p->patterns);
	}
	gf_free(p);
}
```

# Analyse

After encountering a POC (see attachment) can trigger segmentation fault and analysing it thoroughly, I found that this is actully the same bug mentioned in this [issue](https://github.com/gpac/gpac/issues/2214), ASAN detects a huge chunk malloc failed. More precisely, csgp_box_read will return OOM error to gf_isom_box_parse_ex if users try to malloc large chunks. After this, newBox structure is corrupted but the program doesn't fall fast, and later calls gf_isom_box_del(newBox) to free all the elements of it, which causing free to uninitialized memory (ps. no-check flag is not set, if it's set, more unexpected things would happen).  By constructing heap fengshui to leave malicious data on heap, this bug can be leveraged to arbitrary free or double free.

# Impact

Since video content is controllable by users, this will crash the service, causing Denial of Service and Remote Code Execution potentially.  

# Mitigation

After OOM error, the program should fall as fast as possible. Since the issue mentioned above is closed but unfixed, the best way here is to reset ptr->pattern_count when malloc fails in csgp_box_read. See [pull request](https://github.com/gpac/gpac/pull/2292).

# Reproducer

On Ubuntu 22.04 lts, Make with this.

```
$ ./configure --static-bin && make
```

Run the following command with POC.mp4.

```
$ MP4Box -split 1:2 ./POC.mp4
```

You will get a Segmentation fault. GDB info as below

```
Program received signal SIGSEGV, Segmentation fault.
0x0000000000a8cfce in free ()
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
─────────────[ REGISTERS / show-flags off / show-compact-regs off ]─────────────
*RAX  0x20
*RBX  0xffffffffffffff98
 RCX  0x0
*RDX  0x1
*RDI  0x203a5845202e6563 ('ce. EX: ')
*RSI  0x203a5845202e6553 ('Se. EX: ')
*R8   0xd95620 ◂— 0xd95
 R9   0x0
*R10  0x22
*R11  0xdb4000
 R12  0x0
*R13  0x63736770
*R14  0xd94350 ◂— 0x63736770 /* 'pgsc' */
*R15  0xfffffffe
*RBP  0xd94350 ◂— 0x63736770 /* 'pgsc' */
*RSP  0x7fffffff7e20 ◂— 0x1000b5c08d
*RIP  0xa8cfce (free+30) ◂— mov    rax, qword ptr [rdi - 8]
──────────────────────[ DISASM / x86-64 / set emulate on ]──────────────────────
 ► 0xa8cfce <free+30>     mov    rax, qword ptr [rdi - 8]
```

Backtrace

```
pwndbg> bt
#0  0x0000000000a8cfce in free ()
#1  0x0000000000947b83 in csgp_box_del ()
#2  0x0000000000532bcc in gf_isom_box_del ()
#3  0x00000000005333c0 in gf_isom_box_parse_ex ()
#4  0x0000000000533890 in gf_isom_parse_root_box ()
#5  0x000000000053b406 in gf_isom_parse_movie_boxes_internal ()
#6  0x000000000053cb67 in gf_isom_open_file ()
#7  0x0000000000413cbc in mp4boxMain ()
#8  0x0000000000a598fa in __libc_start_call_main ()
#9  0x0000000000a5b157 in __libc_start_main_impl ()
#10 0x0000000000402b95 in _start ()
```

# Credit

xdchase
Janette88

# POC

[POC.zip](https://github.com/gpac/gpac/files/9891946/POC.zip)





GPAC-2.0.0 MP4Box: invalid free in csgp_box_del
This is a GitHub Issue
repo:gpac
owner:gpac
Title : GPAC-2.0.0 MP4Box: invalid free in csgp_box_del
Issue date:

--- start body ---
Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [X] I looked for a similar issue and couldn't find any.
- [X] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [X] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/

# Description

An arbitrary free can be triggered in csgp_box_del when doing gf_free

```c
void csgp_box_del(GF_Box *a)
{
	GF_CompactSampleGroupBox *p = (GF_CompactSampleGroupBox *)a;
	if (p->patterns) {
		u32 i;
		for (i=0; i<p->pattern_count; i++) {
			if (p->patterns[i].sample_group_description_indices)
				gf_free(p->patterns[i].sample_group_description_indices);
		}
		gf_free(p->patterns);
	}
	gf_free(p);
}
```

# Analyse

After encountering a POC (see attachment) can trigger segmentation fault and analysing it thoroughly, I found that this is actully the same bug mentioned in this [issue](https://github.com/gpac/gpac/issues/2214), ASAN detects a huge chunk malloc failed. More precisely, csgp_box_read will return OOM error to gf_isom_box_parse_ex if users try to malloc large chunks. After this, newBox structure is corrupted but the program doesn't fall fast, and later calls gf_isom_box_del(newBox) to free all the elements of it, which causing free to uninitialized memory (ps. no-check flag is not set, if it's set, more unexpected things would happen).  By constructing heap fengshui to leave malicious data on heap, this bug can be leveraged to arbitrary free or double free.

# Impact

Since video content is controllable by users, this will crash the service, causing Denial of Service and Remote Code Execution potentially.  

# Mitigation

After OOM error, the program should fall as fast as possible. Since the issue mentioned above is closed but unfixed, the best way here is to reset ptr->pattern_count when malloc fails in csgp_box_read. See [pull request](https://github.com/gpac/gpac/pull/2292).

# Reproducer

On Ubuntu 22.04 lts, Make with this.

```
$ ./configure --static-bin && make
```

Run the following command with POC.mp4.

```
$ MP4Box -split 1:2 ./POC.mp4
```

You will get a Segmentation fault. GDB info as below

```
Program received signal SIGSEGV, Segmentation fault.
0x0000000000a8cfce in free ()
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
─────────────[ REGISTERS / show-flags off / show-compact-regs off ]─────────────
*RAX  0x20
*RBX  0xffffffffffffff98
 RCX  0x0
*RDX  0x1
*RDI  0x203a5845202e6563 ('ce. EX: ')
*RSI  0x203a5845202e6553 ('Se. EX: ')
*R8   0xd95620 ◂— 0xd95
 R9   0x0
*R10  0x22
*R11  0xdb4000
 R12  0x0
*R13  0x63736770
*R14  0xd94350 ◂— 0x63736770 /* 'pgsc' */
*R15  0xfffffffe
*RBP  0xd94350 ◂— 0x63736770 /* 'pgsc' */
*RSP  0x7fffffff7e20 ◂— 0x1000b5c08d
*RIP  0xa8cfce (free+30) ◂— mov    rax, qword ptr [rdi - 8]
──────────────────────[ DISASM / x86-64 / set emulate on ]──────────────────────
 ► 0xa8cfce <free+30>     mov    rax, qword ptr [rdi - 8]
```

Backtrace

```
pwndbg> bt
#0  0x0000000000a8cfce in free ()
#1  0x0000000000947b83 in csgp_box_del ()
#2  0x0000000000532bcc in gf_isom_box_del ()
#3  0x00000000005333c0 in gf_isom_box_parse_ex ()
#4  0x0000000000533890 in gf_isom_parse_root_box ()
#5  0x000000000053b406 in gf_isom_parse_movie_boxes_internal ()
#6  0x000000000053cb67 in gf_isom_open_file ()
#7  0x0000000000413cbc in mp4boxMain ()
#8  0x0000000000a598fa in __libc_start_call_main ()
#9  0x0000000000a5b157 in __libc_start_main_impl ()
#10 0x0000000000402b95 in _start ()
```

# Credit

xdchase
Janette88

# POC

[POC.zip](https://github.com/gpac/gpac/files/9891946/POC.zip)





--- end body ---
