Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [x] I looked for a similar issue and couldn't find any.
- [x] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [x] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/

An invalid memory address dereference was discovered in gf_list_last(). The vulnerability causes a segmentation fault and application crash.

**Version:**

```
MP4Box - GPAC version 1.1.0-DEV-rev1555-g339e7a736-master
(c) 2000-2021 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
        GPAC Filters: https://doi.org/10.1145/3339825.3394929
        GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --prefix=/root/fuck_bin/gpac/test
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_JPEG GPAC_HAS_PNG GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D
```
**System information**
Ubuntu 20.04 focal, AMD EPYC 7742 64-Core @ 16x 2.25GHz

**command:**

```
./MP4Box -bt poc
```
[gf_list_last-lsr_read_anim_values_ex.part.zip](https://github.com/gpac/gpac/files/7708215/gf_list_last-lsr_read_anim_values_ex.part.zip)

**Result**

gf_list_last-lsr_read_anim_values_ex.part/id:000419,sig:11,src:004556+004627,op:splice,rep:8

```
../../test/lib/MP4Box -bt gf_list_last-lsr_read_anim_values_ex.part/id:000419,sig:11,src:0045
56+004627,op:splice,rep:8
[iso file] extra box maxr found in hinf, deleting
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type 80rak in parent moov
[iso file] Incomplete box mdat - start 11495 size 853098
[iso file] Incomplete file while reading for dump - aborting parsing
[iso file] extra box maxr found in hinf, deleting
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type 80rak in parent moov
[iso file] Incomplete box mdat - start 11495 size 853098
[iso file] Incomplete file while reading for dump - aborting parsing
MPEG-4 LASeR Scene Parsing
[LASeR] samepath coded in bitstream but no path defined !
[LASeR] sameline coded in bitstream but no line defined !
[1]    3869073 segmentation fault  ../../test/lib/MP4Box -bt
```

**gdb**

gf_list_last-lsr_read_anim_values_ex.part/id:000419,sig:11,src:004556+004627,op:splice,rep:8

```
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff77ef566 in gf_list_last () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
────────────────────────────────────────────[ REGISTERS ]─────────────────────────────────────────────
 RAX  0x5555555e2700 —▸ 0x7ffff7720001 ◂— 0xe49020b50080e0a
 RBX  0x0
 RCX  0x0
 RDX  0xf7727bdf
 RDI  0x5555555e2720 —▸ 0x5555555e2700 —▸ 0x7ffff7720001 ◂— 0xe49020b50080e0a
 RSI  0x1
 R8   0x5555555e27e0 ◂— 0x555e2a0050080e0a
 R9   0x5555555c6010 ◂— 0x0
 R10  0x7ffff7759e24 ◂— 'gf_list_last'
 R11  0x7ffff77ef550 (gf_list_last) ◂— endbr64
 R12  0x5555555e26c0 ◂— 0x51 /* 'Q' */
 R13  0x5555555e27e0 ◂— 0x555e2a0050080e0a
 R14  0x7ffff7e4e3d4 ◂— 0x65756c61765f61 /* 'a_value' */
 R15  0x5555555e2720 —▸ 0x5555555e2700 —▸ 0x7ffff7720001 ◂— 0xe49020b50080e0a
 RBP  0x2
 RSP  0x7fffffff6c98 —▸ 0x7ffff7b54ff5 (lsr_read_anim_values_ex.part+645) ◂— mov    rdi, r15
 RIP  0x7ffff77ef566 (gf_list_last+22) ◂— mov    rax, qword ptr [rax + rdx*8]
──────────────────────────────────────────────[ DISASM ]──────────────────────────────────────────────
 ► 0x7ffff77ef566 <gf_list_last+22>    mov    rax, qword ptr [rax + rdx*8]
   0x7ffff77ef56a <gf_list_last+26>    ret

   0x7ffff77ef56b <gf_list_last+27>    nop    dword ptr [rax + rax]
   0x7ffff77ef570 <gf_list_last+32>    xor    eax, eax
   0x7ffff77ef572 <gf_list_last+34>    ret

   0x7ffff77ef573                      nop    word ptr cs:[rax + rax]
   0x7ffff77ef57e                      nop
   0x7ffff77ef580 <gf_list_rem>        endbr64
   0x7ffff77ef584 <gf_list_rem+4>      test   rdi, rdi
   0x7ffff77ef587 <gf_list_rem+7>      je     gf_list_rem+111                <gf_list_rem+111>
    ↓
   0x7ffff77ef5ef <gf_list_rem+111>    mov    eax, 0xffffffff
──────────────────────────────────────────────[ STACK ]───────────────────────────────────────────────
00:0000│ rsp 0x7fffffff6c98 —▸ 0x7ffff7b54ff5 (lsr_read_anim_values_ex.part+645) ◂— mov    rdi, r15
01:0008│     0x7fffffff6ca0 ◂— 0x2ffff6d2c
02:0010│     0x7fffffff6ca8 ◂— 0x7fff00000000
03:0018│     0x7fffffff6cb0 ◂— 0x350000006e /* 'n' */
04:0020│     0x7fffffff6cb8 —▸ 0x5555555e26c0 ◂— 0x51 /* 'Q' */
05:0028│     0x7fffffff6cc0 ◂— 0x0
06:0030│     0x7fffffff6cc8 —▸ 0x7ffff78e2cef (gf_node_get_attribute_by_tag+239) ◂— mov    qword ptr [r15 + 8], rax
07:0038│     0x7fffffff6cd0 ◂— 0x40d
────────────────────────────────────────────[ BACKTRACE ]─────────────────────────────────────────────
 ► f 0   0x7ffff77ef566 gf_list_last+22
   f 1   0x7ffff7b54ff5 lsr_read_anim_values_ex.part+645
   f 2   0x7ffff7b5d9e8 lsr_read_animateTransform+424
   f 3   0x7ffff7b5beeb lsr_read_scene_content_model+1547
   f 4   0x7ffff7b5c89c lsr_read_group_content.part+316
   f 5   0x7ffff7b60a76 lsr_read_svg+838
   f 6   0x7ffff7b58817 lsr_read_command_list+759
   f 7   0x7ffff7b5ab74 lsr_decode_laser_unit+708
──────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> bt
#0  0x00007ffff77ef566 in gf_list_last () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#1  0x00007ffff7b54ff5 in lsr_read_anim_values_ex.part () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#2  0x00007ffff7b5d9e8 in lsr_read_animateTransform () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#3  0x00007ffff7b5beeb in lsr_read_scene_content_model () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#4  0x00007ffff7b5c89c in lsr_read_group_content.part () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#5  0x00007ffff7b60a76 in lsr_read_svg () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#6  0x00007ffff7b58817 in lsr_read_command_list () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#7  0x00007ffff7b5ab74 in lsr_decode_laser_unit () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#8  0x00007ffff7b6239d in gf_laser_decode_command_list () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#9  0x00007ffff7aa3061 in gf_sm_load_run_isom () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#10 0x00005555555844a8 in dump_isom_scene ()
#11 0x000055555557b42c in mp4boxMain ()
#12 0x00007ffff75630b3 in __libc_start_main (main=0x55555556c420 <main>, argc=3, argv=0x7fffffffe1d8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe1c8) at ../csu/libc-start.c:308
#13 0x000055555556c45e in _start ()
```


Invalid memory address dereference in gf_list_last()
This is a GitHub Issue
repo:gpac
owner:gpac
Title : Invalid memory address dereference in gf_list_last()
Issue date:

--- start body ---
Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [x] I looked for a similar issue and couldn't find any.
- [x] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [x] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

Detailed guidelines: http://gpac.io/2013/07/16/how-to-file-a-bug-properly/

An invalid memory address dereference was discovered in gf_list_last(). The vulnerability causes a segmentation fault and application crash.

**Version:**

```
MP4Box - GPAC version 1.1.0-DEV-rev1555-g339e7a736-master
(c) 2000-2021 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io

Please cite our work in your research:
        GPAC Filters: https://doi.org/10.1145/3339825.3394929
        GPAC: https://doi.org/10.1145/1291233.1291452

GPAC Configuration: --prefix=/root/fuck_bin/gpac/test
Features: GPAC_CONFIG_LINUX GPAC_64_BITS GPAC_HAS_IPV6 GPAC_HAS_SOCK_UN GPAC_MINIMAL_ODF GPAC_HAS_QJS GPAC_HAS_JPEG GPAC_HAS_PNG GPAC_HAS_LINUX_DVB  GPAC_DISABLE_3D
```
**System information**
Ubuntu 20.04 focal, AMD EPYC 7742 64-Core @ 16x 2.25GHz

**command:**

```
./MP4Box -bt poc
```
[gf_list_last-lsr_read_anim_values_ex.part.zip](https://github.com/gpac/gpac/files/7708215/gf_list_last-lsr_read_anim_values_ex.part.zip)

**Result**

gf_list_last-lsr_read_anim_values_ex.part/id:000419,sig:11,src:004556+004627,op:splice,rep:8

```
../../test/lib/MP4Box -bt gf_list_last-lsr_read_anim_values_ex.part/id:000419,sig:11,src:0045
56+004627,op:splice,rep:8
[iso file] extra box maxr found in hinf, deleting
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type 80rak in parent moov
[iso file] Incomplete box mdat - start 11495 size 853098
[iso file] Incomplete file while reading for dump - aborting parsing
[iso file] extra box maxr found in hinf, deleting
[iso file] extra box maxr found in hinf, deleting
[iso file] Unknown box type 80rak in parent moov
[iso file] Incomplete box mdat - start 11495 size 853098
[iso file] Incomplete file while reading for dump - aborting parsing
MPEG-4 LASeR Scene Parsing
[LASeR] samepath coded in bitstream but no path defined !
[LASeR] sameline coded in bitstream but no line defined !
[1]    3869073 segmentation fault  ../../test/lib/MP4Box -bt
```

**gdb**

gf_list_last-lsr_read_anim_values_ex.part/id:000419,sig:11,src:004556+004627,op:splice,rep:8

```
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff77ef566 in gf_list_last () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
────────────────────────────────────────────[ REGISTERS ]─────────────────────────────────────────────
 RAX  0x5555555e2700 —▸ 0x7ffff7720001 ◂— 0xe49020b50080e0a
 RBX  0x0
 RCX  0x0
 RDX  0xf7727bdf
 RDI  0x5555555e2720 —▸ 0x5555555e2700 —▸ 0x7ffff7720001 ◂— 0xe49020b50080e0a
 RSI  0x1
 R8   0x5555555e27e0 ◂— 0x555e2a0050080e0a
 R9   0x5555555c6010 ◂— 0x0
 R10  0x7ffff7759e24 ◂— 'gf_list_last'
 R11  0x7ffff77ef550 (gf_list_last) ◂— endbr64
 R12  0x5555555e26c0 ◂— 0x51 /* 'Q' */
 R13  0x5555555e27e0 ◂— 0x555e2a0050080e0a
 R14  0x7ffff7e4e3d4 ◂— 0x65756c61765f61 /* 'a_value' */
 R15  0x5555555e2720 —▸ 0x5555555e2700 —▸ 0x7ffff7720001 ◂— 0xe49020b50080e0a
 RBP  0x2
 RSP  0x7fffffff6c98 —▸ 0x7ffff7b54ff5 (lsr_read_anim_values_ex.part+645) ◂— mov    rdi, r15
 RIP  0x7ffff77ef566 (gf_list_last+22) ◂— mov    rax, qword ptr [rax + rdx*8]
──────────────────────────────────────────────[ DISASM ]──────────────────────────────────────────────
 ► 0x7ffff77ef566 <gf_list_last+22>    mov    rax, qword ptr [rax + rdx*8]
   0x7ffff77ef56a <gf_list_last+26>    ret

   0x7ffff77ef56b <gf_list_last+27>    nop    dword ptr [rax + rax]
   0x7ffff77ef570 <gf_list_last+32>    xor    eax, eax
   0x7ffff77ef572 <gf_list_last+34>    ret

   0x7ffff77ef573                      nop    word ptr cs:[rax + rax]
   0x7ffff77ef57e                      nop
   0x7ffff77ef580 <gf_list_rem>        endbr64
   0x7ffff77ef584 <gf_list_rem+4>      test   rdi, rdi
   0x7ffff77ef587 <gf_list_rem+7>      je     gf_list_rem+111                <gf_list_rem+111>
    ↓
   0x7ffff77ef5ef <gf_list_rem+111>    mov    eax, 0xffffffff
──────────────────────────────────────────────[ STACK ]───────────────────────────────────────────────
00:0000│ rsp 0x7fffffff6c98 —▸ 0x7ffff7b54ff5 (lsr_read_anim_values_ex.part+645) ◂— mov    rdi, r15
01:0008│     0x7fffffff6ca0 ◂— 0x2ffff6d2c
02:0010│     0x7fffffff6ca8 ◂— 0x7fff00000000
03:0018│     0x7fffffff6cb0 ◂— 0x350000006e /* 'n' */
04:0020│     0x7fffffff6cb8 —▸ 0x5555555e26c0 ◂— 0x51 /* 'Q' */
05:0028│     0x7fffffff6cc0 ◂— 0x0
06:0030│     0x7fffffff6cc8 —▸ 0x7ffff78e2cef (gf_node_get_attribute_by_tag+239) ◂— mov    qword ptr [r15 + 8], rax
07:0038│     0x7fffffff6cd0 ◂— 0x40d
────────────────────────────────────────────[ BACKTRACE ]─────────────────────────────────────────────
 ► f 0   0x7ffff77ef566 gf_list_last+22
   f 1   0x7ffff7b54ff5 lsr_read_anim_values_ex.part+645
   f 2   0x7ffff7b5d9e8 lsr_read_animateTransform+424
   f 3   0x7ffff7b5beeb lsr_read_scene_content_model+1547
   f 4   0x7ffff7b5c89c lsr_read_group_content.part+316
   f 5   0x7ffff7b60a76 lsr_read_svg+838
   f 6   0x7ffff7b58817 lsr_read_command_list+759
   f 7   0x7ffff7b5ab74 lsr_decode_laser_unit+708
──────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> bt
#0  0x00007ffff77ef566 in gf_list_last () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#1  0x00007ffff7b54ff5 in lsr_read_anim_values_ex.part () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#2  0x00007ffff7b5d9e8 in lsr_read_animateTransform () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#3  0x00007ffff7b5beeb in lsr_read_scene_content_model () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#4  0x00007ffff7b5c89c in lsr_read_group_content.part () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#5  0x00007ffff7b60a76 in lsr_read_svg () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#6  0x00007ffff7b58817 in lsr_read_command_list () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#7  0x00007ffff7b5ab74 in lsr_decode_laser_unit () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#8  0x00007ffff7b6239d in gf_laser_decode_command_list () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#9  0x00007ffff7aa3061 in gf_sm_load_run_isom () from /root/fuck_bin/gpac/test/lib/libgpac.so.10
#10 0x00005555555844a8 in dump_isom_scene ()
#11 0x000055555557b42c in mp4boxMain ()
#12 0x00007ffff75630b3 in __libc_start_main (main=0x55555556c420 <main>, argc=3, argv=0x7fffffffe1d8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe1c8) at ../csu/libc-start.c:308
#13 0x000055555556c45e in _start ()
```


--- end body ---
