POC: 
LINK : https://drive.google.com/file/d/1PO-c2WJnWqjUsG5dB0terCddup9-CL28/view?usp=share_link

```
A heap use-after-free vulnerability has been discovered in GPAC MP4Box's ogg_stream_clear function when processing OGG files. The vulnerability occurs due to improper handling of memory allocations and deallocations while processing OGG files. This leads to the use of previously freed memory, causing a potential risk of memory corruption, crashes, or other undefined behaviors.

Reproduce : ./bin/gcc/MP4Box -dash 1000 POC

Impact

An attacker who can successfully exploit this vulnerability could potentially execute arbitrary code in the context of the application, leading to a compromise of the system where the vulnerable software is installed. Additionally, the attacker could use this vulnerability to cause a denial of service (DoS) by crashing the application or making it unresponsive. This vulnerability poses a significant risk to the confidentiality, integrity, and availability of systems running the affected software.
Occurrences

mux_ogg.c L217

==1223316==ERROR: AddressSanitizer: heap-use-after-free on address 0x615000013188 at pc 0x7fc0bb2da988 bp 0x7ffce834e7e0 sp 0x7ffce834e7d0 READ of size 8 at 0x615000013188 thread T0 #0 0x7fc0bb2da987 in ogg_stream_clear (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2557987) #1 0x7fc0bba259e1 in oggdmx_finalize (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2ca29e1) #2 0x7fc0bb88f54e in gf_fs_del (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b0c54e) #3 0x7fc0bb0f8c56 in gf_dasher_clean_inputs (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2375c56) #4 0x7fc0bb0f8d14 in gf_dasher_del (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2375d14) #5 0x55587f9c995c in do_dash /root/gpac2/gpac/applications/mp4box/mp4box.c:4870 #6 0x55587f9c995c in mp4box_main /root/gpac2/gpac/applications/mp4box/mp4box.c:6184 #7 0x7fc0b854fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #8 0x7fc0b854fe3f in __libc_start_main_impl ../csu/libc-start.c:392 #9 0x55587f9a0cb4 in _start (/root/gpac2/gpac/bin/gcc/MP4Box+0xabcb4)

0x615000013188 is located 8 bytes inside of 488-byte region [0x615000013180,0x615000013368) freed by thread T0 here: #0 0x7fc0be615517 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127 #1 0x7fc0bba25a9a in oggdmx_finalize (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2ca2a9a) #2 0x7fc0bb88f54e in gf_fs_del (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b0c54e) #3 0x7fc0bb0f8c56 in gf_dasher_clean_inputs (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2375c56) #4 0x7fc0bb0f8d14 in gf_dasher_del (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2375d14) #5 0x55587f9c995c in do_dash /root/gpac2/gpac/applications/mp4box/mp4box.c:4870 #6 0x55587f9c995c in mp4box_main /root/gpac2/gpac/applications/mp4box/mp4box.c:6184 #7 0x7fc0b854fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

previously allocated by thread T0 here: #0 0x7fc0be615867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145 #1 0x7fc0bba2a0cd in oggdmx_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2ca70cd) #2 0x7fc0bb8c197c in gf_filter_process_task (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b3e97c) #3 0x7fc0bb87d00a in gf_fs_thread_proc (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2afa00a) #4 0x7fc0bb88a92e in gf_fs_run (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b0792e) #5 0x7fc0bb0fb0ce in gf_dasher_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x23780ce) #6 0x55587f9ca338 in do_dash /root/gpac2/gpac/applications/mp4box/mp4box.c:4807 #7 0x55587f9ca338 in mp4box_main /root/gpac2/gpac/applications/mp4box/mp4box.c:6184 #8 0x7fc0b854fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-use-after-free (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2557987) in ogg_stream_clear Shadow bytes around the buggy address: 0x0c2a7fffa5e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2a7fffa5f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2a7fffa600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2a7fffa610: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa 0x0c2a7fffa620: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x0c2a7fffa630: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2a7fffa640: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2a7fffa650: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2a7fffa660: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa 0x0c2a7fffa670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2a7fffa680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc
```

Heap Use-After-Free in GPAC MP4Box's ogg_stream_clear Function When Processing OGG Files
This is a GitHub Issue
repo:gpac
owner:gpac
Title : Heap Use-After-Free in GPAC MP4Box's ogg_stream_clear Function When Processing OGG Files
Issue date:

--- start body ---
POC: 
LINK : https://drive.google.com/file/d/1PO-c2WJnWqjUsG5dB0terCddup9-CL28/view?usp=share_link

```
A heap use-after-free vulnerability has been discovered in GPAC MP4Box's ogg_stream_clear function when processing OGG files. The vulnerability occurs due to improper handling of memory allocations and deallocations while processing OGG files. This leads to the use of previously freed memory, causing a potential risk of memory corruption, crashes, or other undefined behaviors.

Reproduce : ./bin/gcc/MP4Box -dash 1000 POC

Impact

An attacker who can successfully exploit this vulnerability could potentially execute arbitrary code in the context of the application, leading to a compromise of the system where the vulnerable software is installed. Additionally, the attacker could use this vulnerability to cause a denial of service (DoS) by crashing the application or making it unresponsive. This vulnerability poses a significant risk to the confidentiality, integrity, and availability of systems running the affected software.
Occurrences

mux_ogg.c L217

==1223316==ERROR: AddressSanitizer: heap-use-after-free on address 0x615000013188 at pc 0x7fc0bb2da988 bp 0x7ffce834e7e0 sp 0x7ffce834e7d0 READ of size 8 at 0x615000013188 thread T0 #0 0x7fc0bb2da987 in ogg_stream_clear (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2557987) #1 0x7fc0bba259e1 in oggdmx_finalize (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2ca29e1) #2 0x7fc0bb88f54e in gf_fs_del (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b0c54e) #3 0x7fc0bb0f8c56 in gf_dasher_clean_inputs (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2375c56) #4 0x7fc0bb0f8d14 in gf_dasher_del (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2375d14) #5 0x55587f9c995c in do_dash /root/gpac2/gpac/applications/mp4box/mp4box.c:4870 #6 0x55587f9c995c in mp4box_main /root/gpac2/gpac/applications/mp4box/mp4box.c:6184 #7 0x7fc0b854fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #8 0x7fc0b854fe3f in __libc_start_main_impl ../csu/libc-start.c:392 #9 0x55587f9a0cb4 in _start (/root/gpac2/gpac/bin/gcc/MP4Box+0xabcb4)

0x615000013188 is located 8 bytes inside of 488-byte region [0x615000013180,0x615000013368) freed by thread T0 here: #0 0x7fc0be615517 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127 #1 0x7fc0bba25a9a in oggdmx_finalize (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2ca2a9a) #2 0x7fc0bb88f54e in gf_fs_del (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b0c54e) #3 0x7fc0bb0f8c56 in gf_dasher_clean_inputs (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2375c56) #4 0x7fc0bb0f8d14 in gf_dasher_del (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2375d14) #5 0x55587f9c995c in do_dash /root/gpac2/gpac/applications/mp4box/mp4box.c:4870 #6 0x55587f9c995c in mp4box_main /root/gpac2/gpac/applications/mp4box/mp4box.c:6184 #7 0x7fc0b854fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

previously allocated by thread T0 here: #0 0x7fc0be615867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145 #1 0x7fc0bba2a0cd in oggdmx_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2ca70cd) #2 0x7fc0bb8c197c in gf_filter_process_task (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b3e97c) #3 0x7fc0bb87d00a in gf_fs_thread_proc (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2afa00a) #4 0x7fc0bb88a92e in gf_fs_run (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2b0792e) #5 0x7fc0bb0fb0ce in gf_dasher_process (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x23780ce) #6 0x55587f9ca338 in do_dash /root/gpac2/gpac/applications/mp4box/mp4box.c:4807 #7 0x55587f9ca338 in mp4box_main /root/gpac2/gpac/applications/mp4box/mp4box.c:6184 #8 0x7fc0b854fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-use-after-free (/root/gpac2/gpac/bin/gcc/libgpac.so.12+0x2557987) in ogg_stream_clear Shadow bytes around the buggy address: 0x0c2a7fffa5e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2a7fffa5f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2a7fffa600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2a7fffa610: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa 0x0c2a7fffa620: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x0c2a7fffa630: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2a7fffa640: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2a7fffa650: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2a7fffa660: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa 0x0c2a7fffa670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2a7fffa680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc
```

--- end body ---
