Submit #941995: gpac v26.07.0 Race Condition

## 1. Summary

When `MP4Box -add` ingests a truncated AV1 elementary stream, the av1dmx demuxer hits a stream-failure path and calls `gf_filter_pid_drop_packet` (filter_pid.c:7316), which pops from the pid instance's lock-free queue via `gf_fq_pop` (filter_queue.c:254). In the same lock-free scheduler session, a pid-instance deletion task (`gf_filter_pid_inst_delete_task`, filter_pid.c:452) may run concurrently and free that queue object (`gf_filter_pid_inst_del` → free of the `gf_fq` allocated by `gf_fq_new`). The demuxer thread then reads the freed queue node → **heap-use-after-free**.

## 2. How to reproduce

### 2.1 Get the source / build

Same as the companion report:

```bash
git clone https://github.com/gpac/gpac.git && cd gpac # commit 2fd5a06 (2026-08-20)
./configure --enable-sanitizer && make -j$(nproc) # binary: bin/gcc/MP4Box
```

### 2.2 PoC input

The PoC is a truncated AV1 elementary stream, attached as PoC.zip and unzip it to obtain `id009` (sha256: `f595eb3696914afe279f83e874b76db82ceccd662cc92e6a89a337f0594e22c7`; a
truncated AV1 bitstream; the demuxer fails mid-stream and enters the drop-packet path).

### 2.3 Run the reproducer

```bash
export ASAN_OPTIONS='detect_leaks=0:abort_on_error=1:symbolize=1'
setarch -R ./bin/gcc/MP4Box -threads 8 -noprog -add id009:dopt: -new /tmp/out.mp4
# repeat until crash (typically within 10-20 invocations)
```

Note: `setarch -R` disables ASLR (Linux); omit on macOS. `-threads 8` is significant — the 8+ scheduler threads exercise the teardown race.

## 3. ASAN report (full, current master, mainstream build)

```
==49120==ERROR: AddressSanitizer: heap-use-after-free on address 0x606000006050 at pc 0x7ffff445b400 bp 0x7fffea907a20 sp 0x7fffea907a10
READ of size 1 at 0x606000006050 thread T6
#0 0x7ffff445b3ff in gf_fq_pop filter_core/filter_queue.c:254
#1 0x7ffff440ddd6 in gf_filter_pid_drop_packet filter_core/filter_pid.c:7316
#2 0x7ffff499c0c0 in av1dmx_process filters/reframe_av1.c:1514
#3 0x7ffff44b9ca6 in gf_filter_process_task filter_core/filter.c:3257
#4 0x7ffff448010f in gf_fs_thread_proc filter_core/filter_session.c:2420
#5 0x7ffff34c8723 in RunThread utils/os_thread.c:234
#6 0x7ffff0ed6ac2 in start_thread nptl/pthread_create.c:442
#7 0x7ffff0f6884f (/lib/x86_64-linux-gnu/libc.so.6+0x12684f)
freed by thread T8 here:
#0 0x7ffff7676537 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127
#1 0x7ffff43e3daa in gf_filter_pid_inst_del filter_core/filter_pid.c:71
#2 0x7ffff4416ca0 in gf_filter_pid_inst_delete_task filter_core/filter_pid.c:452
#3 0x7ffff448010f in gf_fs_thread_proc filter_core/filter_session.c:2420
#4 0x7ffff34c8723 in RunThread utils/os_thread.c:234
#5 0x7ffff0ed6ac2 in start_thread nptl/pthread_create.c:442
previously allocated by thread T2 here:
#0 0x7ffff7676887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x7ffff445a0f7 in gf_fq_new filter_core/filter_queue.c:68
#2 0x7ffff4416a12 in gf_filter_pid_inst_new filter_core/filter_pid.c:...
#3 0x7ffff448010f in gf_fs_thread_proc filter_core/filter_session.c:2420

SUMMARY: AddressSanitizer: heap-use-after-free filter_core/filter_queue.c:254 in gf_fq_pop
==49120==ABORTING
```

## 4. Additional notes

- I noticed that upstream recently published commit 563859e5 ("utils: Avoid mutex access after release", 2026-08-20). However, this bug still triggers under that commit: re-tested with the attached PoC on master including 563859e5, the crash reproduces on the first invocation with the identical stack (heap-use-after-free in `gf_fq_pop`, filter_queue.c:254). That commit only modifies `gf_mx_v` (os_thread.c) and does not affect this pid-instance queue race.

• Source: ⚠️ https://github.com/user-attachments/files/31288202/PoC.zip
• User: ziiiro (UID 93755)
• Submission: 08/21/2026 05:51 (2 months ago)
• Moderation: 10/10/2026 15:17 (2 months later)
• Status: Accepted
• VulDB entry: 416194 [GPAC up to 26.07.0 MP4Box filter_queue.c gf_fq_pop use after free]
• Points: 20