CVE-2021-29279: Integer Overflow or Wraparound (CWE-190)
value: There is a integer overflow in function filter_core/filter_props.c:gf_props_assign_value in GPAC 1.0.1. In which, the arg const GF_PropertyValue *value,maybe value->value.data.size is a negative number. In result, memcpy in gf_props_assign_value failed.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 7.8
Published: 2021-04-19T20:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/reframe_flac.c
Commit date: 2021-03-29 09:17:40 +0200
Commit message: fixed 1718

Diff: diff --git a/src/filters/reframe_flac.c b/src/filters/reframe_flac.c
index 1e4f6467bb8..0d6bbd2aa89 100644
--- a/src/filters/reframe_flac.c
+++ b/src/filters/reframe_flac.c
@@ -57,10 +57,11 @@ typedef struct
 	Bool in_seek;
 	u32 timescale;
 	Bool is_playing;
 	Bool is_file;
 	Bool initial_play_done, file_loaded;
+	Bool in_error;
 
 	Bool initialized;
 	u32 sample_rate, nb_channels, bits_per_sample, block_size;
 
 	u8 *flac_buffer;
@@ -386,10 +387,13 @@ GF_Err flac_dmx_process(GF_Filter *filter)
 	Bool final_flush=GF_FALSE;
 	u32 pck_size, remain, prev_pck_size;
 	u64 cts = GF_FILTER_NO_TS;
 	FLACHeader hdr;
 
+	if (ctx->in_error)
+		return GF_NON_COMPLIANT_BITSTREAM;
+
 	//always reparse duration
 	if (!ctx->duration.num)
 		flac_dmx_check_dur(filter, ctx);
 
 	if (ctx->opid && !ctx->is_playing)
@@ -492,11 +496,16 @@ GF_Err flac_dmx_process(GF_Filter *filter)
 			u32 dsi_end = 0;
 			//we have a header
 			gf_bs_reassign_buffer(ctx->bs, ctx->flac_buffer, size);
 			u32 magic = gf_bs_read_u32(ctx->bs);
 			if (magic != GF_4CC('f','L','a','C')) {
-
+				GF_LOG(GF_LOG_ERROR, GF_LOG_PARSER, ("[FLACDmx] invalid FLAC magic\n"));
+				ctx->in_error = GF_TRUE;
+				ctx->flac_buffer_size = 0;
+				if (pck)
+					gf_filter_pid_drop_packet(ctx->ipid);
+				return GF_NON_COMPLIANT_BITSTREAM;
 			}
 			while (gf_bs_available(ctx->bs)) {
 				Bool last = gf_bs_read_int(ctx->bs, 1);
 				u32 type = gf_bs_read_int(ctx->bs, 7);
 				u32 len = gf_bs_read_int(ctx->bs, 24);
@@ -523,10 +532,18 @@ GF_Err flac_dmx_process(GF_Filter *filter)
 					//TODO: expose metadata, pictures and co
 					gf_bs_skip_bytes(ctx->bs, len);
 				}
 				if (last) break;
 			}
+			if (!dsi_end) {
+				GF_LOG(GF_LOG_ERROR, GF_LOG_PARSER, ("[FLACDmx] invalid FLAC header\n"));
+				ctx->in_error = GF_TRUE;
+				ctx->flac_buffer_size = 0;
+				if (pck)
+					gf_filter_pid_drop_packet(ctx->ipid);
+				return GF_NON_COMPLIANT_BITSTREAM;
+			}
 			flac_dmx_check_pid(filter, ctx, ctx->flac_buffer+4, dsi_end-4);
 			remain -= size;
 			start += size;
 			ctx->initialized = GF_TRUE;
 			if (!ctx->is_playing) break;

Fixed code: 	Bool in_error;
	if (ctx->in_error)
		return GF_NON_COMPLIANT_BITSTREAM;

				GF_LOG(GF_LOG_ERROR, GF_LOG_PARSER, ("[FLACDmx] invalid FLAC magic\n"));
				ctx->in_error = GF_TRUE;
				ctx->flac_buffer_size = 0;
				if (pck)
					gf_filter_pid_drop_packet(ctx->ipid);
				return GF_NON_COMPLIANT_BITSTREAM;
			if (!dsi_end) {
				GF_LOG(GF_LOG_ERROR, GF_LOG_PARSER, ("[FLACDmx] invalid FLAC header\n"));
				ctx->in_error = GF_TRUE;
				ctx->flac_buffer_size = 0;
				if (pck)
					gf_filter_pid_drop_packet(ctx->ipid);
				return GF_NON_COMPLIANT_BITSTREAM;
			}