Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2020-25427: NULL Pointer Dereference (CWE-476)
value: A Null pointer dereference vulnerability exits in MP4Box - GPAC version 0.8.0-rev177-g51a8ef874-master via the gf_isom_get_track_id function, which causes a denial of service.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2022-01-10T22:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/box_funcs.c
Commit date: 2020-06-11 19:28:51 +0200
Commit message: fixed potential crash - cf #1406

Diff: diff --git a/src/isomedia/box_funcs.c b/src/isomedia/box_funcs.c
index afa1213c83..230ce9c6ed 100644
--- a/src/isomedia/box_funcs.c
+++ b/src/isomedia/box_funcs.c
@@ -203,21 +203,15 @@ retry_unknown_box:
 		return GF_ISOM_INCOMPLETE_FILE;
 	}
 
 	newBox->size = size - hdr_size;
 
-	if (newBox->size) {
-		e = gf_isom_full_box_read(newBox, bs);
-		if (!e) e = gf_isom_box_read(newBox, bs);
-		newBox->size = size;
-		end = gf_bs_get_position(bs);
-	} else {
-		newBox->size = size;
-		//empty box
-		e = GF_OK;
-		end = gf_bs_get_position(bs);
-	}
+	//parse even if size is 0 - this makes sure that we perform box parsing (usually in box->read)
+	e = gf_isom_full_box_read(newBox, bs);
+	if (!e) e = gf_isom_box_read(newBox, bs);
+	newBox->size = size;
+	end = gf_bs_get_position(bs);
 
 	if (e && (e != GF_ISOM_INCOMPLETE_FILE)) {
 		gf_isom_box_del(newBox);
 		*outBox = NULL;
 

Vulnerable code: 	if (newBox->size) {
		e = gf_isom_full_box_read(newBox, bs);
		if (!e) e = gf_isom_box_read(newBox, bs);
		newBox->size = size;
		end = gf_bs_get_position(bs);
	} else {
		newBox->size = size;
		//empty box
		e = GF_OK;
		end = gf_bs_get_position(bs);
	}
Fixed code: 	//parse even if size is 0 - this makes sure that we perform box parsing (usually in box->read)
	e = gf_isom_full_box_read(newBox, bs);
	if (!e) e = gf_isom_box_read(newBox, bs);
	newBox->size = size;
	end = gf_bs_get_position(bs);
CVE-2020-35979: Out-of-bounds Write (CWE-787)
value: An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is heap-based buffer overflow in the function gp_rtp_builder_do_avc() in ietf/rtp_pck_mpeg4.c.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2021-04-21T16:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/media_tools/isom_hinter.c
Commit date: 2021-01-04 12:04:18 +0100
Commit message: fixed #1662

Diff: diff --git a/src/media_tools/isom_hinter.c b/src/media_tools/isom_hinter.c
index 8af1d04b7f5..2d05934f6de 100644
--- a/src/media_tools/isom_hinter.c
+++ b/src/media_tools/isom_hinter.c
@@ -791,12 +791,16 @@ GF_Err gf_hinter_track_process(GF_RTPHinter *tkHint)
 					GF_LOG(GF_LOG_ERROR, GF_LOG_RTP, ("[rtp hinter] Broken AVC nalu encapsulation: NALU size is %d but only %d bytes left in sample %d\n", size, remain, tkHint->CurrentSample));
 					break;
 				}
 				remain -= size;
 				tkHint->rtp_p->sl_header.accessUnitEndFlag = remain ? 0 : 1;
-				e = gf_rtp_builder_process(tkHint->rtp_p, ptr, size, (u8) !remain, samp->dataLength, duration, (u8) (descIndex + GF_RTP_TX3G_SIDX_OFFSET) );
-				ptr += size;
+				if (!size) {
+					GF_LOG(GF_LOG_WARNING, GF_LOG_RTP, ("[rtp hinter] Broken AVC nalu encapsulation: NALU size is 0, ignoring it\n", size));
+				} else {
+					e = gf_rtp_builder_process(tkHint->rtp_p, ptr, size, (u8) !remain, samp->dataLength, duration, (u8) (descIndex + GF_RTP_TX3G_SIDX_OFFSET) );
+					ptr += size;
+				}
 				tkHint->rtp_p->sl_header.accessUnitStartFlag = 0;
 			}
 		} else {
 			e = gf_rtp_builder_process(tkHint->rtp_p, samp->data, samp->dataLength, 1, samp->dataLength, duration, (u8) (descIndex + GF_RTP_TX3G_SIDX_OFFSET) );
 		}

Vulnerable code: 				e = gf_rtp_builder_process(tkHint->rtp_p, ptr, size, (u8) !remain, samp->dataLength, duration, (u8) (descIndex + GF_RTP_TX3G_SIDX_OFFSET) );
				ptr += size;
Fixed code: 				if (!size) {
					GF_LOG(GF_LOG_WARNING, GF_LOG_RTP, ("[rtp hinter] Broken AVC nalu encapsulation: NALU size is 0, ignoring it\n", size));
				} else {
					e = gf_rtp_builder_process(tkHint->rtp_p, ptr, size, (u8) !remain, samp->dataLength, duration, (u8) (descIndex + GF_RTP_TX3G_SIDX_OFFSET) );
					ptr += size;
				}
CVE-2020-35980: Use After Free (CWE-416)
value: An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is a use-after-free in the function gf_isom_box_del() in isomedia/box_funcs.c.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 7.8
Published: 2021-04-21T16:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/isom_store.c
Commit date: 2021-01-04 12:04:18 +0100
Commit message: fixed #1661

Diff: diff --git a/src/isomedia/isom_store.c b/src/isomedia/isom_store.c
index ee2b2cfaf26..b3aea7b6936 100644
--- a/src/isomedia/isom_store.c
+++ b/src/isomedia/isom_store.c
@@ -100,10 +100,13 @@ typedef struct
 
 void CleanWriters(GF_List *writers)
 {
 	while (gf_list_count(writers)) {
 		TrackWriter *writer = (TrackWriter*)gf_list_get(writers, 0);
+		//in case we have an error in the middle of file write, remove our created stco and stsc from sample table
+		gf_list_del_item(writer->stbl->child_boxes, writer->stco);
+		gf_list_del_item(writer->stbl->child_boxes, writer->stsc);
 		gf_isom_box_del(writer->stco);
 		gf_isom_box_del((GF_Box *)writer->stsc);
 		gf_free(writer);
 		gf_list_rem(writers, 0);
 	}

Fixed code: 		//in case we have an error in the middle of file write, remove our created stco and stsc from sample table
		gf_list_del_item(writer->stbl->child_boxes, writer->stco);
		gf_list_del_item(writer->stbl->child_boxes, writer->stsc);
CVE-2020-35981: NULL Pointer Dereference (CWE-476)
value: An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is an invalid pointer dereference in the function SetupWriters() in isomedia/isom_store.c.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.8
Published: 2021-04-21T16:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/isom_store.c
Commit date: 2021-01-04 12:04:18 +0100
Commit message: fixed #1659

Diff: diff --git a/src/isomedia/isom_store.c b/src/isomedia/isom_store.c
index 37dfbe55a9f..ee2b2cfaf26 100644
--- a/src/isomedia/isom_store.c
+++ b/src/isomedia/isom_store.c
@@ -148,12 +148,18 @@ GF_Err SetupWriters(MovieWriter *mw, GF_List *writers, u8 interleaving)
 	mw->total_samples = mw->nb_done = 0;
 	if (!movie->moov) return GF_OK;
 
 	trackCount = gf_list_count(movie->moov->trackList);
 	for (i = 0; i < trackCount; i++) {
+		GF_SampleTableBox *stbl;
 		trak = gf_isom_get_track(movie->moov, i+1);
 
+		stbl = (trak->Media && trak->Media->information) ? trak->Media->information->sampleTable : NULL;
+		if (!stbl || !stbl->SampleSize || !stbl->ChunkOffset || !stbl->SampleToChunk) {
+			return GF_ISOM_INVALID_FILE;
+		}
+
 		GF_SAFEALLOC(writer, TrackWriter);
 		if (!writer) goto exit;
 		writer->sampleNumber = 1;
 		writer->mdia = trak->Media;
 		writer->stbl = trak->Media->information->sampleTable;

Fixed code: 		GF_SampleTableBox *stbl;
		stbl = (trak->Media && trak->Media->information) ? trak->Media->information->sampleTable : NULL;
		if (!stbl || !stbl->SampleSize || !stbl->ChunkOffset || !stbl->SampleToChunk) {
			return GF_ISOM_INVALID_FILE;
		}
CVE-2020-35982: NULL Pointer Dereference (CWE-476)
value: An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is an invalid pointer dereference in the function gf_hinter_track_finalize() in media_tools/isom_hinter.c.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.8
Published: 2021-04-21T16:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/media_tools/isom_hinter.c
Commit date: 2021-01-04 12:04:18 +0100
Commit message: fixed #1660

Diff: diff --git a/src/media_tools/isom_hinter.c b/src/media_tools/isom_hinter.c
index 5bf89cb5cae..8af1d04b7f5 100644
--- a/src/media_tools/isom_hinter.c
+++ b/src/media_tools/isom_hinter.c
@@ -965,10 +965,12 @@ GF_Err gf_hinter_track_finalize(GF_RTPHinter *tkHint, Bool AddSystemInfo)
 		/*TODO - check syntax for SVC (might be some extra signaling)*/
 
 		if (avcc) {
 			sprintf(sdpLine, "a=fmtp:%d profile-level-id=%02X%02X%02X; packetization-mode=1", tkHint->rtp_p->PayloadType, avcc->AVCProfileIndication, avcc->profile_compatibility, avcc->AVCLevelIndication);
 		} else {
+			if (!svcc)
+				return GF_ISOM_INVALID_FILE;
 			sprintf(sdpLine, "a=fmtp:%d profile-level-id=%02X%02X%02X; packetization-mode=1", tkHint->rtp_p->PayloadType, svcc->AVCProfileIndication, svcc->profile_compatibility, svcc->AVCLevelIndication);
 		}
 
 		write_avc_config(sdpLine, avcc, svcc);
 

Fixed code: 			if (!svcc)
				return GF_ISOM_INVALID_FILE;
CVE-2021-30015: NULL Pointer Dereference (CWE-476)
value: There is a Null Pointer Dereference in function filter_core/filter_pck.c:gf_filter_pck_new_alloc_internal in GPAC 1.0.1. The pid comes from function av1dmx_parse_flush_sample, the ctx.opid maybe NULL. The result is a crash in gf_filter_pck_new_alloc_internal.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2021-04-19T20:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/reframe_av1.c
Commit date: 2021-03-29 09:21:51 +0200
Commit message: fixed #1719

Diff: diff --git a/src/filters/reframe_av1.c b/src/filters/reframe_av1.c
index 591a826a922..c8b402c8a97 100644
--- a/src/filters/reframe_av1.c
+++ b/src/filters/reframe_av1.c
@@ -737,10 +737,13 @@ static GF_Err av1dmx_parse_flush_sample(GF_Filter *filter, GF_AV1DmxCtx *ctx)
 {
 	u32 pck_size;
 	GF_FilterPacket *pck;
 	u8 *output;
 
+	if (!ctx->opid)
+		return GF_NON_COMPLIANT_BITSTREAM;
+		
 	gf_bs_get_content_no_truncate(ctx->state.bs, &ctx->state.frame_obus, &pck_size, &ctx->state.frame_obus_alloc);
 
 	if (!pck_size) {
 		GF_LOG(GF_LOG_DEBUG, GF_LOG_CONTAINER, ("[AV1Dmx] no frame OBU, skipping OBU\n"));
 		return GF_OK;

Fixed code: 	if (!ctx->opid)
		return GF_NON_COMPLIANT_BITSTREAM;
CVE-2021-30019: Out-of-bounds Write (CWE-787)
value: In the adts_dmx_process function in filters/reframe_adts.c in GPAC 1.0.1, a crafted file may cause ctx->hdr.frame_size to be smaller than ctx->hdr.hdr_size, resulting in size to be a negative number and a heap overflow in the memcpy.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2021-04-19T20:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/reframe_adts.c
Commit date: 2021-03-29 09:44:12 +0200
Commit message: fixed potential crash in adts reframer with broken streams - cf #1723

Diff: diff --git a/src/filters/reframe_adts.c b/src/filters/reframe_adts.c
index 9139df6fbf9..e93d4be2927 100644
--- a/src/filters/reframe_adts.c
+++ b/src/filters/reframe_adts.c
@@ -743,10 +743,16 @@ GF_Err adts_dmx_process(GF_Filter *filter)
 				ctx->cts = cts;
 			}
 			break;
 		}
 
+		if (ctx->hdr.frame_size < ctx->hdr.hdr_size) {
+			GF_LOG(GF_LOG_WARNING, GF_LOG_PARSER, ("[ADTSDmx] Corrupted ADTS frame header, resyncing\n"));
+			ctx->nb_frames = 0;
+			goto drop_byte;
+		}
+
 		adts_dmx_check_pid(filter, ctx);
 
 		if (!ctx->is_playing) {
 			ctx->resume_from = 1 + ctx->adts_buffer_size - remain;
 			return GF_OK;

Fixed code: 		if (ctx->hdr.frame_size < ctx->hdr.hdr_size) {
			GF_LOG(GF_LOG_WARNING, GF_LOG_PARSER, ("[ADTSDmx] Corrupted ADTS frame header, resyncing\n"));
			ctx->nb_frames = 0;
			goto drop_byte;
		}
CVE-2021-30199: NULL Pointer Dereference (CWE-476)
value: In filters/reframe_latm.c in GPAC 1.0.1 there is a Null Pointer Dereference, when gf_filter_pck_get_data is called. The first arg pck may be null with a crafted mp4 file,which results in a crash.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2021-04-19T20:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/reframe_latm.c
Commit date: 2021-04-08 09:29:42 +0200
Commit message: fixed #1728

Diff: diff --git a/src/filters/reframe_latm.c b/src/filters/reframe_latm.c
index f65609bfc01..bb40d55d8b2 100644
--- a/src/filters/reframe_latm.c
+++ b/src/filters/reframe_latm.c
@@ -446,12 +446,12 @@ static GFINLINE void latm_dmx_update_cts(GF_LATMDmxCtx *ctx)
 GF_Err latm_dmx_process(GF_Filter *filter)
 {
 	GF_LATMDmxCtx *ctx = gf_filter_get_udta(filter);
 	GF_FilterPacket *pck, *dst_pck;
 	u32 pos;
-	u8 *data, *output;
-	u32 pck_size, prev_pck_size;
+	u8 *data=NULL, *output;
+	u32 pck_size=0, prev_pck_size;
 	u64 cts = GF_FILTER_NO_TS;
 
 	if (ctx->in_error)
 		return ctx->in_error;
 
@@ -473,14 +473,14 @@ GF_Err latm_dmx_process(GF_Filter *filter)
 				return GF_EOS;
 			}
 		} else {
 			return GF_OK;
 		}
+	} else {
+		data = (char *) gf_filter_pck_get_data(pck, &pck_size);
 	}
 
-	data = (char *) gf_filter_pck_get_data(pck, &pck_size);
-
 	//input pid sets some timescale - we flushed pending data , update cts
 	if (ctx->timescale && pck) {
 		cts = gf_filter_pck_get_cts(pck);
 	}
 

Vulnerable code: 	u8 *data, *output;
	u32 pck_size, prev_pck_size;
	data = (char *) gf_filter_pck_get_data(pck, &pck_size);

Fixed code: 	u8 *data=NULL, *output;
	u32 pck_size=0, prev_pck_size;
	} else {
		data = (char *) gf_filter_pck_get_data(pck, &pck_size);
CVE-2021-31254: Out-of-bounds Write (CWE-787)
value: Buffer overflow in the tenc_box_read function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file, related invalid IV sizes.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2021-04-19T19:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/box_code_drm.c
Commit date: 2021-03-11 15:37:21 +0100
Commit message: fixed #1703

Diff: diff --git a/src/isomedia/box_code_drm.c b/src/isomedia/box_code_drm.c
index dd867f2f585..6ffc99b0f32 100644
--- a/src/isomedia/box_code_drm.c
+++ b/src/isomedia/box_code_drm.c
@@ -874,12 +874,21 @@ GF_Err tenc_box_read(GF_Box *s, GF_BitStream *bs)
 	gf_bs_read_data(bs, ptr->key_info+4, 16);
 	if (!iv_size && ptr->isProtected) {
 		ISOM_DECREASE_SIZE(ptr, 1);
 		iv_size = ptr->key_info[20] = gf_bs_read_u8(bs);
 		ISOM_DECREASE_SIZE(ptr, ptr->key_info[20]);
+		if ((iv_size!=8) && (iv_size!=16)) {
+			GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[iso file] Invalid constant IV size %d, must be 8 or 16\n", (u32) iv_size));
+			ptr->key_info[20] = 16;
+			return GF_NON_COMPLIANT_BITSTREAM;
+		}
 		gf_bs_read_data(bs, ptr->key_info+21, iv_size);
 	}
+	else if ((iv_size!=0) && (iv_size!=8) && (iv_size!=16)) {
+		GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[iso file] Invalid IV size %d, must be 0, 8 or 16\n", (u32) iv_size));
+		return GF_NON_COMPLIANT_BITSTREAM;
+	}
 	return GF_OK;
 }
 
 #ifndef GPAC_DISABLE_ISOM_WRITE
 

Fixed code: 		if ((iv_size!=8) && (iv_size!=16)) {
			GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[iso file] Invalid constant IV size %d, must be 8 or 16\n", (u32) iv_size));
			ptr->key_info[20] = 16;
			return GF_NON_COMPLIANT_BITSTREAM;
		}
	else if ((iv_size!=0) && (iv_size!=8) && (iv_size!=16)) {
		GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[iso file] Invalid IV size %d, must be 0, 8 or 16\n", (u32) iv_size));
		return GF_NON_COMPLIANT_BITSTREAM;
	}
CVE-2021-31256: Missing Release of Memory after Effective Lifetime (CWE-401)
value: Memory leak in the stbl_GetSampleInfos function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 5.5
Published: 2021-04-19T19:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/stbl_read.c
Commit date: 2021-03-12 11:46:56 +0100
Commit message: fixed #1705

Diff: diff --git a/src/isomedia/stbl_read.c b/src/isomedia/stbl_read.c
index ebfbe62abec..384d4f78271 100644
--- a/src/isomedia/stbl_read.c
+++ b/src/isomedia/stbl_read.c
@@ -417,15 +417,17 @@ GF_Err stbl_GetSampleInfos(GF_SampleTableBox *stbl, u32 sampleNumber, u64 *offse
 		(*chunkNumber) = sampleNumber;
 		if (out_ent) *out_ent = ent;
 		if ( stbl->ChunkOffset->type == GF_ISOM_BOX_TYPE_STCO) {
 			stco = (GF_ChunkOffsetBox *)stbl->ChunkOffset;
 			if (!stco->offsets) return GF_ISOM_INVALID_FILE;
+			if (stco->nb_entries < sampleNumber) return GF_ISOM_INVALID_FILE;
 
 			(*offset) = (u64) stco->offsets[sampleNumber - 1];
 		} else {
 			co64 = (GF_ChunkLargeOffsetBox *)stbl->ChunkOffset;
 			if (!co64->offsets) return GF_ISOM_INVALID_FILE;
+			if (co64->nb_entries < sampleNumber) return GF_ISOM_INVALID_FILE;
 
 			(*offset) = co64->offsets[sampleNumber - 1];
 		}
 		return GF_OK;
 	}

Fixed code: 			if (stco->nb_entries < sampleNumber) return GF_ISOM_INVALID_FILE;
			if (co64->nb_entries < sampleNumber) return GF_ISOM_INVALID_FILE;
CVE-2021-31257: NULL Pointer Dereference (CWE-476)
value: The HintFile function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2021-04-19T19:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: applications/mp4box/main.c
Commit date: 2021-04-08 10:09:46 +0200
Commit message: fixed #1734

Diff: diff --git a/applications/mp4box/main.c b/applications/mp4box/main.c
index 3f30bfc8b6a..fc71e2ae2f0 100644
--- a/applications/mp4box/main.c
+++ b/applications/mp4box/main.c
@@ -3368,11 +3368,11 @@ GF_Err HintFile(GF_ISOFile *file, u32 MTUSize, u32 max_ptime, u32 rtp_rate, u32
 			media_prio = 1;
 		}
 
 		streamType = 0;
 		esd = gf_isom_get_esd(file, i+1, 1);
-		if (esd) {
+		if (esd && esd->decoderConfig) {
 			streamType = esd->decoderConfig->streamType;
 			if (!prev_ocr) {
 				prev_ocr = esd->OCRESID;
 				if (!esd->OCRESID) prev_ocr = esd->ESID;
 			} else if (esd->OCRESID && prev_ocr != esd->OCRESID) {

Vulnerable code: 		if (esd) {
Fixed code: 		if (esd && esd->decoderConfig) {
CVE-2021-31259: NULL Pointer Dereference (CWE-476)
value: The gf_isom_cenc_get_default_info_internal function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2021-04-19T19:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/drm_sample.c
Commit date: 2021-04-08 10:13:35 +0200
Commit message: fixed #1735

Diff: diff --git a/src/isomedia/drm_sample.c b/src/isomedia/drm_sample.c
index 5db63d055db..f8f4d7ac5db 100644
--- a/src/isomedia/drm_sample.c
+++ b/src/isomedia/drm_sample.c
@@ -1684,11 +1684,11 @@ void gf_isom_cenc_get_default_info_internal(GF_TrackBox *trak, u32 sampleDescrip
 			if (sgdesc->grouping_type!=GF_ISOM_SAMPLE_GROUP_SEIG) continue;
 			if (sgdesc->default_description_index)
 				seig_entry = gf_list_get(sgdesc->group_descriptions, sgdesc->default_description_index-1);
 			else
 				seig_entry = gf_list_get(sgdesc->group_descriptions, 0);
-			if (!seig_entry->key_info[0])
+			if (seig_entry && !seig_entry->key_info[0])
 				seig_entry = NULL;
 			break;
 		}
 		if (seig_entry) {
 			if (default_IsEncrypted) *default_IsEncrypted = seig_entry->IsProtected;

Vulnerable code: 			if (!seig_entry->key_info[0])
Fixed code: 			if (seig_entry && !seig_entry->key_info[0])
CVE-2021-31260: NULL Pointer Dereference (CWE-476)
value: The MergeTrack function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2021-04-19T19:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/track.c
Commit date: 2021-04-08 10:21:26 +0200
Commit message: fixed #1736

Diff: diff --git a/src/isomedia/track.c b/src/isomedia/track.c
index 881bb1b1f55..5b793e6d8fe 100644
--- a/src/isomedia/track.c
+++ b/src/isomedia/track.c
@@ -1033,14 +1033,17 @@ GF_Err MergeTrack(GF_TrackBox *trak, GF_TrackFragmentBox *traf, GF_MovieFragment
 
 				/*if we have only 1 sai_offsets, assume that its type is cenc*/
 				if ((aux_info_type == GF_ISOM_CENC_SCHEME) || (aux_info_type == GF_ISOM_CBC_SCHEME) ||
 					(aux_info_type == GF_ISOM_CENS_SCHEME) || (aux_info_type == GF_ISOM_CBCS_SCHEME) ||
 					(gf_list_count(traf->sai_offsets) == 1)) {
-					offset = saio->offsets[0] + moof_offset;
-					nb_saio = saio->entry_count;
-					break;
+					if (saio->offsets && saio->entry_count) {
+						offset = saio->offsets[0] + moof_offset;
+						nb_saio = saio->entry_count;
+						break;
+					}
 				}
+				saio = NULL;
 			}
 			for (i = 0; i < gf_list_count(traf->sai_sizes); i++) {
 				saiz = (GF_SampleAuxiliaryInfoSizeBox *)gf_list_get(traf->sai_sizes, i);
 				aux_info_type = saiz->aux_info_type;
 				if (!aux_info_type) aux_info_type = scheme_type;
@@ -1048,10 +1051,11 @@ GF_Err MergeTrack(GF_TrackBox *trak, GF_TrackFragmentBox *traf, GF_MovieFragment
 				if ((aux_info_type == GF_ISOM_CENC_SCHEME) || (aux_info_type == GF_ISOM_CBC_SCHEME) ||
 					(aux_info_type == GF_ISOM_CENS_SCHEME) || (aux_info_type == GF_ISOM_CBCS_SCHEME) ||
 					(gf_list_count(traf->sai_sizes) == 1)) {
 					break;
 				}
+				saiz = NULL;
 			}
 			if (saiz && saio && senc) {
 				for (i = 0; i < saiz->sample_count; i++) {
 					GF_CENCSampleAuxInfo *sai;
 					const u8 *key_info=NULL;

Vulnerable code: 					offset = saio->offsets[0] + moof_offset;
					nb_saio = saio->entry_count;
					break;
Fixed code: 					if (saio->offsets && saio->entry_count) {
						offset = saio->offsets[0] + moof_offset;
						nb_saio = saio->entry_count;
						break;
					}
				saio = NULL;
				saiz = NULL;
CVE-2021-31261: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The gf_hinter_track_new function in GPAC 1.0.1 allows attackers to read memory via a crafted file in the MP4Box command.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 5.5
Published: 2021-04-19T19:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/media_tools/isom_hinter.c
Commit date: 2021-04-09 11:12:47 +0200
Commit message: fixed #1737

Diff: diff --git a/src/media_tools/isom_hinter.c b/src/media_tools/isom_hinter.c
index 6aeb9d17211..6c4da454a95 100644
--- a/src/media_tools/isom_hinter.c
+++ b/src/media_tools/isom_hinter.c
@@ -400,12 +400,13 @@ GF_RTPHinter *gf_hinter_track_new(GF_ISOFile *file, u32 TrackNum,
 				}
 				/*systems streams*/
 				else if (gf_isom_has_sync_shadows(file, TrackNum) || gf_isom_has_sample_dependency(file, TrackNum)) {
 					flags |= GP_RTP_PCK_SYSTEMS_CAROUSEL;
 				}
-				gf_odf_desc_del((GF_Descriptor*)esd);
 			}
+			if (esd)
+				gf_odf_desc_del((GF_Descriptor*)esd);
 			break;
 		case GF_ISOM_SUBTYPE_3GP_H263:
 			hintType = GF_RTP_PAYT_H263;
 			required_rate = 90000;
 			streamType = GF_STREAM_VISUAL;

Vulnerable code: 				gf_odf_desc_del((GF_Descriptor*)esd);
Fixed code: 			if (esd)
				gf_odf_desc_del((GF_Descriptor*)esd);
CVE-2021-31262: NULL Pointer Dereference (CWE-476)
value: The AV1_DuplicateConfig function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2021-04-19T19:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/avc_ext.c
Commit date: 2021-04-09 11:17:40 +0200
Commit message: fixed #1738

Diff: diff --git a/src/isomedia/avc_ext.c b/src/isomedia/avc_ext.c
index 741f8055f1c..d5a40023c6a 100644
--- a/src/isomedia/avc_ext.c
+++ b/src/isomedia/avc_ext.c
@@ -1336,11 +1336,12 @@ static GF_Err gf_isom_check_mvc(GF_ISOFile *the_file, GF_TrackBox *trak, GF_MPEG
 	}
 
 	return GF_OK;
 }
 
-static GF_AV1Config* AV1_DuplicateConfig(GF_AV1Config const * const cfg) {
+static GF_AV1Config* AV1_DuplicateConfig(GF_AV1Config const * const cfg)
+{
 	u32 i = 0;
 	GF_AV1Config *out = gf_malloc(sizeof(GF_AV1Config));
 
 	out->marker = cfg->marker;
 	out->version = cfg->version;
@@ -1380,11 +1381,11 @@ void AV1_RewriteESDescriptorEx(GF_MPEGVisualSampleEntryBox *av1, GF_MediaBox *md
 	if (btrt) {
 		av1->emul_esd->decoderConfig->bufferSizeDB = btrt->bufferSizeDB;
 		av1->emul_esd->decoderConfig->avgBitrate = btrt->avgBitrate;
 		av1->emul_esd->decoderConfig->maxBitrate = btrt->maxBitrate;
 	}
-	if (av1->av1_config) {
+	if (av1->av1_config && av1->av1_config->config) {
 		GF_AV1Config *av1_cfg = AV1_DuplicateConfig(av1->av1_config->config);
 		if (av1_cfg) {
 			gf_odf_av1_cfg_write(av1_cfg, &av1->emul_esd->decoderConfig->decoderSpecificInfo->data, &av1->emul_esd->decoderConfig->decoderSpecificInfo->dataLength);
 			gf_odf_av1_cfg_del(av1_cfg);
 		}
@@ -2404,11 +2405,11 @@ GF_AV1Config *gf_isom_av1_config_get(GF_ISOFile *the_file, u32 trackNumber, u32
 		}
 	}
 	trak = gf_isom_get_track_from_file(the_file, trackNumber);
 	if (!trak || !trak->Media || !DescriptionIndex) return NULL;
 	entry = (GF_MPEGVisualSampleEntryBox*)gf_list_get(trak->Media->information->sampleTable->SampleDescription->child_boxes, DescriptionIndex - 1);
-	if (!entry || !entry->av1_config) return NULL;
+	if (!entry || !entry->av1_config|| !entry->av1_config->config) return NULL;
 	return AV1_DuplicateConfig(entry->av1_config->config);
 }
 
 GF_EXPORT
 GF_VPConfig *gf_isom_vp_config_get(GF_ISOFile *the_file, u32 trackNumber, u32 DescriptionIndex)

Vulnerable code: static GF_AV1Config* AV1_DuplicateConfig(GF_AV1Config const * const cfg) {
	if (av1->av1_config) {
	if (!entry || !entry->av1_config) return NULL;
Fixed code: static GF_AV1Config* AV1_DuplicateConfig(GF_AV1Config const * const cfg)
{
	if (av1->av1_config && av1->av1_config->config) {
	if (!entry || !entry->av1_config|| !entry->av1_config->config) return NULL;
CVE-2021-32135: NULL Pointer Dereference (CWE-476)
value: The trak_box_size function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2021-09-13T15:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/box_code_base.c
Commit date: 2021-04-23 14:37:01 +0200
Commit message: fixed #1757

Diff: diff --git a/src/isomedia/box_code_base.c b/src/isomedia/box_code_base.c
index 752bd5464fa..5964aa45067 100644
--- a/src/isomedia/box_code_base.c
+++ b/src/isomedia/box_code_base.c
@@ -6741,10 +6741,12 @@ GF_Err trak_box_size(GF_Box *s)
 {
 	u32 pos=0;
 	GF_TrackBox *ptr = (GF_TrackBox *)s;
 
 	if (ptr->sample_encryption && ptr->sample_encryption->load_needed) {
+		if (!ptr->moov || !!ptr->moov->mov || !ptr->moov->mov->movieFileMap)
+			return GF_ISOM_INVALID_FILE;
 		GF_Err e = senc_Parse(ptr->moov->mov->movieFileMap->bs, ptr, NULL, ptr->sample_encryption);
 		if (e) return e;
 	}
 
 	gf_isom_check_position(s, (GF_Box *)ptr->Header, &pos);

Fixed code: 		if (!ptr->moov || !!ptr->moov->mov || !ptr->moov->mov->movieFileMap)
			return GF_ISOM_INVALID_FILE;
CVE-2021-32136: Out-of-bounds Write (CWE-787)
value: Heap buffer overflow in the print_udta function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2021-09-13T13:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: applications/mp4box/filedump.c
Commit date: 2021-04-30 10:37:24 +0200
Commit message: fixed #1765

Diff: diff --git a/applications/mp4box/filedump.c b/applications/mp4box/filedump.c
index 77cf6fc7bf0..050121d524e 100644
--- a/applications/mp4box/filedump.c
+++ b/applications/mp4box/filedump.c
@@ -1893,16 +1893,22 @@ void print_udta(GF_ISOFile *file, u32 track_number, Bool has_itags)
 		for (j=0; j<nb_items; j++) {
 			u8 *udta=NULL;
 			u32 udta_size;
 			gf_isom_get_user_data(file, track_number, type, uuid, j+1, &udta, &udta_size);
 			if (!udta) continue;
-			if (gf_utf8_is_legal(udta, udta_size)) {
+			if (udta_size && gf_utf8_is_legal(udta, udta_size)) {
+				u32 idx;
 				if (first) {
 					fprintf(stderr, "\n");
 					first = GF_FALSE;
 				}
-				fprintf(stderr, "\t%s\n", (char *) udta);
+				fprintf(stderr, "\t");
+				for (idx=0; idx<udta_size; idx++) {
+					if (!udta[idx]) break;
+					fprintf(stderr, "%c", udta[idx]);
+				}
+				fprintf(stderr, "\n");
 			}
 			gf_free(udta);
 		}
 	}
 	fprintf(stderr, "\n");

Vulnerable code: 			if (gf_utf8_is_legal(udta, udta_size)) {
				fprintf(stderr, "\t%s\n", (char *) udta);
Fixed code: 			if (udta_size && gf_utf8_is_legal(udta, udta_size)) {
				u32 idx;
				fprintf(stderr, "\t");
				for (idx=0; idx<udta_size; idx++) {
					if (!udta[idx]) break;
					fprintf(stderr, "%c", udta[idx]);
				}
				fprintf(stderr, "\n");
CVE-2021-32137: Out-of-bounds Write (CWE-787)
value: Heap buffer overflow in the URL_GetProtocolType function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2021-09-13T14:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/media.c
Commit date: 2021-04-30 10:43:32 +0200
Commit message: fixed #1766 (fuzz)

Diff: diff --git a/src/isomedia/media.c b/src/isomedia/media.c
index 26b9af8de4a..7ce8d1d01f6 100644
--- a/src/isomedia/media.c
+++ b/src/isomedia/media.c
@@ -672,23 +672,24 @@ GF_Err Media_GetSample(GF_MediaBox *mdia, u32 sampleNumber, GF_ISOSample **samp,
 
 
 
 GF_Err Media_CheckDataEntry(GF_MediaBox *mdia, u32 dataEntryIndex)
 {
-
 	GF_DataEntryURLBox *entry;
 	GF_DataMap *map;
 	GF_Err e;
 	if (!mdia || !dataEntryIndex || dataEntryIndex > gf_list_count(mdia->information->dataInformation->dref->child_boxes)) return GF_BAD_PARAM;
 
 	entry = (GF_DataEntryURLBox*)gf_list_get(mdia->information->dataInformation->dref->child_boxes, dataEntryIndex - 1);
 	if (!entry) return GF_ISOM_INVALID_FILE;
 	if (entry->flags == 1) return GF_OK;
 
 	//ok, not self contained, let's go for it...
-	//we don't know what's a URN yet
-	if (entry->type == GF_ISOM_BOX_TYPE_URN) return GF_NOT_SUPPORTED;
+	//we only support alias and URL boxes
+	if ((entry->type != GF_ISOM_BOX_TYPE_URL) && (entry->type != GF_QT_BOX_TYPE_ALIS) )
+		return GF_NOT_SUPPORTED;
+
 	if (mdia->mediaTrack->moov->mov->openMode == GF_ISOM_OPEN_WRITE) {
 		e = gf_isom_datamap_new(entry->location, NULL, GF_ISOM_DATA_MAP_READ, &map);
 	} else {
 		e = gf_isom_datamap_new(entry->location, mdia->mediaTrack->moov->mov->fileName, GF_ISOM_DATA_MAP_READ, &map);
 	}

Vulnerable code: 
	//we don't know what's a URN yet
	if (entry->type == GF_ISOM_BOX_TYPE_URN) return GF_NOT_SUPPORTED;
Fixed code: 	//we only support alias and URL boxes
	if ((entry->type != GF_ISOM_BOX_TYPE_URL) && (entry->type != GF_QT_BOX_TYPE_ALIS) )
		return GF_NOT_SUPPORTED;
CVE-2021-32268: Out-of-bounds Write (CWE-787)
value: Buffer overflow vulnerability in function gf_fprintf in os_file.c in gpac before 1.0.1 allows attackers to execute arbitrary code. The fixed version is 1.0.1.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2021-09-20T16:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/box_code_base.c
Commit date: 2020-09-07 09:20:37 +0200
Commit message: fixed #1587

Diff: diff --git a/src/isomedia/box_code_base.c b/src/isomedia/box_code_base.c
index 36b54ccb00e..c79cfcc8e03 100644
--- a/src/isomedia/box_code_base.c
+++ b/src/isomedia/box_code_base.c
@@ -578,10 +578,14 @@ GF_Err url_box_read(GF_Box *s, GF_BitStream *bs)
 
 	if (ptr->size) {
 		ptr->location = (char*)gf_malloc((u32) ptr->size);
 		if (! ptr->location) return GF_OUT_OF_MEM;
 		gf_bs_read_data(bs, ptr->location, (u32)ptr->size);
+		if (ptr->location[ptr->size-1]) {
+			GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[iso file] url box location is not 0-terminated\n" ));
+			return GF_ISOM_INVALID_FILE;
+		}
 	}
 	return GF_OK;
 }
 
 GF_Box *url_box_new()

Fixed code: 		if (ptr->location[ptr->size-1]) {
			GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[iso file] url box location is not 0-terminated\n" ));
			return GF_ISOM_INVALID_FILE;
		}
CVE-2021-32437: NULL Pointer Dereference (CWE-476)
value: The gf_hinter_finalize function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2021-08-11T20:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/media_tools/isom_hinter.c
Commit date: 2021-04-30 10:53:53 +0200
Commit message: fixed #1770 (fuzz)

Diff: diff --git a/src/media_tools/isom_hinter.c b/src/media_tools/isom_hinter.c
index c05d38ccca8..9bff67767a5 100644
--- a/src/media_tools/isom_hinter.c
+++ b/src/media_tools/isom_hinter.c
@@ -1231,11 +1231,11 @@ GF_Err gf_hinter_finalize(GF_ISOFile *file, GF_SDP_IODProfile IOD_Profile, u32 b
 		}
 
 		esd = gf_isom_get_esd(file, sceneT, 1);
 		if (gf_isom_get_sample_count(file, sceneT)==1) {
 			samp = gf_isom_get_sample(file, sceneT, 1, &descIndex);
-			if (gf_hinter_can_embbed_data(samp->data, samp->dataLength, GF_STREAM_SCENE)) {
+			if (samp && gf_hinter_can_embbed_data(samp->data, samp->dataLength, GF_STREAM_SCENE)) {
 
 				slc.timeScale = slc.timestampResolution = gf_isom_get_media_timescale(file, sceneT);
 				slc.OCRResolution = 1000;
 				slc.startCTS = samp->DTS+samp->CTS_Offset;
 				slc.startDTS = samp->DTS;

Vulnerable code: 			if (gf_hinter_can_embbed_data(samp->data, samp->dataLength, GF_STREAM_SCENE)) {
Fixed code: 			if (samp && gf_hinter_can_embbed_data(samp->data, samp->dataLength, GF_STREAM_SCENE)) {
CVE-2021-32438: NULL Pointer Dereference (CWE-476)
value: The gf_media_export_filters function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2021-08-11T20:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/media_tools/media_export.c
Commit date: 2021-04-30 10:50:38 +0200
Commit message: fixed #1769 (fuzz)

Diff: diff --git a/src/media_tools/media_export.c b/src/media_tools/media_export.c
index b89936f83ca..968818da31e 100644
--- a/src/media_tools/media_export.c
+++ b/src/media_tools/media_export.c
@@ -1106,11 +1106,11 @@ static GF_Err gf_media_export_filters(GF_MediaExporter *dumper)
 			GF_LOG(GF_LOG_ERROR, GF_LOG_AUTHOR, ("[Exporter] No tracks with ID %d in file\n", dumper->trackID));
 			return GF_BAD_PARAM;
 		}
 		esd = gf_media_map_esd(dumper->file, track_num, 0);
 		sample_count = gf_isom_get_sample_count(dumper->file, dumper->trackID);
-		if (esd) {
+		if (esd && esd->decoderConfig) {
 			if (esd->decoderConfig->objectTypeIndication<GF_CODECID_LAST_MPEG4_MAPPING) {
 				codec_id = gf_codecid_from_oti(esd->decoderConfig->streamType, esd->decoderConfig->objectTypeIndication);
 #ifndef GPAC_DISABLE_AV_PARSERS
 				if (esd->decoderConfig->decoderSpecificInfo && (codec_id==GF_CODECID_AAC_MPEG4)) {
 					GF_M4ADecSpecInfo acfg;

Vulnerable code: 		if (esd) {
Fixed code: 		if (esd && esd->decoderConfig) {
CVE-2021-33361: Missing Release of Memory after Effective Lifetime (CWE-401)
value: Memory leak in the afra_box_read function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 5.5
Published: 2021-09-13T20:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: applications/mp4box/main.c, src/isomedia/box_code_adobe.c
Commit date: 2021-05-10 11:14:03 +0200
Commit message: fixed #1782 (fuzz)

Diff: diff --git a/applications/mp4box/main.c b/applications/mp4box/main.c
index e0215f77ed5..db6c067796d 100644
--- a/applications/mp4box/main.c
+++ b/applications/mp4box/main.c
@@ -5437,10 +5437,18 @@ static u32 mp4box_cleanup(u32 ret_code) {
 		gf_free(dash_inputs);
 		dash_inputs = NULL;
 	}
 	if (logfile) gf_fclose(logfile);
 	gf_sys_close();
+
+#ifdef GPAC_MEMORY_TRACKING
+	if (mem_track && (gf_memory_size() || gf_file_handles_count() )) {
+		gf_log_set_tool_level(GF_LOG_MEMORY, GF_LOG_INFO);
+		gf_memory_print();
+	}
+#endif
+
 	return ret_code;
 }
 
 
 
diff --git a/src/isomedia/box_code_adobe.c b/src/isomedia/box_code_adobe.c
index fe46191915f..bb80f3ce89e 100644
--- a/src/isomedia/box_code_adobe.c
+++ b/src/isomedia/box_code_adobe.c
@@ -406,30 +406,31 @@ GF_Err afra_box_read(GF_Box *s, GF_BitStream *bs)
 		return GF_ISOM_INVALID_FILE;
 
 	for (i=0; i<ptr->entry_count; i++) {
 		GF_AfraEntry *ae = gf_malloc(sizeof(GF_AfraEntry));
 		if (!ae) return GF_OUT_OF_MEM;
+		gf_list_insert(ptr->local_access_entries, ae, i);
 
 		ISOM_DECREASE_SIZE(ptr, 8)
 		ae->time = gf_bs_read_u64(bs);
 		if (ptr->long_offsets) {
 			ISOM_DECREASE_SIZE(ptr, 8)
 			ae->offset = gf_bs_read_u64(bs);
 		} else {
 			ISOM_DECREASE_SIZE(ptr, 4)
 			ae->offset = gf_bs_read_u32(bs);
 		}
-
-		gf_list_insert(ptr->local_access_entries, ae, i);
 	}
 
 	if (ptr->global_entries) {
 		ISOM_DECREASE_SIZE(ptr, 4)
 		ptr->global_entry_count = gf_bs_read_u32(bs);
 		for (i=0; i<ptr->global_entry_count; i++) {
 			GF_GlobalAfraEntry *ae = gf_malloc(sizeof(GF_GlobalAfraEntry));
 			if (!ae) return GF_OUT_OF_MEM;
+			gf_list_insert(ptr->global_access_entries, ae, i);
+
 			ISOM_DECREASE_SIZE(ptr, 8)
 			ae->time = gf_bs_read_u64(bs);
 			if (ptr->long_ids) {
 				ISOM_DECREASE_SIZE(ptr, 8)
 				ae->segment = gf_bs_read_u32(bs);
@@ -446,12 +447,10 @@ GF_Err afra_box_read(GF_Box *s, GF_BitStream *bs)
 			} else {
 				ISOM_DECREASE_SIZE(ptr, 8)
 				ae->afra_offset = gf_bs_read_u32(bs);
 				ae->offset_from_afra = gf_bs_read_u32(bs);
 			}
-
-			gf_list_insert(ptr->global_access_entries, ae, i);
 		}
 	}
 
 	return GF_OK;
 }

Vulnerable code: 
		gf_list_insert(ptr->local_access_entries, ae, i);

			gf_list_insert(ptr->global_access_entries, ae, i);
Fixed code: 
#ifdef GPAC_MEMORY_TRACKING
	if (mem_track && (gf_memory_size() || gf_file_handles_count() )) {
		gf_log_set_tool_level(GF_LOG_MEMORY, GF_LOG_INFO);
		gf_memory_print();
	}
#endif

		gf_list_insert(ptr->local_access_entries, ae, i);
			gf_list_insert(ptr->global_access_entries, ae, i);
CVE-2021-33362: Out-of-bounds Write (CWE-787)
value: Stack buffer overflow in the hevc_parse_vps_extension function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2021-09-13T19:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/media_tools/av_parsers.c
Commit date: 2021-05-10 10:56:28 +0200
Commit message: fixed #1780 (fuzz)

Diff: diff --git a/src/media_tools/av_parsers.c b/src/media_tools/av_parsers.c
index 49f3900985b..d9d13d0a750 100644
--- a/src/media_tools/av_parsers.c
+++ b/src/media_tools/av_parsers.c
@@ -7473,10 +7473,15 @@ static Bool hevc_parse_vps_extension(HEVC_VPS *vps, GF_BitStream *bs)
 		default_output_layer_idc = gf_bs_read_int_log(bs, 2, "default_output_layer_idc");
 		default_output_layer_idc = default_output_layer_idc < 2 ? default_output_layer_idc : 2;
 	}
 	vps->num_output_layer_sets = num_add_olss + NumLayerSets;
 
+	if (vps->num_output_layer_sets > MAX_LHVC_LAYERS) {
+		GF_LOG(GF_LOG_ERROR, GF_LOG_CODING, ("[HEVC] Wrong number of output layer sets in VPS %d, max %d supported\n", vps->num_output_layer_sets, MAX_LHVC_LAYERS));
+		vps->num_output_layer_sets = 1;
+		return GF_FALSE;
+	}
 
 	layer_set_idx_for_ols_minus1[0] = 1;
 	vps->output_layer_flag[0][0] = 1;
 
 	for (i = 0; i < vps->num_output_layer_sets; i++) {

Fixed code: 	if (vps->num_output_layer_sets > MAX_LHVC_LAYERS) {
		GF_LOG(GF_LOG_ERROR, GF_LOG_CODING, ("[HEVC] Wrong number of output layer sets in VPS %d, max %d supported\n", vps->num_output_layer_sets, MAX_LHVC_LAYERS));
		vps->num_output_layer_sets = 1;
		return GF_FALSE;
	}
CVE-2021-33363: Missing Release of Memory after Effective Lifetime (CWE-401)
value: Memory leak in the infe_box_read function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 5.5
Published: 2021-09-13T20:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/box_code_meta.c
Commit date: 2021-05-10 11:31:19 +0200
Commit message: fixed #1786 (fuzz)

Diff: diff --git a/src/isomedia/box_code_meta.c b/src/isomedia/box_code_meta.c
index c8435b9f88a..e3f0556c006 100644
--- a/src/isomedia/box_code_meta.c
+++ b/src/isomedia/box_code_meta.c
@@ -564,14 +564,17 @@ GF_Err infe_box_read(GF_Box *s, GF_BitStream *bs)
 				memcpy(ptr->item_name, buf+string_start, string_len);
 			} else if (!ptr->content_type) {
 				ptr->content_type = (char*)gf_malloc(sizeof(char)*string_len);
 				if (!ptr->content_type) return GF_OUT_OF_MEM;
 				memcpy(ptr->content_type, buf+string_start, string_len);
-			} else {
+			} else if (!ptr->content_encoding) {
 				ptr->content_encoding = (char*)gf_malloc(sizeof(char)*string_len);
 				if (!ptr->content_encoding) return GF_OUT_OF_MEM;
 				memcpy(ptr->content_encoding, buf+string_start, string_len);
+			} else {
+				//we could throw an error but we silently accept this infe
+				break;
 			}
 			string_start += string_len;
 			string_len = 0;
 			if (ptr->content_encoding && ptr->version == 1) {
 				break;

Vulnerable code: 			} else {
Fixed code: 			} else if (!ptr->content_encoding) {
			} else {
				//we could throw an error but we silently accept this infe
				break;
CVE-2021-33364: Missing Release of Memory after Effective Lifetime (CWE-401)
value: Memory leak in the def_parent_box_new function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 5.5
Published: 2021-09-13T19:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/isom_intern.c
Commit date: 2021-05-10 11:18:59 +0200
Commit message: fixed #1783 (fuzz)

Diff: diff --git a/src/isomedia/isom_intern.c b/src/isomedia/isom_intern.c
index e7c41d69b3f..74ee92f765a 100644
--- a/src/isomedia/isom_intern.c
+++ b/src/isomedia/isom_intern.c
@@ -495,10 +495,11 @@ static GF_Err gf_isom_parse_movie_boxes_internal(GF_ISOFile *mov, u32 *boxType,
 					gf_isom_box_del((GF_Box *) mov->brand);
 					mov->brand = brand;
 					if (pos<0) pos=0;
 					gf_list_insert(mov->TopBoxes, brand, pos);
 				}
+				gf_isom_box_del(a);
 			}
 			break;
 
 		case GF_ISOM_BOX_TYPE_PDIN:
 			/*ONE AND ONLY ONE PDIN*/

Fixed code: 				gf_isom_box_del(a);
CVE-2021-33365: Missing Release of Memory after Effective Lifetime (CWE-401)
value: Memory leak in the gf_isom_get_root_od function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 5.5
Published: 2021-09-13T20:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/isom_read.c
Commit date: 2021-05-10 11:24:17 +0200
Commit message: fixed #1784 (fuzz)

Diff: diff --git a/src/isomedia/isom_read.c b/src/isomedia/isom_read.c
index 2f4feb95a40..58e631f9181 100644
--- a/src/isomedia/isom_read.c
+++ b/src/isomedia/isom_read.c
@@ -692,11 +692,21 @@ GF_Descriptor *gf_isom_get_root_od(GF_ISOFile *movie)
 		return NULL;
 	}
 
 	//duplicate our descriptor
 	movie->LastError = gf_odf_desc_copy((GF_Descriptor *) movie->moov->iods->descriptor, &desc);
-	if (movie->LastError) return NULL;
+	if (movie->LastError) {
+		if (od) {
+			gf_list_del(od->ESDescriptors);
+			gf_free(od);
+		}
+		if (iod) {
+			gf_list_del(iod->ESDescriptors);
+			gf_free(iod);
+		}
+		return NULL;
+	}
 
 	if (!useIOD) {
 		isom_od = (GF_IsomObjectDescriptor *)desc;
 		od->objectDescriptorID = isom_od->objectDescriptorID;
 		od->extensionDescriptors = isom_od->extensionDescriptors;

Vulnerable code: 	if (movie->LastError) return NULL;
Fixed code: 	if (movie->LastError) {
		if (od) {
			gf_list_del(od->ESDescriptors);
			gf_free(od);
		}
		if (iod) {
			gf_list_del(iod->ESDescriptors);
			gf_free(iod);
		}
		return NULL;
	}
CVE-2021-33366: Missing Release of Memory after Effective Lifetime (CWE-401)
value: Memory leak in the gf_isom_oinf_read_entry function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 5.5
Published: 2021-09-13T19:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/avc_ext.c
Commit date: 2021-05-10 11:26:57 +0200
Commit message: fixed #1785 (fuzz)

Diff: diff --git a/src/isomedia/avc_ext.c b/src/isomedia/avc_ext.c
index a3674510bbf..0e7d96a9679 100644
--- a/src/isomedia/avc_ext.c
+++ b/src/isomedia/avc_ext.c
@@ -3371,12 +3371,14 @@ GF_Err gf_isom_oinf_read_entry(void *entry, GF_BitStream *bs)
 		GF_SAFEALLOC(op, LHEVC_OperatingPoint);
 		if (!op) return GF_OUT_OF_MEM;
 		op->output_layer_set_idx = gf_bs_read_u16(bs);
 		op->max_temporal_id = gf_bs_read_u8(bs);
 		op->layer_count = gf_bs_read_u8(bs);
-		if (op->layer_count > GF_ARRAY_LENGTH(op->layers_info))
+		if (op->layer_count > GF_ARRAY_LENGTH(op->layers_info)) {
+			gf_free(op);
 			return GF_NON_COMPLIANT_BITSTREAM;
+		}
 		for (j = 0; j < op->layer_count; j++) {
 			op->layers_info[j].ptl_idx = gf_bs_read_u8(bs);
 			op->layers_info[j].layer_id = gf_bs_read_int(bs, 6);
 			op->layers_info[j].is_outputlayer = gf_bs_read_int(bs, 1) ? GF_TRUE : GF_FALSE;
 			op->layers_info[j].is_alternate_outputlayer = gf_bs_read_int(bs, 1) ? GF_TRUE : GF_FALSE;

Vulnerable code: 		if (op->layer_count > GF_ARRAY_LENGTH(op->layers_info))
Fixed code: 		if (op->layer_count > GF_ARRAY_LENGTH(op->layers_info)) {
			gf_free(op);
		}