Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2021-4043: NULL Pointer Dereference (CWE-476)
value: NULL Pointer Dereference in GitHub repository gpac/gpac prior to 1.1.0.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2022-02-04T23:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/box_code_base.c
Commit date: 2022-02-01 15:28:23 +0100
Commit message: fixed #2092

Diff: diff --git a/src/isomedia/box_code_base.c b/src/isomedia/box_code_base.c
index b3c38310add9..126084b0ea98 100644
--- a/src/isomedia/box_code_base.c
+++ b/src/isomedia/box_code_base.c
@@ -11081,14 +11081,16 @@ GF_Box *gitn_box_new()
 void gitn_box_del(GF_Box *s)
 {
 	u32 i;
 	GroupIdToNameBox *ptr = (GroupIdToNameBox *)s;
 	if (ptr == NULL) return;
-	for (i=0; i<ptr->nb_entries; i++) {
-		if (ptr->entries[i].name) gf_free(ptr->entries[i].name);
+	if (ptr->entries) {
+		for (i=0; i<ptr->nb_entries; i++) {
+			if (ptr->entries[i].name) gf_free(ptr->entries[i].name);
+		}
+		gf_free(ptr->entries);
 	}
-	if (ptr->entries) gf_free(ptr->entries);
 	gf_free(ptr);
 }
 
 GF_Err gitn_box_read(GF_Box *s, GF_BitStream *bs)
 {

Vulnerable code: 	for (i=0; i<ptr->nb_entries; i++) {
		if (ptr->entries[i].name) gf_free(ptr->entries[i].name);
	if (ptr->entries) gf_free(ptr->entries);
Fixed code: 	if (ptr->entries) {
		for (i=0; i<ptr->nb_entries; i++) {
			if (ptr->entries[i].name) gf_free(ptr->entries[i].name);
		}
		gf_free(ptr->entries);
CVE-2021-40562: Incorrect Comparison (CWE-697)
value: A Segmentation fault caused by a floating point exception exists in Gpac through 1.0.1 using mp4box via the naludmx_enqueue_or_dispatch function in reframe_nalu.c, which causes a denial of service.
CWE description: The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
CVSS v3 base score: 5.5
Published: 2022-01-12T22:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/reframe_nalu.c
Commit date: 2021-08-30 17:26:28 +0200
Commit message: fixed #1901

Diff: diff --git a/src/filters/reframe_nalu.c b/src/filters/reframe_nalu.c
index aad8ad9640ce..812c8e1ec3a8 100644
--- a/src/filters/reframe_nalu.c
+++ b/src/filters/reframe_nalu.c
@@ -1350,13 +1350,13 @@ void naludmx_create_avc_decoder_config(GF_NALUDmxCtx *ctx, u8 **dsi, u32 *dsi_si
 					else if (ctx->avc_state->sei.pic_timing.pic_struct == 8)
 						DeltaTfiDivisorIdx = 6;
 					else
 						DeltaTfiDivisorIdx = (ctx->avc_state->sei.pic_timing.pic_struct+1) / 2;
 				}
-				if (!ctx->timescale) {
+				if (!ctx->timescale && sps->vui.time_scale && sps->vui.num_units_in_tick) {
 					ctx->cur_fps.num = 2 * sps->vui.time_scale;
-					ctx->cur_fps.den =  2 * sps->vui.num_units_in_tick * DeltaTfiDivisorIdx;
+					ctx->cur_fps.den = 2 * sps->vui.num_units_in_tick * DeltaTfiDivisorIdx;
 
 					if (!ctx->fps.num && ctx->dts==ctx->fps.den)
 						ctx->dts = ctx->cur_fps.den;
 				}
 				if (! sps->vui.fixed_frame_rate_flag)

Vulnerable code: 				if (!ctx->timescale) {
					ctx->cur_fps.den =  2 * sps->vui.num_units_in_tick * DeltaTfiDivisorIdx;
Fixed code: 				if (!ctx->timescale && sps->vui.time_scale && sps->vui.num_units_in_tick) {
					ctx->cur_fps.den = 2 * sps->vui.num_units_in_tick * DeltaTfiDivisorIdx;
CVE-2021-40563: NULL Pointer Dereference (CWE-476)
value: A Segmentation fault exists casued by null pointer dereference exists in Gpac through 1.0.1 via the naludmx_create_avc_decoder_config function in reframe_nalu.c when using mp4box, which causes a denial of service.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2022-01-12T22:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/reframe_nalu.c
Commit date: 2021-08-30 16:06:09 +0200
Commit message: fixed #1892

Diff: diff --git a/src/filters/reframe_nalu.c b/src/filters/reframe_nalu.c
index 507780581973..aad8ad9640ce 100644
--- a/src/filters/reframe_nalu.c
+++ b/src/filters/reframe_nalu.c
@@ -1678,12 +1678,14 @@ static GFINLINE void naludmx_update_time(GF_NALUDmxCtx *ctx)
 
 static void naludmx_queue_param_set(GF_NALUDmxCtx *ctx, char *data, u32 size, u32 ps_type, s32 ps_id)
 {
 	GF_List *list = NULL, *alt_list = NULL;
 	GF_NALUFFParam *sl;
-	u32 i, count;
-	u32 crc = gf_crc_32(data, size);
+	u32 i, count, crc;
+
+	if (!size) return;
+	crc = gf_crc_32(data, size);
 
 	if (ctx->codecid==GF_CODECID_HEVC) {
 		switch (ps_type) {
 		case GF_HEVC_NALU_VID_PARAM:
 			if (!ctx->vps) ctx->vps = gf_list_new();

Vulnerable code: 	u32 i, count;
	u32 crc = gf_crc_32(data, size);
Fixed code: 	u32 i, count, crc;

	if (!size) return;
	crc = gf_crc_32(data, size);
CVE-2021-40564: NULL Pointer Dereference (CWE-476)
value: A Segmentation fault caused by null pointer dereference vulnerability eists in Gpac through 1.0.2 via the avc_parse_slice function in av_parsers.c when using mp4box, which causes a denial of service.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2022-01-12T22:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/media_tools/av_parsers.c
Commit date: 2021-08-30 17:09:02 +0200
Commit message: fixed #1898

Diff: diff --git a/src/media_tools/av_parsers.c b/src/media_tools/av_parsers.c
index 4ea0db8a90dc..0cc096d1a3c2 100644
--- a/src/media_tools/av_parsers.c
+++ b/src/media_tools/av_parsers.c
@@ -4703,12 +4703,16 @@ u32 gf_bs_read_ue_log_idx3(GF_BitStream *bs, const char *fname, s32 idx1, s32 id
 		code = gf_bs_read_int(bs, 1);
 		bits++;
 	}
 
 	if (nb_lead) {
+		u32 leads=1;
 		val = gf_bs_read_int(bs, nb_lead);
-		val += (1 << nb_lead) - 1;
+		leads <<= nb_lead;
+		leads -= 1;
+		val += leads;
+//		val += (1 << nb_lead) - 1;
 		bits += nb_lead;
 	}
 
 	if (fname) {
 		gf_bs_log_idx(bs, bits, fname, val, idx1, idx2, idx3);
@@ -5669,11 +5673,11 @@ static s32 avc_parse_slice(GF_BitStream *bs, AVCState *avc, Bool svc_idr_flag, A
 	gf_bs_read_ue_log(bs, "first_mb_in_slice");
 	si->slice_type = gf_bs_read_ue_log(bs, "slice_type");
 	if (si->slice_type > 9) return -1;
 
 	pps_id = gf_bs_read_ue_log(bs, "pps_id");
-	if (pps_id > 255) return -1;
+	if ((pps_id<0) || (pps_id > 255)) return -1;
 	si->pps = &avc->pps[pps_id];
 	if (!si->pps->slice_group_count) return -2;
 	si->sps = &avc->sps[si->pps->sps_id];
 	if (!si->sps->log2_max_frame_num) return -2;
 	avc->sps_active_idx = si->pps->sps_id;

Vulnerable code: 		val += (1 << nb_lead) - 1;
	if (pps_id > 255) return -1;
Fixed code: 		u32 leads=1;
		leads <<= nb_lead;
		leads -= 1;
		val += leads;
//		val += (1 << nb_lead) - 1;
	if ((pps_id<0) || (pps_id > 255)) return -1;
CVE-2021-40565: NULL Pointer Dereference (CWE-476)
value: A Segmentation fault caused by a null pointer dereference vulnerability exists in Gpac through 1.0.1 via the gf_avc_parse_nalu function in av_parsers.c when using mp4box, which causes a denial of service.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2022-01-12T22:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/media_tools/av_parsers.c
Commit date: 2021-08-30 17:29:13 +0200
Commit message: fixed #1902

Diff: diff --git a/src/media_tools/av_parsers.c b/src/media_tools/av_parsers.c
index 96d279742021..1ab1a5373fb5 100644
--- a/src/media_tools/av_parsers.c
+++ b/src/media_tools/av_parsers.c
@@ -6111,11 +6111,12 @@ s32 gf_avc_parse_nalu(GF_BitStream *bs, AVCState *avc)
 		if ((avc->s_info.nal_ref_idc != n_state.nal_ref_idc) &&
 			(!avc->s_info.nal_ref_idc || !n_state.nal_ref_idc)) {
 			ret = 1;
 			break;
 		}
-		assert(avc->s_info.sps);
+		if (!avc->s_info.sps)
+			return -1;
 
 		if (avc->s_info.sps->poc_type == n_state.sps->poc_type) {
 			if (!avc->s_info.sps->poc_type) {
 				if (!n_state.bottom_field_flag && (avc->s_info.poc_lsb != n_state.poc_lsb)) {
 					ret = 1;

Vulnerable code: 		assert(avc->s_info.sps);
Fixed code: 		if (!avc->s_info.sps)
			return -1;
CVE-2021-40567: Insufficient Information (NVD-CWE-noinfo)
value: Segmentation fault vulnerability exists in Gpac through 1.0.1 via the gf_odf_size_descriptor function in desc_private.c when using mp4box, which causes a denial of service.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.5
Published: 2022-01-13T18:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/media_tools/isom_hinter.c
Commit date: 2021-08-30 14:53:51 +0200
Commit message: fixed #1885

Diff: diff --git a/src/media_tools/isom_hinter.c b/src/media_tools/isom_hinter.c
index eacef641fe76..6d823b1484b3 100644
--- a/src/media_tools/isom_hinter.c
+++ b/src/media_tools/isom_hinter.c
@@ -1239,11 +1239,11 @@ GF_Err gf_hinter_finalize(GF_ISOFile *file, GF_SDP_IODProfile IOD_Profile, u32 b
 
 		esd = gf_isom_get_esd(file, sceneT, 1);
 		if (gf_isom_get_sample_count(file, sceneT)==1) {
 			samp = gf_isom_get_sample(file, sceneT, 1, &descIndex);
 			if (samp && gf_hinter_can_embbed_data(samp->data, samp->dataLength, GF_STREAM_SCENE)) {
-
+				InitSL_NULL(&slc);
 				slc.timeScale = slc.timestampResolution = gf_isom_get_media_timescale(file, sceneT);
 				slc.OCRResolution = 1000;
 				slc.startCTS = samp->DTS+samp->CTS_Offset;
 				slc.startDTS = samp->DTS;
 				//set the SL for future extraction

Fixed code: 				InitSL_NULL(&slc);
CVE-2021-40569: Double Free (CWE-415)
value: The binary MP4Box in Gpac through 1.0.1 has a double-free vulnerability in the iloc_entry_del funciton in box_code_meta.c, which allows attackers to cause a denial of service.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 5.5
Published: 2022-01-13T18:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/box_code_meta.c
Commit date: 2021-08-30 15:55:13 +0200
Commit message: fixed #1890

Diff: diff --git a/src/isomedia/box_code_meta.c b/src/isomedia/box_code_meta.c
index e3f0556c0062..cdd0948a6da1 100644
--- a/src/isomedia/box_code_meta.c
+++ b/src/isomedia/box_code_meta.c
@@ -280,11 +280,12 @@ GF_Err iloc_box_read(GF_Box *s, GF_BitStream *bs)
 		ISOM_DECREASE_SIZE(ptr, 4)
 		item_count = gf_bs_read_u32(bs);
 	}
 
 	for (i = 0; i < item_count; i++) {
-		GF_ItemLocationEntry *location_entry = (GF_ItemLocationEntry *)gf_malloc(sizeof(GF_ItemLocationEntry));
+		GF_ItemLocationEntry *location_entry;
+		GF_SAFEALLOC(location_entry, GF_ItemLocationEntry);
 		if (!location_entry) return GF_OUT_OF_MEM;
 
 		gf_list_add(ptr->location_entries, location_entry);
 		if (ptr->version < 2) {
 			ISOM_DECREASE_SIZE(ptr, 2)
@@ -309,11 +310,12 @@ GF_Err iloc_box_read(GF_Box *s, GF_BitStream *bs)
 
 		ISOM_DECREASE_SIZE(ptr, 2)
 		extent_count = gf_bs_read_u16(bs);
 		location_entry->extent_entries = gf_list_new();
 		for (j = 0; j < extent_count; j++) {
-			GF_ItemExtentEntry *extent_entry = (GF_ItemExtentEntry *)gf_malloc(sizeof(GF_ItemExtentEntry));
+			GF_ItemExtentEntry *extent_entry;
+			GF_SAFEALLOC(extent_entry, GF_ItemExtentEntry);
 			if (!extent_entry) return GF_OUT_OF_MEM;
 			
 			gf_list_add(location_entry->extent_entries, extent_entry);
 			if ((ptr->version == 1 || ptr->version == 2) && ptr->index_size > 0) {
 				ISOM_DECREASE_SIZE(ptr, ptr->index_size)

Vulnerable code: 		GF_ItemLocationEntry *location_entry = (GF_ItemLocationEntry *)gf_malloc(sizeof(GF_ItemLocationEntry));
			GF_ItemExtentEntry *extent_entry = (GF_ItemExtentEntry *)gf_malloc(sizeof(GF_ItemExtentEntry));
Fixed code: 		GF_ItemLocationEntry *location_entry;
		GF_SAFEALLOC(location_entry, GF_ItemLocationEntry);
			GF_ItemExtentEntry *extent_entry;
			GF_SAFEALLOC(extent_entry, GF_ItemExtentEntry);
CVE-2021-40570: Double Free (CWE-415)
value: The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the avc_compute_poc function in av_parsers.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 7.8
Published: 2022-01-13T18:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/media_tools/av_parsers.c
Commit date: 2021-08-30 17:15:34 +0200
Commit message: fixed #1899

Diff: diff --git a/src/media_tools/av_parsers.c b/src/media_tools/av_parsers.c
index 0cc096d1a3c2..2a819da12c94 100644
--- a/src/media_tools/av_parsers.c
+++ b/src/media_tools/av_parsers.c
@@ -5196,10 +5196,11 @@ static s32 gf_avc_read_sps_bs_internal(GF_BitStream *bs, AVCState *avc, u32 subs
 		sps->delta_pic_order_always_zero_flag = gf_bs_read_int_log(bs, 1, "delta_pic_order_always_zero_flag");
 		sps->offset_for_non_ref_pic = gf_bs_read_se_log(bs, "offset_for_non_ref_pic");
 		sps->offset_for_top_to_bottom_field = gf_bs_read_se_log(bs, "offset_for_top_to_bottom_field");
 		sps->poc_cycle_length = gf_bs_read_ue_log(bs, "poc_cycle_length");
 		if (sps->poc_cycle_length > GF_ARRAY_LENGTH(sps->offset_for_ref_frame)) {
+			sps->poc_cycle_length = 255;
 			GF_LOG(GF_LOG_ERROR, GF_LOG_CODING, ("[avc-h264] offset_for_ref_frame overflow from poc_cycle_length\n"));
 			return -1;
 		}
 		for (i = 0; i < sps->poc_cycle_length; i++)
 			sps->offset_for_ref_frame[i] = gf_bs_read_se_log_idx(bs, "offset_for_ref_frame", i);

Fixed code: 			sps->poc_cycle_length = 255;
CVE-2021-40571: Double Free (CWE-415)
value: The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the ilst_box_read function in box_code_apple.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 7.8
Published: 2022-01-13T18:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/odf/descriptors.c
Commit date: 2021-08-30 16:24:05 +0200
Commit message: fixed #1895

Diff: diff --git a/src/odf/descriptors.c b/src/odf/descriptors.c
index afc623729e4b..c1970e820b2f 100644
--- a/src/odf/descriptors.c
+++ b/src/odf/descriptors.c
@@ -1611,10 +1611,11 @@ GF_AV1Config *gf_odf_av1_cfg_read_bs_size(GF_BitStream *bs, u32 size)
 			break;
 		}
 		size -= (u32) obu_size;
 	}
 	gf_av1_reset_state(& state, GF_TRUE);
+	gf_bs_align(bs);
 	return cfg;
 #else
 	return NULL;
 #endif
 }

Fixed code: 	gf_bs_align(bs);
CVE-2021-40572: Double Free (CWE-415)
value: The binary MP4Box in Gpac 1.0.1 has a double-free bug in the av1dmx_finalize function in reframe_av1.c, which allows attackers to cause a denial of service.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 5.5
Published: 2022-01-13T19:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/media_tools/av_parsers.c
Commit date: 2021-08-30 16:15:32 +0200
Commit message: fixed #1893

Diff: diff --git a/src/media_tools/av_parsers.c b/src/media_tools/av_parsers.c
index 3ce9a90156dd..4ea0db8a90dc 100644
--- a/src/media_tools/av_parsers.c
+++ b/src/media_tools/av_parsers.c
@@ -3978,14 +3978,12 @@ void gf_av1_reset_state(AV1State *state, Bool is_destroy)
 
 	if (is_destroy) {
 		gf_list_del(l1);
 		gf_list_del(l2);
 		if (state->bs) {
-			if (gf_bs_get_position(state->bs)) {
-				u32 size;
-				gf_bs_get_content_no_truncate(state->bs, &state->frame_obus, &size, &state->frame_obus_alloc);
-			}
+			u32 size;
+			gf_bs_get_content_no_truncate(state->bs, &state->frame_obus, &size, &state->frame_obus_alloc);
 			gf_bs_del(state->bs);
 		}
 		state->bs = NULL;
 	}
 	else {

Vulnerable code: 			if (gf_bs_get_position(state->bs)) {
				u32 size;
				gf_bs_get_content_no_truncate(state->bs, &state->frame_obus, &size, &state->frame_obus_alloc);
			}
Fixed code: 			u32 size;
			gf_bs_get_content_no_truncate(state->bs, &state->frame_obus, &size, &state->frame_obus_alloc);
CVE-2021-40573: Double Free (CWE-415)
value: The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the gf_list_del function in list.c, which allows attackers to cause a denial of service.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 5.5
Published: 2022-01-13T19:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/box_code_meta.c
Commit date: 2021-08-30 15:55:13 +0200
Commit message: fixed #1890

Diff: diff --git a/src/isomedia/box_code_meta.c b/src/isomedia/box_code_meta.c
index e3f0556c0062..cdd0948a6da1 100644
--- a/src/isomedia/box_code_meta.c
+++ b/src/isomedia/box_code_meta.c
@@ -280,11 +280,12 @@ GF_Err iloc_box_read(GF_Box *s, GF_BitStream *bs)
 		ISOM_DECREASE_SIZE(ptr, 4)
 		item_count = gf_bs_read_u32(bs);
 	}
 
 	for (i = 0; i < item_count; i++) {
-		GF_ItemLocationEntry *location_entry = (GF_ItemLocationEntry *)gf_malloc(sizeof(GF_ItemLocationEntry));
+		GF_ItemLocationEntry *location_entry;
+		GF_SAFEALLOC(location_entry, GF_ItemLocationEntry);
 		if (!location_entry) return GF_OUT_OF_MEM;
 
 		gf_list_add(ptr->location_entries, location_entry);
 		if (ptr->version < 2) {
 			ISOM_DECREASE_SIZE(ptr, 2)
@@ -309,11 +310,12 @@ GF_Err iloc_box_read(GF_Box *s, GF_BitStream *bs)
 
 		ISOM_DECREASE_SIZE(ptr, 2)
 		extent_count = gf_bs_read_u16(bs);
 		location_entry->extent_entries = gf_list_new();
 		for (j = 0; j < extent_count; j++) {
-			GF_ItemExtentEntry *extent_entry = (GF_ItemExtentEntry *)gf_malloc(sizeof(GF_ItemExtentEntry));
+			GF_ItemExtentEntry *extent_entry;
+			GF_SAFEALLOC(extent_entry, GF_ItemExtentEntry);
 			if (!extent_entry) return GF_OUT_OF_MEM;
 			
 			gf_list_add(location_entry->extent_entries, extent_entry);
 			if ((ptr->version == 1 || ptr->version == 2) && ptr->index_size > 0) {
 				ISOM_DECREASE_SIZE(ptr, ptr->index_size)

Vulnerable code: 		GF_ItemLocationEntry *location_entry = (GF_ItemLocationEntry *)gf_malloc(sizeof(GF_ItemLocationEntry));
			GF_ItemExtentEntry *extent_entry = (GF_ItemExtentEntry *)gf_malloc(sizeof(GF_ItemExtentEntry));
Fixed code: 		GF_ItemLocationEntry *location_entry;
		GF_SAFEALLOC(location_entry, GF_ItemLocationEntry);
			GF_ItemExtentEntry *extent_entry;
			GF_SAFEALLOC(extent_entry, GF_ItemExtentEntry);
CVE-2021-40574: Double Free (CWE-415)
value: The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the gf_text_get_utf8_line function in load_text.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 7.8
Published: 2022-01-13T19:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/load_text.c
Commit date: 2021-08-30 16:57:38 +0200
Commit message: fixed #1897

Diff: diff --git a/src/filters/load_text.c b/src/filters/load_text.c
index 4f41d2d3bf92..b82d2991b114 100644
--- a/src/filters/load_text.c
+++ b/src/filters/load_text.c
@@ -253,11 +253,11 @@ static GF_Err gf_text_guess_format(const char *filename, u32 *fmt)
 
 char *gf_text_get_utf8_line(char *szLine, u32 lineSize, FILE *txt_in, s32 unicode_type)
 {
 	u32 i, j, len;
 	char *sOK;
-	char szLineConv[1024];
+	char szLineConv[2048];
 	unsigned short *sptr;
 
 	memset(szLine, 0, sizeof(char)*lineSize);
 	sOK = gf_fgets(szLine, lineSize, txt_in);
 	if (!sOK) return NULL;
@@ -326,11 +326,11 @@ char *gf_text_get_utf8_line(char *szLine, u32 lineSize, FILE *txt_in, s32 unicod
 			szLine[i] = c;
 			i+=2;
 		}
 	}
 	sptr = (u16 *)szLine;
-	i = (u32) gf_utf8_wcstombs(szLineConv, 1024, (const unsigned short **) &sptr);
+	i = (u32) gf_utf8_wcstombs(szLineConv, 2048, (const unsigned short **) &sptr);
 	szLineConv[i] = 0;
 	strcpy(szLine, szLineConv);
 	/*this is ugly indeed: since input is UTF16-LE, there are many chances the gf_fgets never reads the \0 after a \n*/
 	if (unicode_type==3) gf_fgetc(txt_in);
 	return sOK;
@@ -2336,10 +2336,12 @@ static GF_Err gf_text_process_sub(GF_Filter *filter, GF_TXTIn *ctx)
 			continue;
 		}
 		while (szLine[i+1] && szLine[i+1]!='}') {
 			szTime[i] = szLine[i+1];
 			i++;
+			if (i>=19)
+				break;
 		}
 		szTime[i] = 0;
 		ctx->start = atoi(szTime);
 		if (ctx->start < ctx->end) {
 			GF_LOG(GF_LOG_WARNING, GF_LOG_PARSER, ("[TXTIn] corrupted SUB frame (line %d) - starts (at %d ms) before end of previous one (%d ms) - adjusting time stamps\n", line, ctx->start, ctx->end));

Vulnerable code: 	char szLineConv[1024];
	i = (u32) gf_utf8_wcstombs(szLineConv, 1024, (const unsigned short **) &sptr);
Fixed code: 	char szLineConv[2048];
	i = (u32) gf_utf8_wcstombs(szLineConv, 2048, (const unsigned short **) &sptr);
			if (i>=19)
				break;
CVE-2021-40575: NULL Pointer Dereference (CWE-476)
value: The binary MP4Box in Gpac 1.0.1 has a null pointer dereference vulnerability in the mpgviddmx_process function in reframe_mpgvid.c, which allows attackers to cause a denial of service. This vulnerability is possibly due to an incomplete fix for CVE-2021-40566.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2022-01-13T19:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/reframe_mpgvid.c
Commit date: 2021-09-01 13:50:54 +0200
Commit message: fixed #1905

Diff: diff --git a/src/filters/reframe_mpgvid.c b/src/filters/reframe_mpgvid.c
index 328db2855101..85d4faa4cbd2 100644
--- a/src/filters/reframe_mpgvid.c
+++ b/src/filters/reframe_mpgvid.c
@@ -782,12 +782,18 @@ GF_Err mpgviddmx_process(GF_Filter *filter)
 			gf_filter_pck_set_carousel_version(dst_pck, 1);
 
 			mpgviddmx_enqueue_or_dispatch(ctx, dst_pck, GF_FALSE, GF_FALSE);
 		}
 
-		//parse headers
+		//not enough bytes to parse start code
+		if (remain<5) {
+			memcpy(ctx->hdr_store, start, remain);
+			ctx->bytes_in_header = remain;
+			break;
+		}
 
+		//parse headers
 		//we have a start code loaded, eg the data packet does not have a full start code at the beginning
 		if (sc_type_forced) {
 			gf_bs_reassign_buffer(ctx->bs, start + hdr_offset, remain - hdr_offset);
 			sc_type = forced_sc_type;
 		} else {

Vulnerable code: 		//parse headers
Fixed code: 		//not enough bytes to parse start code
		if (remain<5) {
			memcpy(ctx->hdr_store, start, remain);
			ctx->bytes_in_header = remain;
			break;
		}
		//parse headers
CVE-2021-40576: NULL Pointer Dereference (CWE-476)
value: The binary MP4Box in Gpac 1.0.1 has a null pointer dereference vulnerability in the gf_isom_get_payt_count function in hint_track.c, which allows attackers to cause a denial of service.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2022-01-13T19:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/hint_track.c
Commit date: 2021-09-01 13:45:04 +0200
Commit message: fixed #1904

Diff: diff --git a/src/isomedia/hint_track.c b/src/isomedia/hint_track.c
index 304aa2cd8c27..385e746257f5 100644
--- a/src/isomedia/hint_track.c
+++ b/src/isomedia/hint_track.c
@@ -41,11 +41,11 @@ Bool IsHintTrack(GF_TrackBox *trak)
 }
 
 u32 GetHintFormat(GF_TrackBox *trak)
 {
 	GF_HintMediaHeaderBox *hmhd = (GF_HintMediaHeaderBox *)trak->Media->information->InfoHeader;
-	if (hmhd->type != GF_ISOM_BOX_TYPE_HMHD)
+	if (!hmhd || (hmhd->type != GF_ISOM_BOX_TYPE_HMHD))
 		return 0;
 		
 	if (!hmhd || !hmhd->subType) {
 		GF_Box *a = (GF_Box *)gf_list_get(trak->Media->information->sampleTable->SampleDescription->child_boxes, 0);
 		if (!hmhd) return a ? a->type : 0;

Vulnerable code: 	if (hmhd->type != GF_ISOM_BOX_TYPE_HMHD)
Fixed code: 	if (!hmhd || (hmhd->type != GF_ISOM_BOX_TYPE_HMHD))
CVE-2021-40592: Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
value: GPAC version before commit 71460d72ec07df766dab0a4d52687529f3efcf0a (version v1.0.1 onwards) contains loop with unreachable exit condition ('infinite loop') vulnerability in ISOBMFF reader filter, isoffin_read.c. Function isoffin_process() can result in DoS by infinite loop. To exploit, the victim must open a specially crafted mp4 file.
CWE description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CVSS v3 base score: 5.5
Published: 2022-06-08T18:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/isoffin_read.c, src/filters/isoffin_read_ch.c
Commit date: 2021-08-30 14:27:49 +0200
Commit message: fixed #1876

Diff: diff --git a/src/filters/isoffin_read.c b/src/filters/isoffin_read.c
index 899d3508a549..1f0d3742b548 100644
--- a/src/filters/isoffin_read.c
+++ b/src/filters/isoffin_read.c
@@ -1451,10 +1451,17 @@ static GF_Err isoffin_process(GF_Filter *filter)
 					}
 
 					gf_filter_pid_set_eos(ch->pid);
 				}
 				break;
+			} else if (ch->last_state==GF_ISOM_INVALID_FILE) {
+				if (!ch->eos_sent) {
+					ch->eos_sent = GF_TRUE;
+					read->eos_signaled = GF_TRUE;
+					gf_filter_pid_set_eos(ch->pid);
+				}
+				return ch->last_state;
 			} else {
 				read->force_fetch = GF_TRUE;
 				break;
 			}
 		}
diff --git a/src/filters/isoffin_read_ch.c b/src/filters/isoffin_read_ch.c
index c9bde63876fb..90f5972eb195 100644
--- a/src/filters/isoffin_read_ch.c
+++ b/src/filters/isoffin_read_ch.c
@@ -477,10 +477,14 @@ void isor_reader_get_sample(ISOMChannel *ch)
 			if (!ch->owner->input_loaded) {
 				ch->last_state = GF_OK;
 				if (!ch->has_edit_list && ch->sample_num)
 					ch->sample_num--;
 			} else {
+				if (ch->to_init && ch->sample_num) {
+					GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[IsoMedia] Failed to fetch initial sample %d for track %d\n"));
+					ch->last_state = GF_ISOM_INVALID_FILE;
+				}
 				if (ch->sample_num >= gf_isom_get_sample_count(ch->owner->mov, ch->track)) {
 					ch->last_state = GF_EOS;
 				}
 			}
 		}

Fixed code: 			} else if (ch->last_state==GF_ISOM_INVALID_FILE) {
				if (!ch->eos_sent) {
					ch->eos_sent = GF_TRUE;
					read->eos_signaled = GF_TRUE;
					gf_filter_pid_set_eos(ch->pid);
				}
				return ch->last_state;
				if (ch->to_init && ch->sample_num) {
					GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[IsoMedia] Failed to fetch initial sample %d for track %d\n"));
					ch->last_state = GF_ISOM_INVALID_FILE;
				}
CVE-2022-1035: NULL Pointer Dereference (CWE-476)
value: Segmentation Fault caused by MP4Box -lsr in GitHub repository gpac/gpac prior to 2.1.0-DEV.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2022-03-21T13:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/scene_manager/scene_dump.c
Commit date: 2022-03-17 12:00:55 +0100
Commit message: fixed #2146

Diff: diff --git a/src/scene_manager/scene_dump.c b/src/scene_manager/scene_dump.c
index 3104d23c3eca..6fe250f528d1 100644
--- a/src/scene_manager/scene_dump.c
+++ b/src/scene_manager/scene_dump.c
@@ -753,12 +753,11 @@ static void gf_dump_vrml_simple_field(GF_SceneDumper *sdump, GF_FieldInfo field,
 	GF_ChildNodeItem *list;
 	void *slot_ptr;
 
 	switch (field.fieldType) {
 	case GF_SG_VRML_SFNODE:
-		assert ( *(GF_Node **)field.far_ptr);
-		gf_dump_vrml_node(sdump, *(GF_Node **)field.far_ptr, 0, NULL);
+		gf_dump_vrml_node(sdump, field.far_ptr ? *(GF_Node **)field.far_ptr : NULL, 0, NULL);
 		return;
 	case GF_SG_VRML_MFNODE:
 		list = * ((GF_ChildNodeItem **) field.far_ptr);
 		assert( list );
 		sdump->indent++;

Vulnerable code: 		assert ( *(GF_Node **)field.far_ptr);
		gf_dump_vrml_node(sdump, *(GF_Node **)field.far_ptr, 0, NULL);
Fixed code: 		gf_dump_vrml_node(sdump, field.far_ptr ? *(GF_Node **)field.far_ptr : NULL, 0, NULL);
CVE-2022-1172: NULL Pointer Dereference (CWE-476)
value: Null Pointer Dereference Caused Segmentation Fault in GitHub repository gpac/gpac prior to 2.1.0-DEV.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5
Published: 2022-03-30T10:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/bifs/field_decode.c
Commit date: 2022-03-29 16:51:46 +0200
Commit message: fixed #2153

Diff: diff --git a/src/bifs/field_decode.c b/src/bifs/field_decode.c
index fe53c0821c84..5537da7d3d87 100644
--- a/src/bifs/field_decode.c
+++ b/src/bifs/field_decode.c
@@ -203,10 +203,11 @@ GF_Err gf_bifs_dec_sf_field(GF_BifsDecoder * codec, GF_BitStream *bs, GF_Node *n
 		SFCommandBuffer *sfcb = (SFCommandBuffer *)field->far_ptr;
 		if (!node) return GF_BAD_PARAM;
 		if (sfcb->buffer) {
 			gf_free(sfcb->buffer);
 			sfcb->buffer = NULL;
+			sfcb->bufferSize = 0;
 		}
 		while (gf_list_count(sfcb->commandList)) {
 			GF_Command *com = (GF_Command*)gf_list_get(sfcb->commandList, 0);
 			gf_list_rem(sfcb->commandList, 0);
 			gf_sg_command_del(com);

Fixed code: 			sfcb->bufferSize = 0;
CVE-2022-1222: Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
value: Inf loop in GitHub repository gpac/gpac prior to 2.1.0-DEV.
CWE description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CVSS v3 base score: 5.5
Published: 2022-04-04T10:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/media_tools/avilib.c
Commit date: 2022-03-31 13:57:05 +0200
Commit message: fixed #2159

Diff: diff --git a/src/media_tools/avilib.c b/src/media_tools/avilib.c
index 71e751d19bc3..14febb365747 100644
--- a/src/media_tools/avilib.c
+++ b/src/media_tools/avilib.c
@@ -1882,12 +1882,12 @@ avi_t *AVI_open_fd(FILE *fd, int getIndex)
 }
 #endif
 
 int avi_parse_input_file(avi_t *AVI, int getIndex)
 {
-	int i, rate, scale, idx_type;
-	s64 n;
+	int rate, scale, idx_type;
+	s64 n, i;
 	unsigned char *hdrl_data;
 	u64 header_offset=0;
 	int hdrl_len=0;
 	int nvi, nai[AVI_MAX_TRACKS], ioff;
 	u64 tot[AVI_MAX_TRACKS];
@@ -1937,10 +1937,11 @@ int avi_parse_input_file(avi_t *AVI, int getIndex)
 		{
 			if( avi_read(AVI->fdes,data,4) != 4 ) ERR_EXIT(AVI_ERR_READ)
 				n -= 4;
 			if(strnicmp(data,"hdrl",4) == 0)
 			{
+				if (n>0xFFFFFFFF) ERR_EXIT(AVI_ERR_READ)
 				hdrl_len = (u32) n;
 				hdrl_data = (unsigned char *) gf_malloc((u32)n);
 				if(hdrl_data==0) ERR_EXIT(AVI_ERR_NO_MEM);
 
 				// offset of header
@@ -2089,12 +2090,14 @@ int avi_parse_input_file(avi_t *AVI, int getIndex)
 
 						memcpy(AVI->compressor2, hdrl_data+i+16, 4);
 						AVI->compressor2[4] = 0;
 
 						if (n>40) {
+							if (n>0xFFFFFFFF) ERR_EXIT(AVI_ERR_READ)
 							AVI->extradata_size = (u32) (n - 40);
 							AVI->extradata = gf_malloc(sizeof(u8)* AVI->extradata_size);
+							if (!AVI->extradata) ERR_EXIT(AVI_ERR_NO_MEM)
 							memcpy(AVI->extradata, hdrl_data + i + 40, AVI->extradata_size);
 						}
 
 					}
 					else if(lasttag == 2)

Vulnerable code: 	int i, rate, scale, idx_type;
	s64 n;
Fixed code: 	int rate, scale, idx_type;
	s64 n, i;
				if (n>0xFFFFFFFF) ERR_EXIT(AVI_ERR_READ)
							if (n>0xFFFFFFFF) ERR_EXIT(AVI_ERR_READ)
							if (!AVI->extradata) ERR_EXIT(AVI_ERR_NO_MEM)
CVE-2022-1441: Out-of-bounds Read (CWE-125)
value: MP4Box is a component of GPAC-2.0.0, which is a widely-used third-party package on RPM Fusion. When MP4Box tries to parse a MP4 file, it calls the function `diST_box_read()` to read from video. In this function, it allocates a buffer `str` with fixed length. However, content read from `bs` is controllable by user, so is the length, which causes a buffer overflow.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2022-04-25T17:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/box_code_3gpp.c
Commit date: 2022-04-19 09:15:58 +0200
Commit message: fixed #2175

Diff: diff --git a/src/isomedia/box_code_3gpp.c b/src/isomedia/box_code_3gpp.c
index 3f9ff05692a5..928a5575f226 100644
--- a/src/isomedia/box_code_3gpp.c
+++ b/src/isomedia/box_code_3gpp.c
@@ -1126,24 +1126,16 @@ void diST_box_del(GF_Box *s)
 	gf_free(p);
 }
 
 GF_Err diST_box_read(GF_Box *s, GF_BitStream *bs)
 {
-	u32 i;
-	char str[1024];
 	GF_DIMSScriptTypesBox *p = (GF_DIMSScriptTypesBox *)s;
 
-	i=0;
-	str[0]=0;
-	while (1) {
-		str[i] = gf_bs_read_u8(bs);
-		if (!str[i]) break;
-		i++;
-	}
-	ISOM_DECREASE_SIZE(p, i);
-
-	p->content_script_types = gf_strdup(str);
+	p->content_script_types = gf_malloc(sizeof(char) * (s->size+1));
+	if (!p->content_script_types) return GF_OUT_OF_MEM;
+	gf_bs_read_data(bs, p->content_script_types, s->size);
+	p->content_script_types[s->size] = 0;
 	return GF_OK;
 }
 
 #ifndef GPAC_DISABLE_ISOM_WRITE
 GF_Err diST_box_write(GF_Box *s, GF_BitStream *bs)

Vulnerable code: 	u32 i;
	char str[1024];
	i=0;
	str[0]=0;
	while (1) {
		str[i] = gf_bs_read_u8(bs);
		if (!str[i]) break;
		i++;
	}
	ISOM_DECREASE_SIZE(p, i);

	p->content_script_types = gf_strdup(str);
Fixed code: 	p->content_script_types = gf_malloc(sizeof(char) * (s->size+1));
	if (!p->content_script_types) return GF_OUT_OF_MEM;
	gf_bs_read_data(bs, p->content_script_types, s->size);
	p->content_script_types[s->size] = 0;
CVE-2022-1795: Use After Free (CWE-416)
value: Use After Free in GitHub repository gpac/gpac prior to v2.1.0-DEV.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 9.8
Published: 2022-05-18T15:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/bifs/memory_decoder.c
Commit date: 2022-05-18 11:49:49 +0200
Commit message: fixed #2194

Diff: diff --git a/src/bifs/memory_decoder.c b/src/bifs/memory_decoder.c
index 74d635750d56..1fc8c99638f2 100644
--- a/src/bifs/memory_decoder.c
+++ b/src/bifs/memory_decoder.c
@@ -176,21 +176,27 @@ static GF_Err BM_ParseGlobalQuantizer(GF_BifsDecoder *codec, GF_BitStream *bs, G
 	}
 	codec->ActiveQP = NULL;
 	codec->scenegraph->global_qp = NULL;
 
 	if (gf_node_get_tag(node) != TAG_MPEG4_QuantizationParameter) {
-		gf_node_unregister(node, NULL);
+		//if node was just created (num_instances == 0), unregister
+		//otherwise (USE node) don't do anything
+		if (!node->sgprivate->num_instances) {
+			node->sgprivate->num_instances = 1;
+			gf_node_unregister(node, NULL);
+		}
 		return GF_NON_COMPLIANT_BITSTREAM;
 	}
 
 	/*register global QP*/
 	codec->ActiveQP = (M_QuantizationParameter *) node;
 	codec->ActiveQP->isLocal = 0;
 	codec->scenegraph->global_qp = node;
 
 	/*register TWICE: once for the command, and for the scenegraph globalQP*/
-	node->sgprivate->num_instances = 2;
+	gf_node_unregister(node, NULL);
+	gf_node_unregister(node, NULL);
 
 	com = gf_sg_command_new(codec->current_graph, GF_SG_GLOBAL_QUANTIZER);
 	inf = gf_sg_command_field_new(com);
 	inf->new_node = node;
 	inf->field_ptr = &inf->new_node;

Vulnerable code: 		gf_node_unregister(node, NULL);
	node->sgprivate->num_instances = 2;
Fixed code: 		//if node was just created (num_instances == 0), unregister
		//otherwise (USE node) don't do anything
		if (!node->sgprivate->num_instances) {
			node->sgprivate->num_instances = 1;
			gf_node_unregister(node, NULL);
		}
	gf_node_unregister(node, NULL);
	gf_node_unregister(node, NULL);
CVE-2022-2454: Integer Overflow or Wraparound (CWE-190)
value: Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.1-DEV.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 7.8
Published: 2022-07-19T14:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/laser/lsr_dec.c
Commit date: 2022-07-12 18:00:35 +0200
Commit message: fixed #2213

Diff: diff --git a/src/laser/lsr_dec.c b/src/laser/lsr_dec.c
index 99d16aaa7747..488babb1045a 100644
--- a/src/laser/lsr_dec.c
+++ b/src/laser/lsr_dec.c
@@ -836,10 +836,12 @@ static void lsr_read_id(GF_LASeRCodec *lsr, GF_Node *n)
 	}
 }
 
 static Fixed lsr_translate_coords(GF_LASeRCodec *lsr, u32 val, u32 nb_bits)
 {
+	if (!nb_bits) return 0;
+	
 #ifdef GPAC_FIXED_POINT
 	if (val >> (nb_bits-1) ) {
 		s32 neg = (s32) val - (1<<nb_bits);
 		if (neg < -FIX_ONE / 2)
 			return 2 * gf_divfix(INT2FIX(neg/2), lsr->res_factor);

Fixed code: 	if (!nb_bits) return 0;
CVE-2022-29340: NULL Pointer Dereference (CWE-476)
value: GPAC 2.1-DEV-rev87-g053aae8-master. has a Null Pointer Dereference vulnerability in gf_isom_parse_movie_boxes_internal due to improper return value handling of GF_SKIP_BOX, which causes a Denial of Service. This vulnerability was fixed in commit 37592ad.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2022-05-05T13:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/box_funcs.c, src/isomedia/isom_intern.c
Commit date: 2022-04-12 10:35:52 +0200
Commit message: fixed #2163

Diff: diff --git a/src/isomedia/box_funcs.c b/src/isomedia/box_funcs.c
index 310511db4ec0..7a79233fab9e 100644
--- a/src/isomedia/box_funcs.c
+++ b/src/isomedia/box_funcs.c
@@ -308,12 +308,14 @@ GF_Err gf_isom_box_parse_ex(GF_Box **outBox, GF_BitStream *bs, u32 parent_type,
 
 
 	if (e && (e != GF_ISOM_INCOMPLETE_FILE)) {
 		gf_isom_box_del(newBox);
 		*outBox = NULL;
+		if (is_root_box && (e==GF_SKIP_BOX))
+			e = GF_ISOM_INVALID_FILE;
 
-		if (!skip_logs) {
+		if (!skip_logs && (e!=GF_SKIP_BOX)) {
 			GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[iso file] Read Box \"%s\" (start "LLU") failed (%s) - skipping\n", gf_4cc_to_str(type), start, gf_error_to_string(e)));
 		}
 		//we don't try to reparse known boxes that have been failing (too dangerous)
 		return e;
 	}
diff --git a/src/isomedia/isom_intern.c b/src/isomedia/isom_intern.c
index 09a720649a99..242209c3fcb3 100644
--- a/src/isomedia/isom_intern.c
+++ b/src/isomedia/isom_intern.c
@@ -371,11 +371,12 @@ static GF_Err gf_isom_parse_movie_boxes_internal(GF_ISOFile *mov, u32 *boxType,
 #endif
 
 		e = gf_isom_parse_root_box(&a, mov->movieFileMap->bs, boxType, bytesMissing, progressive_mode);
 
 		if (e >= 0) {
-
+			//safety check, should never happen
+			if (!a) return GF_ISOM_INVALID_FILE;
 		} else if (e == GF_ISOM_INCOMPLETE_FILE) {
 			/*our mdat is uncomplete, only valid for READ ONLY files...*/
 			if (mov->openMode != GF_ISOM_OPEN_READ) {
 				GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[iso file] Incomplete MDAT while file is not read-only\n"));
 				return GF_ISOM_INVALID_FILE;

Vulnerable code: 		if (!skip_logs) {

Fixed code: 		if (is_root_box && (e==GF_SKIP_BOX))
			e = GF_ISOM_INVALID_FILE;
		if (!skip_logs && (e!=GF_SKIP_BOX)) {
			//safety check, should never happen
			if (!a) return GF_ISOM_INVALID_FILE;
CVE-2022-3178: Out-of-bounds Read (CWE-125)
value: Buffer Over-read in GitHub repository gpac/gpac prior to 2.1.0-DEV.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2022-09-12T17:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/box_code_base.c
Commit date: 2022-09-12 11:46:55 +0200
Commit message: fixed #2255

Diff: diff --git a/src/isomedia/box_code_base.c b/src/isomedia/box_code_base.c
index 3cf6b3bd386e..b7ee3e356ebb 100644
--- a/src/isomedia/box_code_base.c
+++ b/src/isomedia/box_code_base.c
@@ -12884,15 +12884,16 @@ GF_Err xtra_box_read(GF_Box *s, GF_BitStream *bs)
 		if (prop_size>4) {
 			tag_size-=2;
 			prop_type = gf_bs_read_u16(bs);
 			prop_size -= 6;
 			ISOM_DECREASE_SIZE_NO_ERR(ptr, prop_size)
-			//add 2 extra bytes for UTF16 case string dump
-			data2 = gf_malloc(sizeof(char) * (prop_size+2));
+			//add 3 extra bytes for UTF16 case string dump (3 because we need 0-aligned short value)
+			data2 = gf_malloc(sizeof(char) * (prop_size+3));
 			gf_bs_read_data(bs, data2, prop_size);
 			data2[prop_size] = 0;
 			data2[prop_size+1] = 0;
+			data2[prop_size+2] = 0;
 			tag_size-=prop_size;
 		} else {
 			prop_size = 0;
 		}
 		GF_SAFEALLOC(tag, GF_XtraTag)

Vulnerable code: 			//add 2 extra bytes for UTF16 case string dump
			data2 = gf_malloc(sizeof(char) * (prop_size+2));
Fixed code: 			//add 3 extra bytes for UTF16 case string dump (3 because we need 0-aligned short value)
			data2 = gf_malloc(sizeof(char) * (prop_size+3));
			data2[prop_size+2] = 0;
CVE-2023-0358: Use After Free (CWE-416)
value: Use After Free in GitHub repository gpac/gpac prior to 2.3.0-DEV.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 7.8
Published: 2023-01-18T02:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/odf/descriptors.c
Commit date: 2023-01-17 23:27:26 +0100
Commit message: fixed #2378

Diff: diff --git a/src/odf/descriptors.c b/src/odf/descriptors.c
index 0d42ff2df2f0..913d8e27af65 100644
--- a/src/odf/descriptors.c
+++ b/src/odf/descriptors.c
@@ -1393,16 +1393,16 @@ GF_VVCConfig *gf_odf_vvc_cfg_read_bs(GF_BitStream *bs)
 			valid = GF_TRUE;
 			ar->nalus = gf_list_new();
 			gf_list_add(cfg->param_array, ar);
 			break;
 		default:
-			GF_LOG(GF_LOG_WARNING, GF_LOG_CODING, ("[VVC] Invalid NALU type in vvcC - ignoring\n", ar->nalus));
+			GF_LOG(GF_LOG_WARNING, GF_LOG_CODING, ("[VVC] Invalid NALU type %d in vvcC - ignoring\n", ar->type));
 			gf_free(ar);
 			break;
 		}
 
-		if ((ar->type != GF_VVC_NALU_DEC_PARAM) && (ar->type != GF_VVC_NALU_OPI))
+		if (!valid || ((ar->type != GF_VVC_NALU_DEC_PARAM) && (ar->type != GF_VVC_NALU_OPI)))
 			nalucount = gf_bs_read_int(bs, 16);
 		else
 			nalucount = 1;
 			
 		for (j=0; j<nalucount; j++) {

Vulnerable code: 			GF_LOG(GF_LOG_WARNING, GF_LOG_CODING, ("[VVC] Invalid NALU type in vvcC - ignoring\n", ar->nalus));
		if ((ar->type != GF_VVC_NALU_DEC_PARAM) && (ar->type != GF_VVC_NALU_OPI))
Fixed code: 			GF_LOG(GF_LOG_WARNING, GF_LOG_CODING, ("[VVC] Invalid NALU type %d in vvcC - ignoring\n", ar->type));
		if (!valid || ((ar->type != GF_VVC_NALU_DEC_PARAM) && (ar->type != GF_VVC_NALU_OPI)))
CVE-2023-0770: Out-of-bounds Write (CWE-787)
value: Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2023-02-09T22:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/scenegraph/vrml_proto.c
Commit date: 2022-11-23 15:59:43 +0100
Commit message: fixed #2316

Diff: diff --git a/src/scenegraph/vrml_proto.c b/src/scenegraph/vrml_proto.c
index df30ed0dfada..02b92b5769f4 100644
--- a/src/scenegraph/vrml_proto.c
+++ b/src/scenegraph/vrml_proto.c
@@ -1290,11 +1290,14 @@ Bool gf_sg_proto_field_is_sftime_offset(GF_Node *node, GF_FieldInfo *field)
 		/*only check eventIn/field/exposedField*/
 		if (r->FromNode || (r->FromField.fieldIndex != field->fieldIndex)) continue;
 
 		gf_node_get_field(r->ToNode, r->ToField.fieldIndex, &inf);
 		/*IS to another proto*/
-		if (r->ToNode->sgprivate->tag == TAG_ProtoNode) return gf_sg_proto_field_is_sftime_offset(r->ToNode, &inf);
+		if (r->ToNode->sgprivate->tag == TAG_ProtoNode) {
+			if (r->ToNode==node) continue;
+			return gf_sg_proto_field_is_sftime_offset(r->ToNode, &inf);
+		}
 		/*IS to a startTime/stopTime field*/
 		if (!stricmp(inf.name, "startTime") || !stricmp(inf.name, "stopTime")) return 1;
 	}
 	return 0;
 }

Vulnerable code: 		if (r->ToNode->sgprivate->tag == TAG_ProtoNode) return gf_sg_proto_field_is_sftime_offset(r->ToNode, &inf);
Fixed code: 		if (r->ToNode->sgprivate->tag == TAG_ProtoNode) {
			if (r->ToNode==node) continue;
			return gf_sg_proto_field_is_sftime_offset(r->ToNode, &inf);
		}
CVE-2023-0817: Out-of-bounds Read (CWE-125)
value: Buffer Over-read in GitHub repository gpac/gpac prior to v2.3.0-DEV.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2023-02-13T22:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/reframe_mhas.c
Commit date: 2023-02-13 15:42:23 +0100
Commit message: mhas: check idx not oob (#2398)

Diff: diff --git a/src/filters/reframe_mhas.c b/src/filters/reframe_mhas.c
index fc0edb28cdab..f459d5b08dc6 100644
--- a/src/filters/reframe_mhas.c
+++ b/src/filters/reframe_mhas.c
@@ -196,16 +196,15 @@ static void mhas_dmx_check_dur(GF_Filter *filter, GF_MHASDmxCtx *ctx)
 		if (mhas_type==2) {
 			mhas_sap = gf_bs_read_int(bs, 1);
 			if (!mhas_last_cfg) mhas_sap = 0;
 		//config
 		} else if (mhas_type==1) {
-			u32 sr = 0;
 			/*u32 pl = */gf_bs_read_u8(bs);
 			u32 idx = gf_bs_read_int(bs, 5);
 			if (idx==0x1f)
 				duration.den = gf_bs_read_int(bs, 24);
-			else if (sr < nb_usac_sr) {
+			else if (idx < nb_usac_sr) {
 				duration.den = USACSampleRates[idx];
 			}
 			idx = gf_bs_read_int(bs, 3);
 			if ((idx==0) || (idx==2) ) frame_len = 768;
 			else frame_len = 1024;
@@ -619,11 +618,11 @@ GF_Err mhas_dmx_process(GF_Filter *filter)
 			u32 frame_len;
 			u32 pl = gf_bs_read_u8(ctx->bs);
 			u32 idx = gf_bs_read_int(ctx->bs, 5);
 			if (idx==0x1f)
 				sr = gf_bs_read_int(ctx->bs, 24);
-			else if (sr < nb_usac_sr) {
+			else if (idx < nb_usac_sr) {
 				sr = USACSampleRates[idx];
 			}
 			ctx->nb_unknown_pck = 0;
 			idx = gf_bs_read_int(ctx->bs, 3);
 			if ((idx==0) || (idx==2) ) frame_len = 768;

Vulnerable code: 			u32 sr = 0;
			else if (sr < nb_usac_sr) {
			else if (sr < nb_usac_sr) {
Fixed code: 			else if (idx < nb_usac_sr) {
			else if (idx < nb_usac_sr) {