Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2023-0818: Off-by-one Error (CWE-193)
value: Off-by-one Error in GitHub repository gpac/gpac prior to v2.3.0-DEV.
CWE description: A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CVSS v3 base score: 5.5
Published: 2023-02-13T22:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/load_text.c
Commit date: 2023-02-13 15:42:10 +0100
Commit message: fix a5efec8 to cover more cases (#2397)

Diff: diff --git a/src/filters/load_text.c b/src/filters/load_text.c
index cf8f0e3137f0..0134671f9f6a 100644
--- a/src/filters/load_text.c
+++ b/src/filters/load_text.c
@@ -313,31 +313,39 @@ char *gf_text_get_utf8_line(char *szLine, u32 lineSize, FILE *txt_in, s32 unicod
 		len = (u32) strlen(szLine);
 		for (i=0; i<len; i++) {
 			if (!unicode_type && (szLine[i] & 0x80)) {
 				/*non UTF8 (likely some win-CP)*/
 				if ((szLine[i+1] & 0xc0) != 0x80) {
+					if (j >= GF_ARRAY_LENGTH(szLineConv))
+						break;
 					szLineConv[j] = 0xc0 | ( (szLine[i] >> 6) & 0x3 );
 					j++;
 					szLine[i] &= 0xbf;
 				}
 				/*UTF8 2 bytes char*/
 				else if ( (szLine[i] & 0xe0) == 0xc0) {
+					if (j >= GF_ARRAY_LENGTH(szLineConv))
+						break;
 					szLineConv[j] = szLine[i];
 					i++;
 					j++;
 				}
 				/*UTF8 3 bytes char*/
 				else if ( (szLine[i] & 0xf0) == 0xe0) {
+					if (j+1 >= GF_ARRAY_LENGTH(szLineConv))
+						break;
 					szLineConv[j] = szLine[i];
 					i++;
 					j++;
 					szLineConv[j] = szLine[i];
 					i++;
 					j++;
 				}
 				/*UTF8 4 bytes char*/
 				else if ( (szLine[i] & 0xf8) == 0xf0) {
+					if (j+2 >= GF_ARRAY_LENGTH(szLineConv))
+						break;
 					szLineConv[j] = szLine[i];
 					i++;
 					j++;
 					szLineConv[j] = szLine[i];
 					i++;
@@ -348,18 +356,22 @@ char *gf_text_get_utf8_line(char *szLine, u32 lineSize, FILE *txt_in, s32 unicod
 				} else {
 					i+=1;
 					continue;
 				}
 			}
+
+			if (j >= GF_ARRAY_LENGTH(szLineConv))
+				break;
+
 			szLineConv[j] = szLine[i];
 			j++;
 
-			if (j >= GF_ARRAY_LENGTH(szLineConv) - 1) {
-				GF_LOG(GF_LOG_DEBUG, GF_LOG_PARSER, ("[TXTIn] Line too long to convert to utf8 (len: %d)\n", len));
-				break;
-			}
 
+		}
+		if ( j >= GF_ARRAY_LENGTH(szLineConv) ) {
+			GF_LOG(GF_LOG_DEBUG, GF_LOG_PARSER, ("[TXTIn] Line too long to convert to utf8 (len: %d)\n", len));
+			j = GF_ARRAY_LENGTH(szLineConv) -1 ;
 		}
 		szLineConv[j] = 0;
 		strcpy(szLine, szLineConv);
 		return sOK;
 	}

Vulnerable code: 			if (j >= GF_ARRAY_LENGTH(szLineConv) - 1) {
				GF_LOG(GF_LOG_DEBUG, GF_LOG_PARSER, ("[TXTIn] Line too long to convert to utf8 (len: %d)\n", len));
				break;
			}
Fixed code: 					if (j >= GF_ARRAY_LENGTH(szLineConv))
						break;
					if (j >= GF_ARRAY_LENGTH(szLineConv))
						break;
					if (j+1 >= GF_ARRAY_LENGTH(szLineConv))
						break;
					if (j+2 >= GF_ARRAY_LENGTH(szLineConv))
						break;

			if (j >= GF_ARRAY_LENGTH(szLineConv))
				break;

		}
		if ( j >= GF_ARRAY_LENGTH(szLineConv) ) {
			GF_LOG(GF_LOG_DEBUG, GF_LOG_PARSER, ("[TXTIn] Line too long to convert to utf8 (len: %d)\n", len));
			j = GF_ARRAY_LENGTH(szLineConv) -1 ;
CVE-2023-0819: Heap-based Buffer Overflow (CWE-122)
value: Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to v2.3.0-DEV.
CWE description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CVSS v3 base score: 7.8
Published: 2023-02-13T22:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/media_tools/mpegts.c
Commit date: 2023-02-13 15:41:48 +0100
Commit message: mpeg2ts: add section size check (#2395)

Diff: diff --git a/src/media_tools/mpegts.c b/src/media_tools/mpegts.c
index 30fb2bb3fe43..7deabb63042e 100644
--- a/src/media_tools/mpegts.c
+++ b/src/media_tools/mpegts.c
@@ -944,10 +944,15 @@ static void gf_m2ts_process_tdt_tot(GF_M2TS_Demuxer *ts, GF_M2TS_SECTION_ES *tdt
 	if (!time_table) {
 		GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[MPEG-2 TS] Fail to alloc DVB time table\n"));
 		return;
 	}
 
+	if (data_size < 5) {
+		GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[MPEG-2 TS] Section data size too small to read date (len: %u)\n", data_size));
+		return;
+	}
+
 	/*UTC_time - see annex C of DVB-SI ETSI EN 300468*/
 /* decodes an Modified Julian Date (MJD) into a Co-ordinated Universal Time (UTC)
 See annex C of DVB-SI ETSI EN 300468 */
 	date = data[0]*256 + data[1];
 	yp = (u32)((date - 15078.2)/365.25);

Fixed code: 	if (data_size < 5) {
		GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[MPEG-2 TS] Section data size too small to read date (len: %u)\n", data_size));
		return;
	}
CVE-2023-0866: Heap-based Buffer Overflow (CWE-122)
value: Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3.0-DEV.
CWE description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CVSS v3 base score: 7.8
Published: 2023-02-16T20:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/reframe_adts.c
Commit date: 2023-02-16 17:34:58 +0100
Commit message: rfadts: add size guard on dmx (#2400)

Diff: diff --git a/src/filters/reframe_adts.c b/src/filters/reframe_adts.c
index 80c98e522e76..818273e58efe 100644
--- a/src/filters/reframe_adts.c
+++ b/src/filters/reframe_adts.c
@@ -298,11 +298,11 @@ static void adts_dmx_check_dur(GF_Filter *filter, GF_ADTSDmxCtx *ctx)
 				rate /= ctx->duration.num;
 				ctx->bitrate = (u32) rate;
 			}
 		}
 	}
-	
+
 	p = gf_filter_pid_get_property(ctx->ipid, GF_PROP_PID_FILE_CACHED);
 	if (p && p->value.boolean) ctx->file_loaded = GF_TRUE;
 }
 
 static void adts_dmx_check_pid(GF_Filter *filter, GF_ADTSDmxCtx *ctx)
@@ -822,10 +822,16 @@ GF_Err adts_dmx_process(GF_Filter *filter)
 			ctx->cts = cts;
 			cts = GF_FILTER_NO_TS;
 		}
 
 		if (!ctx->in_seek) {
+
+			if (sync_pos + offset + size > remain) {
+				GF_LOG(GF_LOG_WARNING, GF_LOG_MEDIA, ("[ADTSDmx] truncated frame\n"));
+				break;
+			}
+
 			dst_pck = gf_filter_pck_new_alloc(ctx->opid, size, &output);
 			if (!dst_pck) return GF_OUT_OF_MEM;
 			if (ctx->src_pck) gf_filter_pck_merge_properties(ctx->src_pck, dst_pck);
 
 			memcpy(output, sync + offset, size);

Fixed code: 

			if (sync_pos + offset + size > remain) {
				GF_LOG(GF_LOG_WARNING, GF_LOG_MEDIA, ("[ADTSDmx] truncated frame\n"));
				break;
			}
CVE-2023-23143: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: Buffer overflow vulnerability in function avc_parse_slice in file media_tools/av_parsers.c. GPAC version 2.3-DEV-rev1-g4669ba229-master.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 7.8
Published: 2023-01-20T19:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/media_tools/av_parsers.c
Commit date: 2023-01-04 10:56:03 +0100
Commit message: fixed #2366

Diff: diff --git a/src/media_tools/av_parsers.c b/src/media_tools/av_parsers.c
index 38429382f5b7..bee41140c24e 100644
--- a/src/media_tools/av_parsers.c
+++ b/src/media_tools/av_parsers.c
@@ -5675,14 +5675,14 @@ static s32 avc_parse_slice(GF_BitStream *bs, AVCState *avc, Bool svc_idr_flag, A
 	gf_bs_read_ue_log(bs, "first_mb_in_slice");
 	si->slice_type = gf_bs_read_ue_log(bs, "slice_type");
 	if (si->slice_type > 9) return -1;
 
 	pps_id = gf_bs_read_ue_log(bs, "pps_id");
-	if ((pps_id<0) || (pps_id > 255)) return -1;
+	if ((pps_id<0) || (pps_id >= 255)) return -1;
 	si->pps = &avc->pps[pps_id];
 	if (!si->pps->slice_group_count) return -2;
-	if (si->pps->sps_id>=255) return -1;
+	if (si->pps->sps_id>=32) return -1;
 	si->sps = &avc->sps[si->pps->sps_id];
 	if (!si->sps->log2_max_frame_num) return -2;
 	avc->sps_active_idx = si->pps->sps_id;
 	avc->pps_active_idx = pps_id;
 
@@ -5785,11 +5785,11 @@ static s32 svc_parse_slice(GF_BitStream *bs, AVCState *avc, AVCSliceInfo *si)
 	gf_bs_read_ue_log(bs, "first_mb_in_slice");
 	si->slice_type = gf_bs_read_ue_log(bs, "slice_type");
 	if (si->slice_type > 9) return -1;
 
 	pps_id = gf_bs_read_ue_log(bs, "pps_id");
-	if ((pps_id<0) || (pps_id > 255))
+	if ((pps_id<0) || (pps_id >= 255))
 		return -1;
 	si->pps = &avc->pps[pps_id];
 	si->pps->id = pps_id;
 	if (!si->pps->slice_group_count)
 		return -2;

Vulnerable code: 	if ((pps_id<0) || (pps_id > 255)) return -1;
	if (si->pps->sps_id>=255) return -1;
	if ((pps_id<0) || (pps_id > 255))
Fixed code: 	if ((pps_id<0) || (pps_id >= 255)) return -1;
	if (si->pps->sps_id>=32) return -1;
	if ((pps_id<0) || (pps_id >= 255))
CVE-2023-23144: Integer Overflow or Wraparound (CWE-190)
value: Integer overflow vulnerability in function Q_DecCoordOnUnitSphere file bifs/unquantize.c in GPAC version 2.2-rev0-gab012bbfb-master.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 5.5
Published: 2023-01-20T19:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/bifs/unquantize.c
Commit date: 2023-01-04 11:25:11 +0100
Commit message: fixed #2364

Diff: diff --git a/src/bifs/unquantize.c b/src/bifs/unquantize.c
index a43df12f07e6..008a83098256 100644
--- a/src/bifs/unquantize.c
+++ b/src/bifs/unquantize.c
@@ -1,10 +1,10 @@
 /*
  *			GPAC - Multimedia Framework C SDK
  *
  *			Authors: Jean Le Feuvre
- *			Copyright (c) Telecom ParisTech 2000-2012
+ *			Copyright (c) Telecom ParisTech 2000-2023
  *					All rights reserved
  *
  *  This file is part of GPAC / BIFS codec sub-project
  *
  *  GPAC is free software; you can redistribute it and/or modify
@@ -282,11 +282,11 @@ GF_Err Q_DecCoordOnUnitSphere(GF_BifsDecoder *codec, GF_BitStream *bs, u32 NbBit
 {
 	u32 i, orient, sign;
 	s32 value;
 	Fixed tang[4], delta;
 	s32 dir;
-
+	if (NbBits>32) return GF_NON_COMPLIANT_BITSTREAM;
 	if (NbComp != 2 && NbComp != 3) return GF_BAD_PARAM;
 
 	//only 2 or 3 comp in the quantized version
 	dir = 1;
 	if(NbComp == 2) dir -= 2 * gf_bs_read_int(bs, 1);

Vulnerable code:  *			Copyright (c) Telecom ParisTech 2000-2012

Fixed code:  *			Copyright (c) Telecom ParisTech 2000-2023
	if (NbBits>32) return GF_NON_COMPLIANT_BITSTREAM;
CVE-2023-23145: Missing Release of Memory after Effective Lifetime (CWE-401)
value: GPAC version 2.2-rev0-gab012bbfb-master was discovered to contain a memory leak in lsr_read_rare_full function.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 7.8
Published: 2023-01-20T19:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/laser/lsr_dec.c
Commit date: 2023-01-04 11:31:29 +0100
Commit message: fixed #2365

Diff: diff --git a/src/laser/lsr_dec.c b/src/laser/lsr_dec.c
index 7918150c3017..1be3af84fa06 100644
--- a/src/laser/lsr_dec.c
+++ b/src/laser/lsr_dec.c
@@ -1,10 +1,10 @@
 /*
  *			GPAC - Multimedia Framework C SDK
  *
  *			Authors: Jean Le Feuvre
- *			Copyright (c) Telecom ParisTech 2005-2022
+ *			Copyright (c) Telecom ParisTech 2005-2023
  *					All rights reserved
  *
  *  This file is part of GPAC / LASeR codec sub-project
  *
  *  GPAC is free software; you can redistribute it and/or modify
@@ -1537,12 +1537,12 @@ static void lsr_read_rare_full(GF_LASeRCodec *lsr, GF_Node *n)
 			if (flag) {
 				da->type=SVG_STROKEDASHARRAY_INHERIT;
 			} else {
 				da->type=SVG_STROKEDASHARRAY_ARRAY;
 				da->array.count = lsr_read_vluimsbf5(lsr, "len");
-				da->array.vals = (Fixed*)gf_malloc(sizeof(Fixed)*da->array.count);
-				da->array.units = (u8*)gf_malloc(sizeof(u8)*da->array.count);
+				da->array.vals = (Fixed*)gf_realloc(da->array.vals, sizeof(Fixed)*da->array.count);
+				da->array.units = (u8*)gf_realloc(da->array.units, sizeof(u8)*da->array.count);
 				if (!da->array.vals || !da->array.units) {
 					lsr->last_error = GF_OUT_OF_MEM;
 					return;
 				}
 				for (j=0; j<da->array.count; j++) {

Vulnerable code:  *			Copyright (c) Telecom ParisTech 2005-2022
				da->array.vals = (Fixed*)gf_malloc(sizeof(Fixed)*da->array.count);
				da->array.units = (u8*)gf_malloc(sizeof(u8)*da->array.count);
Fixed code:  *			Copyright (c) Telecom ParisTech 2005-2023
				da->array.vals = (Fixed*)gf_realloc(da->array.vals, sizeof(Fixed)*da->array.count);
				da->array.units = (u8*)gf_realloc(da->array.units, sizeof(u8)*da->array.count);
CVE-2023-2837: Stack-based Buffer Overflow (CWE-121)
value: Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.2.
CWE description: A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CVSS v3 base score: 5.5
Published: 2023-05-22T18:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/utils/xml_parser.c
Commit date: 2023-05-22 17:35:19 +0200
Commit message: fixed #2473

Diff: diff --git a/src/utils/xml_parser.c b/src/utils/xml_parser.c
index b1b1491529ae..49df33816485 100644
--- a/src/utils/xml_parser.c
+++ b/src/utils/xml_parser.c
@@ -189,10 +189,11 @@ struct _tag_sax_parser
 	u32 text_check_escapes;
 
 	GF_XMLAttribute *attrs;
 	GF_XMLSaxAttribute *sax_attrs;
 	u32 nb_attrs, nb_alloc_attrs;
+	u32 ent_rec_level;
 };
 
 static GF_XMLSaxAttribute *xml_get_sax_attribute(GF_SAXParser *parser)
 {
 	if (parser->nb_attrs==parser->nb_alloc_attrs) {
@@ -900,11 +901,18 @@ restart:
 						orig_buf = gf_strdup(parser->buffer + parser->current_pos);
 						parser->current_pos = 0;
 						parser->line_size = 0;
 						parser->elt_start_pos = 0;
 						parser->sax_state = SAX_STATE_TEXT_CONTENT;
-						e = gf_xml_sax_parse_intern(parser, orig_buf);
+						parser->ent_rec_level++;
+						if (parser->ent_rec_level>100) {
+							GF_LOG(GF_LOG_WARNING, GF_LOG_CORE, ("[XML] Too many recursions in entity solving, max 100 allowed\n"));
+							e = GF_NOT_SUPPORTED;
+						} else {
+							e = gf_xml_sax_parse_intern(parser, orig_buf);
+							parser->ent_rec_level--;
+						}
 						gf_free(orig_buf);
 						return e;
 					}
 				}
 			}
@@ -1073,12 +1081,13 @@ static GF_Err gf_xml_sax_parse_intern(GF_SAXParser *parser, char *current)
 			current = entityStart + ent->namelen + 2;
 		}
 		/*append entity*/
 		line_num = parser->line;
 		xml_sax_append_string(parser, ent->value);
-		xml_sax_parse(parser, GF_TRUE);
+		GF_Err e = xml_sax_parse(parser, GF_TRUE);
 		parser->line = line_num;
+		if (e) return e;
 
 	}
 	xml_sax_append_string(parser, current);
 	return xml_sax_parse(parser, GF_FALSE);
 }

Vulnerable code: 						e = gf_xml_sax_parse_intern(parser, orig_buf);
		xml_sax_parse(parser, GF_TRUE);
Fixed code: 	u32 ent_rec_level;
						parser->ent_rec_level++;
						if (parser->ent_rec_level>100) {
							GF_LOG(GF_LOG_WARNING, GF_LOG_CORE, ("[XML] Too many recursions in entity solving, max 100 allowed\n"));
							e = GF_NOT_SUPPORTED;
						} else {
							e = gf_xml_sax_parse_intern(parser, orig_buf);
							parser->ent_rec_level--;
						}
		GF_Err e = xml_sax_parse(parser, GF_TRUE);
		if (e) return e;
CVE-2023-2838: Out-of-bounds Read (CWE-125)
value: Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2023-05-22T18:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filter_core/filter_session.c
Commit date: 2023-05-22 17:40:44 +0200
Commit message: fixed #2475

Diff: diff --git a/src/filter_core/filter_session.c b/src/filter_core/filter_session.c
index 1cee6fd45205..bcef8cfc0b61 100644
--- a/src/filter_core/filter_session.c
+++ b/src/filter_core/filter_session.c
@@ -4143,10 +4143,13 @@ GF_Err gf_filter_get_stats(GF_Filter *f, GF_FilterStats *stats)
 			stats->last_ts_drop = pidi->last_ts_drop;
 
 		if ((f->num_input_pids!=1) && f->num_output_pids)
 			continue;
 
+		if (!pidi->pid)
+			continue;
+
 		if (!stats->codecid)
 			stats->codecid = pidi->pid->codecid;
 		if (!stats->stream_type)
 			stats->stream_type = pidi->pid->stream_type;
 

Fixed code: 		if (!pidi->pid)
			continue;
CVE-2023-2839: Divide By Zero (CWE-369)
value: Divide By Zero in GitHub repository gpac/gpac prior to 2.2.2.
CWE description: The product divides a value by zero.
CVSS v3 base score: 7.5
Published: 2023-05-22T18:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/reframe_nalu.c
Commit date: 2023-05-22 17:48:08 +0200
Commit message: fixed #2476

Diff: diff --git a/src/filters/reframe_nalu.c b/src/filters/reframe_nalu.c
index e269be4d0dc8..da0af4c7dc4f 100644
--- a/src/filters/reframe_nalu.c
+++ b/src/filters/reframe_nalu.c
@@ -1507,14 +1507,17 @@ Bool naludmx_create_avc_decoder_config(GF_NALUDmxCtx *ctx, u8 **dsi, u32 *dsi_si
 					else if (ctx->avc_state->sei.pic_timing.pic_struct == 8)
 						DeltaTfiDivisorIdx = 6;
 					else
 						DeltaTfiDivisorIdx = (ctx->avc_state->sei.pic_timing.pic_struct+1) / 2;
 				}
-				if (ctx->notime && sps->vui.time_scale && sps->vui.num_units_in_tick) {
-					ctx->cur_fps.num = 2 * sps->vui.time_scale;
-					ctx->cur_fps.den = 2 * sps->vui.num_units_in_tick * DeltaTfiDivisorIdx;
-
+				if (ctx->notime) {
+					u32 fps_num = 2 * sps->vui.time_scale;
+					u32 fps_den = 2 * sps->vui.num_units_in_tick * DeltaTfiDivisorIdx;
+					if (fps_num && fps_den) {
+						ctx->cur_fps.num = fps_num;
+						ctx->cur_fps.den = fps_den;
+					}
 					if (!ctx->fps.num && ctx->dts==ctx->fps.den)
 						ctx->dts = ctx->cur_fps.den;
 				}
 				if (! sps->vui.fixed_frame_rate_flag)
 					GF_LOG(GF_LOG_INFO, GF_LOG_MEDIA, ("[%s] Possible Variable Frame Rate: VUI \"fixed_frame_rate_flag\" absent\n", ctx->log_name));

Vulnerable code: 				if (ctx->notime && sps->vui.time_scale && sps->vui.num_units_in_tick) {
					ctx->cur_fps.num = 2 * sps->vui.time_scale;
					ctx->cur_fps.den = 2 * sps->vui.num_units_in_tick * DeltaTfiDivisorIdx;

Fixed code: 				if (ctx->notime) {
					u32 fps_num = 2 * sps->vui.time_scale;
					u32 fps_den = 2 * sps->vui.num_units_in_tick * DeltaTfiDivisorIdx;
					if (fps_num && fps_den) {
						ctx->cur_fps.num = fps_num;
						ctx->cur_fps.den = fps_den;
					}
CVE-2023-2840: NULL Pointer Dereference (CWE-476)
value: NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.2.2.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 9.8
Published: 2023-05-22T18:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/movie_fragments.c
Commit date: 2023-05-22 17:37:24 +0200
Commit message: fixed #2474

Diff: diff --git a/src/isomedia/movie_fragments.c b/src/isomedia/movie_fragments.c
index b742078d15e7..41d0717a4837 100644
--- a/src/isomedia/movie_fragments.c
+++ b/src/isomedia/movie_fragments.c
@@ -2874,11 +2874,12 @@ GF_Err gf_isom_fragment_add_sample_ex(GF_ISOFile *movie, GF_ISOTrackID TrackID,
 	}
 
 	//rewrite OD frames
 	if (traf->trex->track->Media->handler->handlerType == GF_ISOM_MEDIA_OD) {
 		//this may fail if dependencies are not well done ...
-		Media_ParseODFrame(traf->trex->track->Media, sample, &od_sample);
+		GF_Err e = Media_ParseODFrame(traf->trex->track->Media, sample, &od_sample);
+		if (!od_sample) return e;
 		sample = od_sample;
 	}
 
 	ent.size = sample->dataLength;
 	trun->samples[trun->nb_samples] = ent;

Vulnerable code: 		Media_ParseODFrame(traf->trex->track->Media, sample, &od_sample);
Fixed code: 		GF_Err e = Media_ParseODFrame(traf->trex->track->Media, sample, &od_sample);
		if (!od_sample) return e;
CVE-2023-3012: NULL Pointer Dereference (CWE-476)
value: NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.2.2.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.8
Published: 2023-05-31T14:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/utils/xml_parser.c
Commit date: 2023-05-31 14:09:48 +0200
Commit message: fixed #2480

Diff: diff --git a/src/utils/xml_parser.c b/src/utils/xml_parser.c
index 49df33816485..11f6f2f5ca2e 100644
--- a/src/utils/xml_parser.c
+++ b/src/utils/xml_parser.c
@@ -702,10 +702,12 @@ static void xml_sax_parse_entity(GF_SAXParser *parser)
 		} else {
 			i++;
 		}
 	}
 	if (ent_name) gf_free(ent_name);
+	if (ent && !ent->value)
+		parser->sax_state = SAX_STATE_SYNTAX_ERROR;
 	xml_sax_store_text(parser, i);
 }
 
 static void xml_sax_cdata(GF_SAXParser *parser)
 {
@@ -966,11 +968,11 @@ exit:
 }
 
 static GF_Err xml_sax_append_string(GF_SAXParser *parser, char *string)
 {
 	u32 size = parser->line_size;
-	u32 nl_size = (u32) strlen(string);
+	u32 nl_size = string ? (u32) strlen(string) : 0;
 
 	if (!nl_size) return GF_OK;
 
 	if ( (parser->alloc_size < size+nl_size+1)
 	        /*		|| (parser->alloc_size / 2 ) > size+nl_size+1 */

Vulnerable code: 	u32 nl_size = (u32) strlen(string);
Fixed code: 	if (ent && !ent->value)
		parser->sax_state = SAX_STATE_SYNTAX_ERROR;
	u32 nl_size = string ? (u32) strlen(string) : 0;
CVE-2023-3013: Unchecked Return Value (CWE-252)
value: Unchecked Return Value in GitHub repository gpac/gpac prior to 2.2.2.
CWE description: The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
CVSS v3 base score: 7.1
Published: 2023-05-31T14:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/dasher.c
Commit date: 2023-05-31 14:12:21 +0200
Commit message: fixed #2485

Diff: diff --git a/src/filters/dasher.c b/src/filters/dasher.c
index fd27f483aa41..6a00c783d9f8 100644
--- a/src/filters/dasher.c
+++ b/src/filters/dasher.c
@@ -1413,22 +1413,24 @@ static GF_Err dasher_configure_pid(GF_Filter *filter, GF_FilterPid *pid, Bool is
 				}
 			}
 			else if (ds->codec_id == GF_CODECID_AVC || ds->codec_id == GF_CODECID_SVC || ds->codec_id == GF_CODECID_MVC) {
 				AVCState avc;
 				GF_AVCConfig* avccfg = gf_odf_avc_cfg_read(dsi->value.data.ptr, dsi->value.data.size);
-				GF_NALUFFParam *sl = (GF_NALUFFParam *)gf_list_get(avccfg->sequenceParameterSets, 0);
-				if (sl) {
-					s32 idx;
-					memset(&avc, 0, sizeof(AVCState));
-					idx = gf_avc_read_sps(sl->data, sl->size, &avc, 0, NULL);
-					if (idx>=0) {
-						Bool is_interlaced = avc.sps[idx].frame_mbs_only_flag ? GF_FALSE : GF_TRUE;
-						if (ds->interlaced != is_interlaced) period_switch = GF_TRUE;
-						ds->interlaced = is_interlaced;
+				if (avccfg) {
+					GF_NALUFFParam *sl = (GF_NALUFFParam *)gf_list_get(avccfg->sequenceParameterSets, 0);
+					if (sl) {
+						s32 idx;
+						memset(&avc, 0, sizeof(AVCState));
+						idx = gf_avc_read_sps(sl->data, sl->size, &avc, 0, NULL);
+						if (idx>=0) {
+							Bool is_interlaced = avc.sps[idx].frame_mbs_only_flag ? GF_FALSE : GF_TRUE;
+							if (ds->interlaced != is_interlaced) period_switch = GF_TRUE;
+							ds->interlaced = is_interlaced;
+						}
 					}
+					gf_odf_avc_cfg_del(avccfg);
 				}
-				gf_odf_avc_cfg_del(avccfg);
 			}
 		}
 #endif /*!GPAC_DISABLE_AV_PARSERS*/
 
 		if (ds->stream_type==GF_STREAM_AUDIO) {

Vulnerable code: 				GF_NALUFFParam *sl = (GF_NALUFFParam *)gf_list_get(avccfg->sequenceParameterSets, 0);
				if (sl) {
					s32 idx;
					memset(&avc, 0, sizeof(AVCState));
					idx = gf_avc_read_sps(sl->data, sl->size, &avc, 0, NULL);
					if (idx>=0) {
						Bool is_interlaced = avc.sps[idx].frame_mbs_only_flag ? GF_FALSE : GF_TRUE;
						if (ds->interlaced != is_interlaced) period_switch = GF_TRUE;
						ds->interlaced = is_interlaced;
				gf_odf_avc_cfg_del(avccfg);
Fixed code: 				if (avccfg) {
					GF_NALUFFParam *sl = (GF_NALUFFParam *)gf_list_get(avccfg->sequenceParameterSets, 0);
					if (sl) {
						s32 idx;
						memset(&avc, 0, sizeof(AVCState));
						idx = gf_avc_read_sps(sl->data, sl->size, &avc, 0, NULL);
						if (idx>=0) {
							Bool is_interlaced = avc.sps[idx].frame_mbs_only_flag ? GF_FALSE : GF_TRUE;
							if (ds->interlaced != is_interlaced) period_switch = GF_TRUE;
							ds->interlaced = is_interlaced;
						}
					gf_odf_avc_cfg_del(avccfg);
CVE-2023-3291: Heap-based Buffer Overflow (CWE-122)
value: Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.2.
CWE description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CVSS v3 base score: 3.3
Published: 2023-06-16T02:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/reframe_mp3.c
Commit date: 2023-06-15 11:28:10 +0200
Commit message: fixed #2493

Diff: diff --git a/src/filters/reframe_mp3.c b/src/filters/reframe_mp3.c
index e81dd174a695..6ed5608b86f0 100644
--- a/src/filters/reframe_mp3.c
+++ b/src/filters/reframe_mp3.c
@@ -263,11 +263,11 @@ void id3dmx_flush(GF_Filter *filter, u8 *id3_buf, u32 id3_buf_size, GF_FilterPid
 		if (size<fsize) {
 			GF_LOG(GF_LOG_ERROR, GF_LOG_MEDIA, ("[MP3Dmx] Broken ID3 frame tag %s, size %d but remaining bytes %d\n", gf_4cc_to_str(ftag), fsize, size));
 			break;
 		}
 
-		if (buf_alloc<=fsize) {
+		if (buf_alloc <= fsize+2) {
 			_buf = gf_realloc(_buf, fsize+3);
 			buf_alloc = fsize+3;
 		}
 		//read into _buf+1 so that buf+1 is always %2 mem aligned as it can be loaded as unsigned short
 		gf_bs_read_data(bs, _buf+1, fsize);

Vulnerable code: 		if (buf_alloc<=fsize) {
Fixed code: 		if (buf_alloc <= fsize+2) {
CVE-2023-3523: Out-of-bounds Read (CWE-125)
value: Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.1
Published: 2023-07-06T10:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/media_tools/vobsub.c
Commit date: 2023-07-06 09:51:29 +0200
Commit message: fixed #2520

Diff: diff --git a/src/media_tools/vobsub.c b/src/media_tools/vobsub.c
index 00630432c2..9fbb1920ce 100644
--- a/src/media_tools/vobsub.c
+++ b/src/media_tools/vobsub.c
@@ -251,17 +251,19 @@ static char *strtrim(char *str)
 	return strltrim(strrtrim(str));
 }
 
 GF_Err vobsub_read_idx(FILE *file, vobsub_file *vobsub, s32 *version)
 {
-	char  strbuf[256];
+	char  strbuf[257];
 	char *str, *pos, *entry;
 	s32   line, id =-1, delay = 0;
 	Bool  error = 0;
 
-	for (line = 0; !error && gf_fgets(strbuf, sizeof(strbuf), file); line++)
+	for (line = 0; !error && gf_fgets(strbuf, 256, file); line++)
 	{
+		//make sure we are null-terminated - cf #2520
+		strbuf[256]=0;
 		str = strtrim(strbuf);
 
 		if (line == 0)
 		{
 			char *buf = "VobSub index file, v";

Vulnerable code: 	char  strbuf[256];
	for (line = 0; !error && gf_fgets(strbuf, sizeof(strbuf), file); line++)
Fixed code: 	char  strbuf[257];
	for (line = 0; !error && gf_fgets(strbuf, 256, file); line++)
		//make sure we are null-terminated - cf #2520
		strbuf[256]=0;
CVE-2023-46001: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: Buffer Overflow vulnerability in gpac MP4Box v.2.3-DEV-rev573-g201320819-master allows a local attacker to cause a denial of service via the gpac/src/isomedia/isom_read.c:2807:51 function in gf_isom_get_user_data.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 5.5
Published: 2023-11-07T22:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/isom_read.c
Commit date: 2023-10-11 12:31:19 +0200
Commit message: gf_isom_get_user_data: handle null uuid (fixes #2629)

Diff: diff --git a/src/isomedia/isom_read.c b/src/isomedia/isom_read.c
index 5a8109e2de..60bded7e77 100644
--- a/src/isomedia/isom_read.c
+++ b/src/isomedia/isom_read.c
@@ -2802,11 +2802,11 @@ GF_Err gf_isom_get_user_data(GF_ISOFile *movie, u32 trackNumber, u32 UserDataTyp
 
 	if (!userData || !userDataSize || *userData) return GF_BAD_PARAM;
 
 	i=0;
 	while ((map = (GF_UserDataMap*)gf_list_enum(udta->recordList, &i))) {
-		if ((map->boxType == GF_ISOM_BOX_TYPE_UUID) && !memcmp(map->uuid, UUID, 16)) goto found;
+		if ((map->boxType == GF_ISOM_BOX_TYPE_UUID) && UUID && !memcmp(map->uuid, UUID, 16)) goto found;
 		else if (map->boxType == UserDataType) goto found;
 
 	}
 	return GF_BAD_PARAM;
 

Vulnerable code: 		if ((map->boxType == GF_ISOM_BOX_TYPE_UUID) && !memcmp(map->uuid, UUID, 16)) goto found;
Fixed code: 		if ((map->boxType == GF_ISOM_BOX_TYPE_UUID) && UUID && !memcmp(map->uuid, UUID, 16)) goto found;
CVE-2023-4682: Heap-based Buffer Overflow (CWE-122)
value: Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3-DEV.
CWE description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CVSS v3 base score: 5.5
Published: 2023-08-31T16:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/media_tools/avilib.c
Commit date: 2023-08-31 16:14:21 +0200
Commit message: fixed #2574

Diff: diff --git a/src/media_tools/avilib.c b/src/media_tools/avilib.c
index 459ff80438..27cd81133d 100644
--- a/src/media_tools/avilib.c
+++ b/src/media_tools/avilib.c
@@ -2939,19 +2939,18 @@ int AVI_read_frame(avi_t *AVI, u8 *vidbuf, int *keyframe)
 		AVI->video_pos++;
 		return n;
 	}
 
 	gf_fseek(AVI->fdes, AVI->video_index[AVI->video_pos].pos, SEEK_SET);
+	AVI->video_pos++;
 
 	if (avi_read(AVI->fdes,vidbuf,n) != (u32) n)
 	{
 		AVI_errno = AVI_ERR_READ;
 		return -1;
 	}
 
-	AVI->video_pos++;
-
 	return n;
 }
 
 #if 0 //unused
 int AVI_get_audio_position_index(avi_t *AVI)
@@ -3065,19 +3064,19 @@ int AVI_read_audio(avi_t *AVI, u8 *audbuf, int bytes, int *continuous)
 			todo = bytes;
 		else
 			todo = left;
 		pos = AVI->track[AVI->aptr].audio_index[AVI->track[AVI->aptr].audio_posc].pos + AVI->track[AVI->aptr].audio_posb;
 		gf_fseek(AVI->fdes, pos, SEEK_SET);
+		AVI->track[AVI->aptr].audio_posb += todo;
 		if ( (ret = avi_read(AVI->fdes,audbuf+nr,todo)) != todo)
 		{
 			GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[avilib] XXX pos = %"LLD", ret = %"LLD", todo = %ld\n", pos, ret, todo));
 			AVI_errno = AVI_ERR_READ;
 			return -1;
 		}
 		bytes -= todo;
 		nr    += todo;
-		AVI->track[AVI->aptr].audio_posb += todo;
 	}
 
 	return nr;
 }
 

Vulnerable code: 	AVI->video_pos++;

		AVI->track[AVI->aptr].audio_posb += todo;
Fixed code: 	AVI->video_pos++;
		AVI->track[AVI->aptr].audio_posb += todo;
CVE-2023-4683: NULL Pointer Dereference (CWE-476)
value: NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3-DEV.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2023-08-31T16:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/scene_manager/loader_bt.c, src/utils/xml_parser.c
Commit date: 2023-08-31 15:40:37 +0200
Commit message: fixed #2563

Diff: diff --git a/src/scene_manager/loader_bt.c b/src/scene_manager/loader_bt.c
index 130ae0170b..a376fa5e6b 100644
--- a/src/scene_manager/loader_bt.c
+++ b/src/scene_manager/loader_bt.c
@@ -3289,12 +3289,16 @@ GF_Err gf_bt_loader_run_intern(GF_BTParser *parser, GF_Command *init_com, Bool i
 	/*parse all top-level items*/
 	while (!parser->last_error) {
 		str = gf_bt_get_next(parser, 0);
 		if (parser->done) break;
 
+		if (!strcmp(str, "")) {
+			//empty string, force moving to next char
+			if (parser->line_pos<parser->line_size) parser->line_pos++;
+		}
 		/*X3D specific things (ignored for now)*/
-		if (!strcmp(str, "PROFILE")) gf_bt_force_line(parser);
+		else if (!strcmp(str, "PROFILE")) gf_bt_force_line(parser);
 		else if (!strcmp(str, "COMPONENT")) gf_bt_force_line(parser);
 		else if (!strcmp(str, "META")) gf_bt_force_line(parser);
 		else if (!strcmp(str, "IMPORT") || !strcmp(str, "EXPORT")) {
 			gf_bt_report(parser, GF_NOT_SUPPORTED, "X3D IMPORT/EXPORT not implemented");
 			break;
diff --git a/src/utils/xml_parser.c b/src/utils/xml_parser.c
index 11f6f2f5ca..2373ea63f2 100644
--- a/src/utils/xml_parser.c
+++ b/src/utils/xml_parser.c
@@ -1040,15 +1040,17 @@ static GF_Err gf_xml_sax_parse_intern(GF_SAXParser *parser, char *current)
 			sprintf(name, "%s%s;", entityStart+1, current);
 
 			ent = gf_xml_locate_entity(parser, name, &needs_text);
 			gf_free(name);
 
+			//entity not found, parse as regular string
 			if (!ent && !needs_text) {
 				xml_sax_append_string(parser, current);
 				xml_sax_parse(parser, GF_TRUE);
 				entityEnd[0] = ';';
 				current = entityEnd;
+				parser->in_entity = GF_FALSE;
 				continue;
 			}
 			assert(ent);
 			/*truncate input buffer*/
 			parser->line_size -= (u32) strlen(entityStart);

Vulnerable code: 		if (!strcmp(str, "PROFILE")) gf_bt_force_line(parser);
Fixed code: 		if (!strcmp(str, "")) {
			//empty string, force moving to next char
			if (parser->line_pos<parser->line_size) parser->line_pos++;
		}
		else if (!strcmp(str, "PROFILE")) gf_bt_force_line(parser);
			//entity not found, parse as regular string
				parser->in_entity = GF_FALSE;
CVE-2023-46928: Insufficient Information (NVD-CWE-noinfo)
value: GPAC 2.3-DEV-rev605-gfc9e29089-master contains a SEGV in gpac/MP4Box in gf_media_change_pl /afltest/gpac/src/media_tools/isom_tools.c:3293:42.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.5
Published: 2023-11-01T15:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/media_tools/isom_tools.c
Commit date: 2023-10-26 12:27:53 +0200
Commit message: null guard on gf_media_change_pl (fixes #2661)

Diff: diff --git a/src/media_tools/isom_tools.c b/src/media_tools/isom_tools.c
index 21f8905cf8..a41e51a0d5 100644
--- a/src/media_tools/isom_tools.c
+++ b/src/media_tools/isom_tools.c
@@ -633,11 +633,11 @@ GF_Err gf_media_make_isma(GF_ISOFile *mp4file, Bool keepESIDs, Bool keepImage, B
 	bifsT = gf_isom_new_track(mp4file, bifsID, GF_ISOM_MEDIA_SCENE, gf_isom_get_timescale(mp4file));
 	if (!bifsT) return gf_isom_last_error(mp4file);
 
 	_esd = gf_odf_desc_esd_new(SLPredef_MP4);
 	if (!_esd) return GF_OUT_OF_MEM;
-	
+
 	_esd->decoderConfig->bufferSizeDB = 20;
 	_esd->decoderConfig->objectTypeIndication = GF_CODECID_BIFS_V2;
 	_esd->decoderConfig->streamType = GF_STREAM_SCENE;
 	_esd->ESID = bifsID;
 	_esd->OCRESID = 0;
@@ -3287,10 +3287,14 @@ GF_Err gf_media_change_pl(GF_ISOFile *file, u32 track, u32 profile, u32 compat,
 	default:
 		return GF_OK;
 	}
 
 	avcc = gf_isom_avc_config_get(file, track, 1);
+
+	if (!avcc)
+		return GF_NON_COMPLIANT_BITSTREAM;
+
 	if (level) avcc->AVCLevelIndication = level;
 	if (compat) avcc->profile_compatibility = compat;
 	if (profile) avcc->AVCProfileIndication = profile;
 	count = gf_list_count(avcc->sequenceParameterSets);
 	for (i=0; i<count; i++) {

Fixed code: 

	if (!avcc)
		return GF_NON_COMPLIANT_BITSTREAM;
CVE-2023-46929: Insufficient Information (NVD-CWE-noinfo)
value: An issue discovered in GPAC 2.3-DEV-rev605-gfc9e29089-master in MP4Box in gf_avc_change_vui /afltest/gpac/src/media_tools/av_parsers.c:6872:55 allows attackers to crash the application.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2024-01-03T19:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/media_tools/av_parsers.c
Commit date: 2023-10-26 11:29:52 +0200
Commit message: add nullguard on gf_avc_change_vui (fixes #2662)

Diff: diff --git a/src/media_tools/av_parsers.c b/src/media_tools/av_parsers.c
index 43c3200b90..84e6601b64 100644
--- a/src/media_tools/av_parsers.c
+++ b/src/media_tools/av_parsers.c
@@ -6863,10 +6863,13 @@ GF_Err gf_avc_change_vui(GF_AVCConfig *avcc, GF_VUIInfo *vui_info)
 	u32 i, bit_offset, flag;
 	s32 idx;
 	GF_AVCConfigSlot *slc;
 	orig = NULL;
 
+	if (!avcc)
+		return GF_NON_COMPLIANT_BITSTREAM;
+
 	memset(&avc, 0, sizeof(AVCState));
 	avc.sps_active_idx = -1;
 
 	i=0;
 	while ((slc = (GF_AVCConfigSlot *)gf_list_enum(avcc->sequenceParameterSets, &i))) {

Fixed code: 	if (!avcc)
		return GF_NON_COMPLIANT_BITSTREAM;
CVE-2023-46930: Insufficient Information (NVD-CWE-noinfo)
value: GPAC 2.3-DEV-rev605-gfc9e29089-master contains a SEGV in gpac/MP4Box in gf_isom_find_od_id_for_track /afltest/gpac/src/isomedia/media_odf.c:522:14.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.5
Published: 2023-11-01T14:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/isomedia/media_odf.c
Commit date: 2023-10-26 11:21:33 +0200
Commit message: add null guards on gf_isom_find_od_id_for_track() (fixes #2666)

Diff: diff --git a/src/isomedia/media_odf.c b/src/isomedia/media_odf.c
index 76ecf9d135..5d842028ca 100644
--- a/src/isomedia/media_odf.c
+++ b/src/isomedia/media_odf.c
@@ -515,10 +515,17 @@ u32 gf_isom_find_od_id_for_track(GF_ISOFile *file, u32 track)
 	GF_TrackBox *tk = gf_isom_get_track_from_file(file, track);
 	if (!tk) return 0;
 
 	i=0;
 	while ( (od_tk = (GF_TrackBox*)gf_list_enum(file->moov->trackList, &i))) {
+		if (!od_tk || !od_tk->Media || !od_tk->Media->handler  || !od_tk->Media->information ||
+			!od_tk->Media->information->sampleTable || !od_tk->Media->information->sampleTable->SampleSize ) {
+
+			continue;
+		}
+
+
 		if (od_tk->Media->handler->handlerType != GF_ISOM_MEDIA_OD) continue;
 
 		for (j=0; j<od_tk->Media->information->sampleTable->SampleSize->sampleCount; j++) {
 			GF_ISOSample *samp = gf_isom_get_sample(file, i, j+1, &di);
 			the_od_id = Media_FindOD_ID(od_tk->Media, samp, tk->Header->trackID);

Fixed code: 		if (!od_tk || !od_tk->Media || !od_tk->Media->handler  || !od_tk->Media->information ||
			!od_tk->Media->information->sampleTable || !od_tk->Media->information->sampleTable->SampleSize ) {

			continue;
		}
CVE-2023-46931: Out-of-bounds Write (CWE-787)
value: GPAC 2.3-DEV-rev605-gfc9e29089-master contains a heap-buffer-overflow in ffdmx_parse_side_data /afltest/gpac/src/filters/ff_dmx.c:202:14 in gpac/MP4Box.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2023-11-01T14:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/ff_dmx.c
Commit date: 2023-10-26 12:28:38 +0200
Commit message: ffdmx: fix loop index mismatch on side data parsing (fixes #2664)

Diff: diff --git a/src/filters/ff_dmx.c b/src/filters/ff_dmx.c
index 180b1107c32..d2497c0d277 100644
--- a/src/filters/ff_dmx.c
+++ b/src/filters/ff_dmx.c
@@ -1235,11 +1235,11 @@ GF_Err ffdmx_init_common(GF_Filter *filter, GF_FFDemuxCtx *ctx, u32 grab_type)
 			gf_filter_pid_set_property(pid, GF_PROP_PID_IS_DEFAULT, &PROP_BOOL(GF_TRUE));
 		}
 		gf_filter_pid_set_property(pid, GF_PROP_PID_MUX_INDEX, &PROP_UINT(i+1));
 
 		for (j=0; j<(u32) stream->nb_side_data; j++) {
-			ffdmx_parse_side_data(&stream->side_data[i], pid);
+			ffdmx_parse_side_data(&stream->side_data[j], pid);
 		}
 
 		if (ctx->demuxer->nb_chapters) {
 			GF_PropertyValue p;
 			GF_PropUIntList times;

Vulnerable code: 			ffdmx_parse_side_data(&stream->side_data[i], pid);
Fixed code: 			ffdmx_parse_side_data(&stream->side_data[j], pid);
CVE-2023-4720: Floating Point Comparison with Incorrect Operator (CWE-1077)
value: Floating Point Comparison with Incorrect Operator in GitHub repository gpac/gpac prior to 2.3-DEV.
CWE description: The code performs a comparison such as an
        equality test between two float (floating point) values, but
        it uses comparison operators that do not account for the
        possibility of loss of precision.
CVSS v3 base score: 5.5
Published: 2023-09-01T16:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/scene_manager/swf_parse.c
Commit date: 2023-09-01 12:15:56 +0200
Commit message: Fixed #2581

Diff: diff --git a/src/scene_manager/swf_parse.c b/src/scene_manager/swf_parse.c
index 77044548c71..f4b974aab57 100644
--- a/src/scene_manager/swf_parse.c
+++ b/src/scene_manager/swf_parse.c
@@ -180,41 +180,21 @@ static void swf_get_rec(SWFReader *read, SWFRec *rc)
 	rc->h -= rc->y;
 }
 
 static u32 swf_get_32(SWFReader *read)
 {
-	u32 val, res;
-	val = swf_read_int(read, 32);
-	res = (val&0xFF);
-	res <<=8;
-	res |= ((val>>8)&0xFF);
-	res<<=8;
-	res |= ((val>>16)&0xFF);
-	res<<=8;
-	res|= ((val>>24)&0xFF);
-	return res;
+	return gf_bs_read_u32_le(read->bs);
 }
 
 static u16 swf_get_16(SWFReader *read)
 {
-	u16 val, res;
-	val = swf_read_int(read, 16);
-	res = (val&0xFF);
-	res <<=8;
-	res |= ((val>>8)&0xFF);
-	return res;
+	return gf_bs_read_u16_le(read->bs);
 }
 
 static s16 swf_get_s16(SWFReader *read)
 {
-	s16 val;
-	u8 v1;
-	v1 = swf_read_int(read, 8);
-	val = swf_read_sint(read, 8);
-	val = (val<<8)&0xFF00;
-	val |= (v1&0xFF);
-	return val;
+	return (s16) gf_bs_read_u16_le(read->bs);
 }
 
 static u32 swf_get_color(SWFReader *read)
 {
 	u32 res;

Vulnerable code: 	u32 val, res;
	val = swf_read_int(read, 32);
	res = (val&0xFF);
	res <<=8;
	res |= ((val>>8)&0xFF);
	res<<=8;
	res |= ((val>>16)&0xFF);
	res<<=8;
	res|= ((val>>24)&0xFF);
	return res;
	u16 val, res;
	val = swf_read_int(read, 16);
	res = (val&0xFF);
	res <<=8;
	res |= ((val>>8)&0xFF);
	return res;
	s16 val;
	u8 v1;
	v1 = swf_read_int(read, 8);
	val = swf_read_sint(read, 8);
	val = (val<<8)&0xFF00;
	val |= (v1&0xFF);
	return val;
Fixed code: 	return gf_bs_read_u32_le(read->bs);
	return gf_bs_read_u16_le(read->bs);
	return (s16) gf_bs_read_u16_le(read->bs);
CVE-2023-4721: Out-of-bounds Read (CWE-125)
value: Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2023-09-01T16:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/media_tools/mpeg2_ps.c
Commit date: 2023-09-01 12:04:54 +0200
Commit message: Fixed #2580

Diff: diff --git a/src/media_tools/mpeg2_ps.c b/src/media_tools/mpeg2_ps.c
index 0af7a31f32c..b0182f2249a 100644
--- a/src/media_tools/mpeg2_ps.c
+++ b/src/media_tools/mpeg2_ps.c
@@ -264,10 +264,12 @@ int MPEG12_ParseSeqHdr(unsigned char *pbuffer, u32 buflen, s32 *have_mpeg2, u32
 	u32 bitrate_int;
 	u32 bitrate_ext;
 	u32 scode, ix;
 	s32 found = -1;
 	*have_mpeg2 = 0;
+	if (buflen<6) return found;
+
 	buflen -= 6;
 	bitrate_int = 0;
 	for (ix = 0; ix < buflen; ix++, pbuffer++) {
 		scode = ((u32)pbuffer[0] << 24) | (pbuffer[1] << 16) | (pbuffer[2] << 8) |
 		        pbuffer[3];

Fixed code: 	if (buflen<6) return found;
CVE-2023-4722: Integer Overflow or Wraparound (CWE-190)
value: Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.3-DEV.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 5.5
Published: 2023-09-01T16:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/mux_isom.c
Commit date: 2023-09-01 11:58:14 +0200
Commit message: Fixed #2579

Diff: diff --git a/src/filters/mux_isom.c b/src/filters/mux_isom.c
index 08f9ff51d45..4044ef11fcc 100644
--- a/src/filters/mux_isom.c
+++ b/src/filters/mux_isom.c
@@ -5711,11 +5711,11 @@ static GF_Err mp4_mux_initialize_movie(GF_MP4MuxCtx *ctx)
 
 		p = gf_filter_pid_get_property(tkw->ipid, GF_PROP_PID_DURATION);
 		if (p && p->value.lfrac.den) {
 			tkw->pid_dur = p->value.lfrac;
 			if (tkw->pid_dur.num<0) tkw->pid_dur.num = -tkw->pid_dur.num;
-			if (max_dur.num * (s64) tkw->pid_dur.den < (s64) max_dur.den * tkw->pid_dur.num) {
+			if (gf_timestamp_less(max_dur.num, max_dur.den, tkw->pid_dur.num, tkw->pid_dur.den)) {
 				max_dur.num = tkw->pid_dur.num;
 				max_dur.den = tkw->pid_dur.den;
 			}
 		}
 #ifdef GF_ENABLE_CTRN

Vulnerable code: 			if (max_dur.num * (s64) tkw->pid_dur.den < (s64) max_dur.den * tkw->pid_dur.num) {
Fixed code: 			if (gf_timestamp_less(max_dur.num, max_dur.den, tkw->pid_dur.num, tkw->pid_dur.den)) {
CVE-2023-4754: Out-of-bounds Write (CWE-787)
value: Out-of-bounds Write in GitHub repository gpac/gpac prior to 2.3-DEV.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2023-09-04T09:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/scene_manager/swf_parse.c
Commit date: 2023-09-02 15:33:04 +0200
Commit message: Fixed #2582

Diff: diff --git a/src/scene_manager/swf_parse.c b/src/scene_manager/swf_parse.c
index f4b974aab57..2afa80c3e81 100644
--- a/src/scene_manager/swf_parse.c
+++ b/src/scene_manager/swf_parse.c
@@ -1424,11 +1424,11 @@ static GF_Err swf_def_font(SWFReader *read, u32 revision)
 		start = swf_get_file_pos(read);
 
 		count = swf_get_16(read);
 		ft->nbGlyphs = count / 2;
 		offset_table = (u32*)gf_malloc(sizeof(u32) * ft->nbGlyphs);
-		offset_table[0] = 0;
+		if (ft->nbGlyphs) offset_table[0] = 0;
 		for (i=1; i<ft->nbGlyphs; i++) offset_table[i] = swf_get_16(read);
 
 		for (i=0; i<ft->nbGlyphs; i++) {
 			swf_align(read);
 			e = swf_seek_file_to(read, start + offset_table[i]);

Vulnerable code: 		offset_table[0] = 0;
Fixed code: 		if (ft->nbGlyphs) offset_table[0] = 0;
CVE-2023-4755: Use After Free (CWE-416)
value: Use After Free in GitHub repository gpac/gpac prior to 2.3-DEV.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 5.5
Published: 2023-09-04T14:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/mux_isom.c
Commit date: 2023-09-02 15:36:49 +0200
Commit message: Fixed #2583

Diff: diff --git a/src/filters/mux_isom.c b/src/filters/mux_isom.c
index 4044ef11fcc..e9bc42231f2 100644
--- a/src/filters/mux_isom.c
+++ b/src/filters/mux_isom.c
@@ -3989,10 +3989,11 @@ static GF_Err mp4_mux_configure_pid(GF_Filter *filter, GF_FilterPid *pid, Bool i
 
 	if (is_remove) {
 		TrackWriter *tkw = gf_filter_pid_get_udta(pid);
 		if (tkw) {
 			gf_list_del_item(ctx->tracks, tkw);
+			if (ctx->ref_tkw == tkw) ctx->ref_tkw = gf_list_get(ctx->tracks, 0);
 			gf_free(tkw);
 		}
 		//removing last pid
 		if (ctx->opid && !gf_list_count(ctx->tracks)) {
 			if (ctx->file) {

Fixed code: 			if (ctx->ref_tkw == tkw) ctx->ref_tkw = gf_list_get(ctx->tracks, 0);