CVE-2021-29279: Out-of-bounds Write (CWE-787)
value: There is a integer overflow in function filter_core/filter_props.c:gf_props_assign_value in GPAC 1.0.1. In which, the arg const GF_PropertyValue *value,maybe value->value.data.size is a negative number. In result, memcpy in gf_props_assign_value failed.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2021-04-19T20:15Z
Repository: https://github.com/gpac/gpac
Language: C
Files changed: src/filters/reframe_flac.c
Commit date: 2021-03-29 09:17:40 +0200
Commit message: fixed 1718

Diff: diff --git a/src/filters/reframe_flac.c b/src/filters/reframe_flac.c
index 1e4f6467bb8..0d6bbd2aa89 100644
--- a/src/filters/reframe_flac.c
+++ b/src/filters/reframe_flac.c
@@ -57,10 +57,11 @@ typedef struct
 	Bool in_seek;
 	u32 timescale;
 	Bool is_playing;
 	Bool is_file;
 	Bool initial_play_done, file_loaded;
+	Bool in_error;
 
 	Bool initialized;
 	u32 sample_rate, nb_channels, bits_per_sample, block_size;
 
 	u8 *flac_buffer;
@@ -386,10 +387,13 @@ GF_Err flac_dmx_process(GF_Filter *filter)
 	Bool final_flush=GF_FALSE;
 	u32 pck_size, remain, prev_pck_size;
 	u64 cts = GF_FILTER_NO_TS;
 	FLACHeader hdr;
 
+	if (ctx->in_error)
+		return GF_NON_COMPLIANT_BITSTREAM;
+
 	//always reparse duration
 	if (!ctx->duration.num)
 		flac_dmx_check_dur(filter, ctx);
 
 	if (ctx->opid && !ctx->is_playing)
@@ -492,11 +496,16 @@ GF_Err flac_dmx_process(GF_Filter *filter)
 			u32 dsi_end = 0;
 			//we have a header
 			gf_bs_reassign_buffer(ctx->bs, ctx->flac_buffer, size);
 			u32 magic = gf_bs_read_u32(ctx->bs);
 			if (magic != GF_4CC('f','L','a','C')) {
-
+				GF_LOG(GF_LOG_ERROR, GF_LOG_PARSER, ("[FLACDmx] invalid FLAC magic\n"));
+				ctx->in_error = GF_TRUE;
+				ctx->flac_buffer_size = 0;
+				if (pck)
+					gf_filter_pid_drop_packet(ctx->ipid);
+				return GF_NON_COMPLIANT_BITSTREAM;
 			}
 			while (gf_bs_available(ctx->bs)) {
 				Bool last = gf_bs_read_int(ctx->bs, 1);
 				u32 type = gf_bs_read_int(ctx->bs, 7);
 				u32 len = gf_bs_read_int(ctx->bs, 24);
@@ -523,10 +532,18 @@ GF_Err flac_dmx_process(GF_Filter *filter)
 					//TODO: expose metadata, pictures and co
 					gf_bs_skip_bytes(ctx->bs, len);
 				}
 				if (last) break;
 			}
+			if (!dsi_end) {
+				GF_LOG(GF_LOG_ERROR, GF_LOG_PARSER, ("[FLACDmx] invalid FLAC header\n"));
+				ctx->in_error = GF_TRUE;
+				ctx->flac_buffer_size = 0;
+				if (pck)
+					gf_filter_pid_drop_packet(ctx->ipid);
+				return GF_NON_COMPLIANT_BITSTREAM;
+			}
 			flac_dmx_check_pid(filter, ctx, ctx->flac_buffer+4, dsi_end-4);
 			remain -= size;
 			start += size;
 			ctx->initialized = GF_TRUE;
 			if (!ctx->is_playing) break;

Fixed code: 	Bool in_error;
	if (ctx->in_error)
		return GF_NON_COMPLIANT_BITSTREAM;

				GF_LOG(GF_LOG_ERROR, GF_LOG_PARSER, ("[FLACDmx] invalid FLAC magic\n"));
				ctx->in_error = GF_TRUE;
				ctx->flac_buffer_size = 0;
				if (pck)
					gf_filter_pid_drop_packet(ctx->ipid);
				return GF_NON_COMPLIANT_BITSTREAM;
			if (!dsi_end) {
				GF_LOG(GF_LOG_ERROR, GF_LOG_PARSER, ("[FLACDmx] invalid FLAC header\n"));
				ctx->in_error = GF_TRUE;
				ctx->flac_buffer_size = 0;
				if (pck)
					gf_filter_pid_drop_packet(ctx->ipid);
				return GF_NON_COMPLIANT_BITSTREAM;
			}