hitoshura25/cvefixes huggingface dataset:
CVE-2020-23932 (C, published 2021-04-21T18:15Z)
Description: value: An issue was discovered in gpac before 1.0.1. A NULL pointer dereference exists in the function dump_isom_sdp located in filedump.c. It allows an attacker to cause Denial of Service.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
applications/mp4box/filedump.c
Commit message: fixed #1566


Vulnerable code:
	fprintf(dump, "%s", sdp);

Fixed code:
	if (sdp && size)
		fprintf(dump, "%s", sdp);
CVE-2020-25427 (C, published 2022-01-10T22:15Z)
Description: value: A Null pointer dereference vulnerability exits in MP4Box - GPAC version 0.8.0-rev177-g51a8ef874-master via the gf_isom_get_track_id function, which causes a denial of service.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/box_funcs.c
Commit message: fixed potential crash - cf #1406


Vulnerable code:
	if (newBox->size) {
		e = gf_isom_full_box_read(newBox, bs);
		if (!e) e = gf_isom_box_read(newBox, bs);
		newBox->size = size;
		end = gf_bs_get_position(bs);
	} else {
		newBox->size = size;
		//empty box
		e = GF_OK;
		end = gf_bs_get_position(bs);
	}

Fixed code:
	//parse even if size is 0 - this makes sure that we perform box parsing (usually in box->read)
	e = gf_isom_full_box_read(newBox, bs);
	if (!e) e = gf_isom_box_read(newBox, bs);
	newBox->size = size;
	end = gf_bs_get_position(bs);
CVE-2020-35979 (C, published 2021-04-21T16:15Z)
Description: value: An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is heap-based buffer overflow in the function gp_rtp_builder_do_avc() in ietf/rtp_pck_mpeg4.c.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gpac/gpac
Files changed:
src/media_tools/isom_hinter.c
Commit message: fixed #1662


Vulnerable code:
				e = gf_rtp_builder_process(tkHint->rtp_p, ptr, size, (u8) !remain, samp->dataLength, duration, (u8) (descIndex + GF_RTP_TX3G_SIDX_OFFSET) );
				ptr += size;

Fixed code:
				if (!size) {
					GF_LOG(GF_LOG_WARNING, GF_LOG_RTP, ("[rtp hinter] Broken AVC nalu encapsulation: NALU size is 0, ignoring it\n", size));
				} else {
					e = gf_rtp_builder_process(tkHint->rtp_p, ptr, size, (u8) !remain, samp->dataLength, duration, (u8) (descIndex + GF_RTP_TX3G_SIDX_OFFSET) );
					ptr += size;
				}
CVE-2020-35980 (C, published 2021-04-21T16:15Z)
Description: value: An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is a use-after-free in the function gf_isom_box_del() in isomedia/box_funcs.c.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/isom_store.c
Commit message: fixed #1661


Vulnerable code:

Fixed code:
		//in case we have an error in the middle of file write, remove our created stco and stsc from sample table
		gf_list_del_item(writer->stbl->child_boxes, writer->stco);
		gf_list_del_item(writer->stbl->child_boxes, writer->stsc);
CVE-2020-35981 (C, published 2021-04-21T16:15Z)
Description: value: An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is an invalid pointer dereference in the function SetupWriters() in isomedia/isom_store.c.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/isom_store.c
Commit message: fixed #1659


Vulnerable code:

Fixed code:
		GF_SampleTableBox *stbl;
		stbl = (trak->Media && trak->Media->information) ? trak->Media->information->sampleTable : NULL;
		if (!stbl || !stbl->SampleSize || !stbl->ChunkOffset || !stbl->SampleToChunk) {
			return GF_ISOM_INVALID_FILE;
		}
CVE-2020-35982 (C, published 2021-04-21T16:15Z)
Description: value: An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is an invalid pointer dereference in the function gf_hinter_track_finalize() in media_tools/isom_hinter.c.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/media_tools/isom_hinter.c
Commit message: fixed #1660


Vulnerable code:

Fixed code:
			if (!svcc)
				return GF_ISOM_INVALID_FILE;
CVE-2021-29279 (C, published 2021-04-19T20:15Z)
Description: value: There is a integer overflow in function filter_core/filter_props.c:gf_props_assign_value in GPAC 1.0.1. In which, the arg const GF_PropertyValue *value,maybe value->value.data.size is a negative number. In result, memcpy in gf_props_assign_value failed.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/gpac/gpac
Files changed:
src/filters/reframe_flac.c
Commit message: fixed 1718


Vulnerable code:

Fixed code:
	Bool in_error;
	if (ctx->in_error)
		return GF_NON_COMPLIANT_BITSTREAM;

				GF_LOG(GF_LOG_ERROR, GF_LOG_PARSER, ("[FLACDmx] invalid FLAC magic\n"));
				ctx->in_error = GF_TRUE;
				ctx->flac_buffer_size = 0;
				if (pck)
					gf_filter_pid_drop_packet(ctx->ipid);
				return GF_NON_COMPLIANT_BITSTREAM;
			if (!dsi_end) {
				GF_LOG(GF_LOG_ERROR, GF_LOG_PARSER, ("[FLACDmx] invalid FLAC header\n"));
				ctx->in_error = GF_TRUE;
				ctx->flac_buffer_size = 0;
				if (pck)
					gf_filter_pid_drop_packet(ctx->ipid);
				return GF_NON_COMPLIANT_BITSTREAM;
			}
CVE-2021-29279 (C, published 2021-04-19T20:15Z)
Description: value: There is a integer overflow in function filter_core/filter_props.c:gf_props_assign_value in GPAC 1.0.1. In which, the arg const GF_PropertyValue *value,maybe value->value.data.size is a negative number. In result, memcpy in gf_props_assign_value failed.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gpac/gpac
Files changed:
src/filters/reframe_flac.c
Commit message: fixed 1718


Vulnerable code:

Fixed code:
	Bool in_error;
	if (ctx->in_error)
		return GF_NON_COMPLIANT_BITSTREAM;

				GF_LOG(GF_LOG_ERROR, GF_LOG_PARSER, ("[FLACDmx] invalid FLAC magic\n"));
				ctx->in_error = GF_TRUE;
				ctx->flac_buffer_size = 0;
				if (pck)
					gf_filter_pid_drop_packet(ctx->ipid);
				return GF_NON_COMPLIANT_BITSTREAM;
			if (!dsi_end) {
				GF_LOG(GF_LOG_ERROR, GF_LOG_PARSER, ("[FLACDmx] invalid FLAC header\n"));
				ctx->in_error = GF_TRUE;
				ctx->flac_buffer_size = 0;
				if (pck)
					gf_filter_pid_drop_packet(ctx->ipid);
				return GF_NON_COMPLIANT_BITSTREAM;
			}
CVE-2021-30014 (C, published 2021-04-19T20:15Z)
Description: value: There is a integer overflow in media_tools/av_parsers.c in the hevc_parse_slice_segment function in GPAC 1.0.1 which results in a crash.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/gpac/gpac
Files changed:
src/media_tools/av_parsers.c
Commit message: add safety in avc/hevc/vvc sps/pps/vps ID check - cf #1720 #1721 #1722


Vulnerable code:
	if (sps_id >= 32) {
		return -1;
	}
	if (sps_id < 0) {
	if (pps_id >= 255) {
	if (pps->sps_id >= 32) {
	if (pps_id >= 64)
	if (vps_id >= 16) return -1;
	if (vps_id >= 16) {
	if (pps->sps_id >= 16) {
	if (vps_id >= 16) return -1;
	if (sps_id >= 16) {
	if (vps_id >= 16) {
	if (pps->sps_id >= 16) {
	if (pps_id >= 64)

Fixed code:
	if ((sps_id < 0) || (sps_id >= 32)) {
	if ((pps_id<0) || (pps_id >= 255)) {
	if ((pps->sps_id<0) || (pps->sps_id >= 32)) {
	if ((pps_id<0) || (pps_id >= 64))
	if ((vps_id<0) || (vps_id >= 16)) return -1;
	if ((vps_id<0) || (vps_id >= 16)) {
	if ((pps->sps_id<0) || (pps->sps_id >= 16)) {
	if ((vps_id<0) || (vps_id >= 16)) return -1;
	if ((sps_id<0) || (sps_id >= 16)) {
	if ((vps_id<0) || (vps_id >= 16)) {
	if ((pps->sps_id<0) || (pps->sps_id >= 16)) {
	if ((pps_id<0) || (pps_id >= 64))
CVE-2021-30015 (C, published 2021-04-19T20:15Z)
Description: value: There is a Null Pointer Dereference in function filter_core/filter_pck.c:gf_filter_pck_new_alloc_internal in GPAC 1.0.1. The pid comes from function av1dmx_parse_flush_sample, the ctx.opid maybe NULL. The result is a crash in gf_filter_pck_new_alloc_internal.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/filters/reframe_av1.c
Commit message: fixed #1719


Vulnerable code:

Fixed code:
	if (!ctx->opid)
		return GF_NON_COMPLIANT_BITSTREAM;
CVE-2021-30019 (C, published 2021-04-19T20:15Z)
Description: value: In the adts_dmx_process function in filters/reframe_adts.c in GPAC 1.0.1, a crafted file may cause ctx->hdr.frame_size to be smaller than ctx->hdr.hdr_size, resulting in size to be a negative number and a heap overflow in the memcpy.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gpac/gpac
Files changed:
src/filters/reframe_adts.c
Commit message: fixed potential crash in adts reframer with broken streams - cf #1723


Vulnerable code:

Fixed code:
		if (ctx->hdr.frame_size < ctx->hdr.hdr_size) {
			GF_LOG(GF_LOG_WARNING, GF_LOG_PARSER, ("[ADTSDmx] Corrupted ADTS frame header, resyncing\n"));
			ctx->nb_frames = 0;
			goto drop_byte;
		}
CVE-2021-30020 (C, published 2021-04-19T20:15Z)
Description: value: In the function gf_hevc_read_pps_bs_internal function in media_tools/av_parsers.c in GPAC 1.0.1 there is a loop, which with crafted file, pps->num_tile_columns may be larger than sizeof(pps->column_width), which results in a heap overflow in the loop.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gpac/gpac
Files changed:
src/media_tools/av_parsers.c
Commit message: add safety in avc/hevc/vvc sps/pps/vps ID check - cf #1720 #1721 #1722


Vulnerable code:
	if (sps_id >= 32) {
		return -1;
	}
	if (sps_id < 0) {
	if (pps_id >= 255) {
	if (pps->sps_id >= 32) {
	if (pps_id >= 64)
	if (vps_id >= 16) return -1;
	if (vps_id >= 16) {
	if (pps->sps_id >= 16) {
	if (vps_id >= 16) return -1;
	if (sps_id >= 16) {
	if (vps_id >= 16) {
	if (pps->sps_id >= 16) {
	if (pps_id >= 64)

Fixed code:
	if ((sps_id < 0) || (sps_id >= 32)) {
	if ((pps_id<0) || (pps_id >= 255)) {
	if ((pps->sps_id<0) || (pps->sps_id >= 32)) {
	if ((pps_id<0) || (pps_id >= 64))
	if ((vps_id<0) || (vps_id >= 16)) return -1;
	if ((vps_id<0) || (vps_id >= 16)) {
	if ((pps->sps_id<0) || (pps->sps_id >= 16)) {
	if ((vps_id<0) || (vps_id >= 16)) return -1;
	if ((sps_id<0) || (sps_id >= 16)) {
	if ((vps_id<0) || (vps_id >= 16)) {
	if ((pps->sps_id<0) || (pps->sps_id >= 16)) {
	if ((pps_id<0) || (pps_id >= 64))
CVE-2021-30022 (C, published 2021-04-19T20:15Z)
Description: value: There is a integer overflow in media_tools/av_parsers.c in the gf_avc_read_pps_bs_internal in GPAC 1.0.1. pps_id may be a negative number, so it will not return. However, avc->pps only has 255 unit, so there is an overflow, which results a crash.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/gpac/gpac
Files changed:
src/media_tools/av_parsers.c
Commit message: add safety in avc/hevc/vvc sps/pps/vps ID check - cf #1720 #1721 #1722


Vulnerable code:
	if (sps_id >= 32) {
		return -1;
	}
	if (sps_id < 0) {
	if (pps_id >= 255) {
	if (pps->sps_id >= 32) {
	if (pps_id >= 64)
	if (vps_id >= 16) return -1;
	if (vps_id >= 16) {
	if (pps->sps_id >= 16) {
	if (vps_id >= 16) return -1;
	if (sps_id >= 16) {
	if (vps_id >= 16) {
	if (pps->sps_id >= 16) {
	if (pps_id >= 64)

Fixed code:
	if ((sps_id < 0) || (sps_id >= 32)) {
	if ((pps_id<0) || (pps_id >= 255)) {
	if ((pps->sps_id<0) || (pps->sps_id >= 32)) {
	if ((pps_id<0) || (pps_id >= 64))
	if ((vps_id<0) || (vps_id >= 16)) return -1;
	if ((vps_id<0) || (vps_id >= 16)) {
	if ((pps->sps_id<0) || (pps->sps_id >= 16)) {
	if ((vps_id<0) || (vps_id >= 16)) return -1;
	if ((sps_id<0) || (sps_id >= 16)) {
	if ((vps_id<0) || (vps_id >= 16)) {
	if ((pps->sps_id<0) || (pps->sps_id >= 16)) {
	if ((pps_id<0) || (pps_id >= 64))
CVE-2021-30199 (C, published 2021-04-19T20:15Z)
Description: value: In filters/reframe_latm.c in GPAC 1.0.1 there is a Null Pointer Dereference, when gf_filter_pck_get_data is called. The first arg pck may be null with a crafted mp4 file,which results in a crash.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/filters/reframe_latm.c
Commit message: fixed #1728


Vulnerable code:
	u8 *data, *output;
	u32 pck_size, prev_pck_size;
	data = (char *) gf_filter_pck_get_data(pck, &pck_size);


Fixed code:
	u8 *data=NULL, *output;
	u32 pck_size=0, prev_pck_size;
	} else {
		data = (char *) gf_filter_pck_get_data(pck, &pck_size);
CVE-2021-31254 (C, published 2021-04-19T19:15Z)
Description: value: Buffer overflow in the tenc_box_read function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file, related invalid IV sizes.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/box_code_drm.c
Commit message: fixed #1703


Vulnerable code:

Fixed code:
		if ((iv_size!=8) && (iv_size!=16)) {
			GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[iso file] Invalid constant IV size %d, must be 8 or 16\n", (u32) iv_size));
			ptr->key_info[20] = 16;
			return GF_NON_COMPLIANT_BITSTREAM;
		}
	else if ((iv_size!=0) && (iv_size!=8) && (iv_size!=16)) {
		GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[iso file] Invalid IV size %d, must be 0, 8 or 16\n", (u32) iv_size));
		return GF_NON_COMPLIANT_BITSTREAM;
	}
CVE-2021-31255 (C, published 2021-04-19T19:15Z)
Description: value: Buffer overflow in the abst_box_read function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/box_code_adobe.c
Commit message: fixed #1733


Vulnerable code:
		if (!tmp_str[i])
			if (!tmp_str[j])
			if (!tmp_str[j])
		if (!tmp_str[i])
		if (!tmp_str[i])

Fixed code:
	Bool zfound=GF_FALSE;
		if (!tmp_str[i]) {
			zfound = GF_TRUE;
		}
	if (!zfound)
		return GF_ISOM_INVALID_FILE;
		zfound = GF_FALSE;
			if (!tmp_str[j]) {
				zfound = GF_TRUE;
			}
		if (!zfound)
			return GF_ISOM_INVALID_FILE;
		zfound = GF_FALSE;
			if (!tmp_str[j]) {
				zfound = GF_TRUE;
			}
		if (!zfound)
			return GF_ISOM_INVALID_FILE;
	zfound = GF_FALSE;
		if (!tmp_str[i]) {
			zfound = GF_TRUE;
		}
	if (!zfound)
		return GF_ISOM_INVALID_FILE;
	zfound = GF_FALSE;
		if (!tmp_str[i]) {
			zfound = GF_TRUE;
		}
	if (!zfound)
		return GF_ISOM_INVALID_FILE;
CVE-2021-31256 (C, published 2021-04-19T19:15Z)
Description: value: Memory leak in the stbl_GetSampleInfos function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/stbl_read.c
Commit message: fixed #1705


Vulnerable code:

Fixed code:
			if (stco->nb_entries < sampleNumber) return GF_ISOM_INVALID_FILE;
			if (co64->nb_entries < sampleNumber) return GF_ISOM_INVALID_FILE;
CVE-2021-31257 (C, published 2021-04-19T19:15Z)
Description: value: The HintFile function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
applications/mp4box/main.c
Commit message: fixed #1734


Vulnerable code:
		if (esd) {

Fixed code:
		if (esd && esd->decoderConfig) {
CVE-2021-31258 (C, published 2021-04-19T19:15Z)
Description: value: The gf_isom_set_extraction_slc function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/isom_read.c
src/isomedia/isom_write.c
src/media_tools/isom_hinter.c
Commit message: fixed #1706


Vulnerable code:
		if (((GF_MPEGSampleEntryBox *)entry)->esd->desc->slConfig->predefined != SLPredef_MP4) return GF_BAD_PARAM;
		if (((GF_MPEGAudioSampleEntryBox *)entry)->esd->desc->slConfig->predefined != SLPredef_MP4) return GF_BAD_PARAM;
		if (((GF_MPEGVisualSampleEntryBox *)entry)->esd->desc->slConfig->predefined != SLPredef_MP4) return GF_BAD_PARAM;
		gf_isom_set_extraction_slc(file, TrackNum, 1, &my_sl);

Fixed code:
				if (!dcd) break;
	GF_ESDBox *esds;
		esds = ((GF_MPEGSampleEntryBox *)entry)->esd;
		if (!esds || !esds->desc || !esds->desc->slConfig || (esds->desc->slConfig->predefined != SLPredef_MP4))
			return GF_ISOM_INVALID_FILE;
		esds = ((GF_MPEGAudioSampleEntryBox *)entry)->esd;
		if (!esds || !esds->desc || !esds->desc->slConfig || (esds->desc->slConfig->predefined != SLPredef_MP4))
			return GF_ISOM_INVALID_FILE;
		esds = ((GF_MPEGVisualSampleEntryBox *)entry)->esd;
		if (!esds || !esds->desc || !esds->desc->slConfig || (esds->desc->slConfig->predefined != SLPredef_MP4))
			return GF_ISOM_INVALID_FILE;
		*e = gf_isom_set_extraction_slc(file, TrackNum, 1, &my_sl);
		if (*e) {
			gf_hinter_track_del(tmp);
			return NULL;
		}
CVE-2021-31259 (C, published 2021-04-19T19:15Z)
Description: value: The gf_isom_cenc_get_default_info_internal function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/drm_sample.c
Commit message: fixed #1735


Vulnerable code:
			if (!seig_entry->key_info[0])

Fixed code:
			if (seig_entry && !seig_entry->key_info[0])
CVE-2021-31260 (C, published 2021-04-19T19:15Z)
Description: value: The MergeTrack function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/track.c
Commit message: fixed #1736


Vulnerable code:
					offset = saio->offsets[0] + moof_offset;
					nb_saio = saio->entry_count;
					break;

Fixed code:
					if (saio->offsets && saio->entry_count) {
						offset = saio->offsets[0] + moof_offset;
						nb_saio = saio->entry_count;
						break;
					}
				saio = NULL;
				saiz = NULL;
CVE-2021-31261 (C, published 2021-04-19T19:15Z)
Description: value: The gf_hinter_track_new function in GPAC 1.0.1 allows attackers to read memory via a crafted file in the MP4Box command.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/gpac/gpac
Files changed:
src/media_tools/isom_hinter.c
Commit message: fixed #1737


Vulnerable code:
				gf_odf_desc_del((GF_Descriptor*)esd);

Fixed code:
			if (esd)
				gf_odf_desc_del((GF_Descriptor*)esd);
CVE-2021-31262 (C, published 2021-04-19T19:15Z)
Description: value: The AV1_DuplicateConfig function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/avc_ext.c
Commit message: fixed #1738


Vulnerable code:
static GF_AV1Config* AV1_DuplicateConfig(GF_AV1Config const * const cfg) {
	if (av1->av1_config) {
	if (!entry || !entry->av1_config) return NULL;

Fixed code:
static GF_AV1Config* AV1_DuplicateConfig(GF_AV1Config const * const cfg)
{
	if (av1->av1_config && av1->av1_config->config) {
	if (!entry || !entry->av1_config|| !entry->av1_config->config) return NULL;