hitoshura25/cvefixes huggingface dataset:
CVE-2022-4202 (C, published 2022-11-29T09:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in GPAC 2.1-DEV-rev490-g68064e101-master. Affected is the function lsr_translate_coords of the file laser/lsr_dec.c. The manipulation leads to integer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is b3d821c4ae9ba62b3a194d9dcb5e99f17bd56908. It is recommended to apply a patch to fix this issue. VDB-214518 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-189 \u2014 Numeric Errors
Weaknesses in this category are related to improper calculation or conversion of numbers.
Repository: https://github.com/gpac/gpac
Files changed:
src/laser/lsr_dec.c
Commit message: fixed #2333


Vulnerable code:
	u32 len;
//	while (len) gf_bs_read_int(lsr->bs, 1);
	gf_bs_read_long_int(lsr->bs, len);
	
		s32 neg = (s32) val - (1<<nb_bits);
		s32 neg = (s32) val - (1<<nb_bits);
		return gf_divfix(INT2FIX(neg), lsr->res_factor);
		return gf_divfix(INT2FIX(val), lsr->res_factor);
		s32 v = val - (1<<lsr->coord_bits);

Fixed code:
	u32 len, blen;
	while (len && !gf_bs_is_align(lsr->bs)) {
		gf_bs_read_int(lsr->bs, len);
		len--;
	}
	blen = len / 8;
	gf_bs_skip_bytes(lsr->bs, blen);
	len -= blen*8;

	while (len) {
		gf_bs_read_int(lsr->bs, 1);
		len--;
	}
	if (nb_bits>=32) return 0;

		s64 neg = (s64) val - (0x00000001UL << nb_bits);
		s64 neg = (s64) val - (0x00000001UL << nb_bits);
		return ((Fixed)neg) / lsr->res_factor;
		return ((Fixed)val) / lsr->res_factor;
		s64 v = val - (0x00000001UL << lsr->coord_bits);
CVE-2023-0358 (C, published 2023-01-18T02:15Z)
Description: value: Use After Free in GitHub repository gpac/gpac prior to 2.3.0-DEV.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/gpac/gpac
Files changed:
src/odf/descriptors.c
Commit message: fixed #2378


Vulnerable code:
			GF_LOG(GF_LOG_WARNING, GF_LOG_CODING, ("[VVC] Invalid NALU type in vvcC - ignoring\n", ar->nalus));
		if ((ar->type != GF_VVC_NALU_DEC_PARAM) && (ar->type != GF_VVC_NALU_OPI))

Fixed code:
			GF_LOG(GF_LOG_WARNING, GF_LOG_CODING, ("[VVC] Invalid NALU type %d in vvcC - ignoring\n", ar->type));
		if (!valid || ((ar->type != GF_VVC_NALU_DEC_PARAM) && (ar->type != GF_VVC_NALU_OPI)))
CVE-2023-0760 (C, published 2023-02-09T14:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to V2.1.0-DEV.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/box_code_base.c
src/isomedia/box_funcs.c
src/isomedia/isom_read.c
Commit message: sgpd box entry: disallow null grouping_type (#2389)


Vulnerable code:
	
	
	
	
	//happens when partially cloning boxes 
	
		 
	
	

Fixed code:


	case 0:
		GF_LOG(GF_LOG_WARNING, GF_LOG_CONTAINER, ("[iso file] sgpd entry null grouping_type is invalid\n") );
		return NULL;


	//happens when partially cloning boxes
CVE-2023-0770 (C, published 2023-02-09T22:15Z)
Description: value: Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gpac/gpac
Files changed:
src/scenegraph/vrml_proto.c
Commit message: fixed #2316


Vulnerable code:
		if (r->ToNode->sgprivate->tag == TAG_ProtoNode) return gf_sg_proto_field_is_sftime_offset(r->ToNode, &inf);

Fixed code:
		if (r->ToNode->sgprivate->tag == TAG_ProtoNode) {
			if (r->ToNode==node) continue;
			return gf_sg_proto_field_is_sftime_offset(r->ToNode, &inf);
		}
CVE-2023-0817 (C, published 2023-02-13T22:15Z)
Description: value: Buffer Over-read in GitHub repository gpac/gpac prior to v2.3.0-DEV.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gpac/gpac
Files changed:
src/filters/reframe_mhas.c
Commit message: mhas: check idx not oob (#2398)


Vulnerable code:
			u32 sr = 0;
			else if (sr < nb_usac_sr) {
			else if (sr < nb_usac_sr) {

Fixed code:
			else if (idx < nb_usac_sr) {
			else if (idx < nb_usac_sr) {
CVE-2023-0818 (C, published 2023-02-13T22:15Z)
Description: value: Off-by-one Error in GitHub repository gpac/gpac prior to v2.3.0-DEV.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-193 \u2014 Off-by-one Error
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
Repository: https://github.com/gpac/gpac
Files changed:
src/filters/load_text.c
Commit message: fix a5efec8 to cover more cases (#2397)


Vulnerable code:
			if (j >= GF_ARRAY_LENGTH(szLineConv) - 1) {
				GF_LOG(GF_LOG_DEBUG, GF_LOG_PARSER, ("[TXTIn] Line too long to convert to utf8 (len: %d)\n", len));
				break;
			}

Fixed code:
					if (j >= GF_ARRAY_LENGTH(szLineConv))
						break;
					if (j >= GF_ARRAY_LENGTH(szLineConv))
						break;
					if (j+1 >= GF_ARRAY_LENGTH(szLineConv))
						break;
					if (j+2 >= GF_ARRAY_LENGTH(szLineConv))
						break;

			if (j >= GF_ARRAY_LENGTH(szLineConv))
				break;

		}
		if ( j >= GF_ARRAY_LENGTH(szLineConv) ) {
			GF_LOG(GF_LOG_DEBUG, GF_LOG_PARSER, ("[TXTIn] Line too long to convert to utf8 (len: %d)\n", len));
			j = GF_ARRAY_LENGTH(szLineConv) -1 ;
CVE-2023-0819 (C, published 2023-02-13T22:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to v2.3.0-DEV.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/gpac/gpac
Files changed:
src/media_tools/mpegts.c
Commit message: mpeg2ts: add section size check (#2395)


Vulnerable code:

Fixed code:
	if (data_size < 5) {
		GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[MPEG-2 TS] Section data size too small to read date (len: %u)\n", data_size));
		return;
	}
CVE-2023-0866 (C, published 2023-02-16T20:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3.0-DEV.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/gpac/gpac
Files changed:
src/filters/reframe_adts.c
Commit message: rfadts: add size guard on dmx (#2400)


Vulnerable code:

Fixed code:


			if (sync_pos + offset + size > remain) {
				GF_LOG(GF_LOG_WARNING, GF_LOG_MEDIA, ("[ADTSDmx] truncated frame\n"));
				break;
			}
CVE-2023-1654 (C, published 2023-03-27T16:15Z)
Description: value: Denial of Service in GitHub repository gpac/gpac prior to 2.4.0.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/gpac/gpac
Files changed:
src/filter_core/filter_pid.c
Commit message: fixed #2429


Vulnerable code:
		if (safe_int_dec(&pidinst->props->reference_count) == 0) {
			//see \ref gf_filter_pid_merge_properties_internal for mutex
			gf_mx_p(pidinst->pid->filter->tasks_mx);
			gf_list_del_item(pidinst->pid->properties, pidinst->props);
			gf_mx_v(pidinst->pid->filter->tasks_mx);
			gf_props_del(pidinst->props);
						//detach props but don't delete them
		//assert(!new_chain_input->swap_pidinst_dst);
	//move to rela pid

Fixed code:
		gf_mx_p(pidinst->pid->filter->tasks_mx);
		//not in parent pid, may happen when reattaching a pid inst to a different pid
		//in this case do NOT delete the props
		if (gf_list_find(pidinst->pid->properties, pidinst->props)>=0) {
			if (safe_int_dec(&pidinst->props->reference_count) == 0) {
				//see \ref gf_filter_pid_merge_properties_internal for mutex
				gf_list_del_item(pidinst->pid->properties, pidinst->props);
				gf_props_del(pidinst->props);
			}
		gf_mx_v(pidinst->pid->filter->tasks_mx);
						//detach props
							GF_FilterPidInst *swap_pidi = filter->swap_pidinst_dst;
							if (safe_int_dec(&swap_pidi->props->reference_count)==0) {
								gf_mx_p(swap_pidi->pid->filter->tasks_mx);
								gf_list_del_item(swap_pidi->pid->properties, pidinst->props);
								gf_mx_v(swap_pidi->pid->filter->tasks_mx);
								gf_props_del(pidinst->props);
							}
		//when swaping encoder, we may have swap_pidinst_dst not NULL so only check swap_pidinst_src
	//move to real pid
CVE-2023-1655 (C, published 2023-03-27T15:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.4.0.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/gpac/gpac
Files changed:
src/filters/reframe_rawpcm.c
src/utils/bitstream.c
Commit message: fixed #2425


Vulnerable code:
			if (ctx->probe_data_size<=10000) {
				gf_filter_pid_drop_packet(ctx->ipid);
				return GF_OK;
			GF_LOG(GF_LOG_WARNING, GF_LOG_MEDIA, ("[PCMReframe] Cannot find wave data chink afetr %d bytes, aborting\n", ctx->probe_data_size));

Fixed code:
		Bool hdr_found = GF_FALSE;
			hdr_found = GF_TRUE;
			if (!hdr_found) {
				if (ctx->probe_data_size<=10000) {
					gf_filter_pid_drop_packet(ctx->ipid);
					return GF_OK;
				}
				GF_LOG(GF_LOG_WARNING, GF_LOG_MEDIA, ("[PCMReframe] Cannot find wave data chunk after %d bytes, aborting\n", ctx->probe_data_size));
			if (bs->position>bs->size) {
				bs->position = bs->size;
				bs->overflow_state = 1;
			}
CVE-2023-23143 (C, published 2023-01-20T19:15Z)
Description: value: Buffer overflow vulnerability in function avc_parse_slice in file media_tools/av_parsers.c. GPAC version 2.3-DEV-rev1-g4669ba229-master.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/gpac/gpac
Files changed:
src/media_tools/av_parsers.c
Commit message: fixed #2366


Vulnerable code:
	if ((pps_id<0) || (pps_id > 255)) return -1;
	if (si->pps->sps_id>=255) return -1;
	if ((pps_id<0) || (pps_id > 255))

Fixed code:
	if ((pps_id<0) || (pps_id >= 255)) return -1;
	if (si->pps->sps_id>=32) return -1;
	if ((pps_id<0) || (pps_id >= 255))
CVE-2023-23144 (C, published 2023-01-20T19:15Z)
Description: value: Integer overflow vulnerability in function Q_DecCoordOnUnitSphere file bifs/unquantize.c in GPAC version 2.2-rev0-gab012bbfb-master.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/gpac/gpac
Files changed:
src/bifs/unquantize.c
Commit message: fixed #2364


Vulnerable code:
 *			Copyright (c) Telecom ParisTech 2000-2012


Fixed code:
 *			Copyright (c) Telecom ParisTech 2000-2023
	if (NbBits>32) return GF_NON_COMPLIANT_BITSTREAM;
CVE-2023-23145 (C, published 2023-01-20T19:15Z)
Description: value: GPAC version 2.2-rev0-gab012bbfb-master was discovered to contain a memory leak in lsr_read_rare_full function.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/gpac/gpac
Files changed:
src/laser/lsr_dec.c
Commit message: fixed #2365


Vulnerable code:
 *			Copyright (c) Telecom ParisTech 2005-2022
				da->array.vals = (Fixed*)gf_malloc(sizeof(Fixed)*da->array.count);
				da->array.units = (u8*)gf_malloc(sizeof(u8)*da->array.count);

Fixed code:
 *			Copyright (c) Telecom ParisTech 2005-2023
				da->array.vals = (Fixed*)gf_realloc(da->array.vals, sizeof(Fixed)*da->array.count);
				da->array.units = (u8*)gf_realloc(da->array.units, sizeof(u8)*da->array.count);
CVE-2023-2837 (C, published 2023-05-22T18:15Z)
Description: value: Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.2.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-121 \u2014 Stack-based Buffer Overflow
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
Repository: https://github.com/gpac/gpac
Files changed:
src/utils/xml_parser.c
Commit message: fixed #2473


Vulnerable code:
						e = gf_xml_sax_parse_intern(parser, orig_buf);
		xml_sax_parse(parser, GF_TRUE);

Fixed code:
	u32 ent_rec_level;
						parser->ent_rec_level++;
						if (parser->ent_rec_level>100) {
							GF_LOG(GF_LOG_WARNING, GF_LOG_CORE, ("[XML] Too many recursions in entity solving, max 100 allowed\n"));
							e = GF_NOT_SUPPORTED;
						} else {
							e = gf_xml_sax_parse_intern(parser, orig_buf);
							parser->ent_rec_level--;
						}
		GF_Err e = xml_sax_parse(parser, GF_TRUE);
		if (e) return e;
CVE-2023-2838 (C, published 2023-05-22T18:15Z)
Description: value: Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.
Severity: nan (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gpac/gpac
Files changed:
src/filter_core/filter_session.c
Commit message: fixed #2475


Vulnerable code:

Fixed code:
		if (!pidi->pid)
			continue;
CVE-2023-2839 (C, published 2023-05-22T18:15Z)
Description: value: Divide By Zero in GitHub repository gpac/gpac prior to 2.2.2.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/gpac/gpac
Files changed:
src/filters/reframe_nalu.c
Commit message: fixed #2476


Vulnerable code:
				if (ctx->notime && sps->vui.time_scale && sps->vui.num_units_in_tick) {
					ctx->cur_fps.num = 2 * sps->vui.time_scale;
					ctx->cur_fps.den = 2 * sps->vui.num_units_in_tick * DeltaTfiDivisorIdx;


Fixed code:
				if (ctx->notime) {
					u32 fps_num = 2 * sps->vui.time_scale;
					u32 fps_den = 2 * sps->vui.num_units_in_tick * DeltaTfiDivisorIdx;
					if (fps_num && fps_den) {
						ctx->cur_fps.num = fps_num;
						ctx->cur_fps.den = fps_den;
					}
CVE-2023-2840 (C, published 2023-05-22T18:15Z)
Description: value: NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.2.2.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/movie_fragments.c
Commit message: fixed #2474


Vulnerable code:
		Media_ParseODFrame(traf->trex->track->Media, sample, &od_sample);

Fixed code:
		GF_Err e = Media_ParseODFrame(traf->trex->track->Media, sample, &od_sample);
		if (!od_sample) return e;
CVE-2023-3012 (C, published 2023-05-31T14:15Z)
Description: value: NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.2.2.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/utils/xml_parser.c
Commit message: fixed #2480


Vulnerable code:
	u32 nl_size = (u32) strlen(string);

Fixed code:
	if (ent && !ent->value)
		parser->sax_state = SAX_STATE_SYNTAX_ERROR;
	u32 nl_size = string ? (u32) strlen(string) : 0;
CVE-2023-3013 (C, published 2023-05-31T14:15Z)
Description: value: Unchecked Return Value in GitHub repository gpac/gpac prior to 2.2.2.
Severity: nan (CVSS v3 base score: 7.1)
Weakness: CWE-252 \u2014 Unchecked Return Value
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
Repository: https://github.com/gpac/gpac
Files changed:
src/filters/dasher.c
Commit message: fixed #2485


Vulnerable code:
				GF_NALUFFParam *sl = (GF_NALUFFParam *)gf_list_get(avccfg->sequenceParameterSets, 0);
				if (sl) {
					s32 idx;
					memset(&avc, 0, sizeof(AVCState));
					idx = gf_avc_read_sps(sl->data, sl->size, &avc, 0, NULL);
					if (idx>=0) {
						Bool is_interlaced = avc.sps[idx].frame_mbs_only_flag ? GF_FALSE : GF_TRUE;
						if (ds->interlaced != is_interlaced) period_switch = GF_TRUE;
						ds->interlaced = is_interlaced;
				gf_odf_avc_cfg_del(avccfg);

Fixed code:
				if (avccfg) {
					GF_NALUFFParam *sl = (GF_NALUFFParam *)gf_list_get(avccfg->sequenceParameterSets, 0);
					if (sl) {
						s32 idx;
						memset(&avc, 0, sizeof(AVCState));
						idx = gf_avc_read_sps(sl->data, sl->size, &avc, 0, NULL);
						if (idx>=0) {
							Bool is_interlaced = avc.sps[idx].frame_mbs_only_flag ? GF_FALSE : GF_TRUE;
							if (ds->interlaced != is_interlaced) period_switch = GF_TRUE;
							ds->interlaced = is_interlaced;
						}
					gf_odf_avc_cfg_del(avccfg);
CVE-2023-3291 (C, published 2023-06-16T02:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.2.
Severity: nan (CVSS v3 base score: 3.3)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/gpac/gpac
Files changed:
src/filters/reframe_mp3.c
Commit message: fixed #2493


Vulnerable code:
		if (buf_alloc<=fsize) {

Fixed code:
		if (buf_alloc <= fsize+2) {
CVE-2023-3523 (C, published 2023-07-06T10:15Z)
Description: value: Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.
Severity: nan (CVSS v3 base score: 7.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gpac/gpac
Files changed:
src/media_tools/vobsub.c
Commit message: fixed #2520


Vulnerable code:
	char  strbuf[256];
	for (line = 0; !error && gf_fgets(strbuf, sizeof(strbuf), file); line++)

Fixed code:
	char  strbuf[257];
	for (line = 0; !error && gf_fgets(strbuf, 256, file); line++)
		//make sure we are null-terminated - cf #2520
		strbuf[256]=0;
CVE-2023-46001 (C, published 2023-11-07T22:15Z)
Description: value: Buffer Overflow vulnerability in gpac MP4Box v.2.3-DEV-rev573-g201320819-master allows a local attacker to cause a denial of service via the gpac/src/isomedia/isom_read.c:2807:51 function in gf_isom_get_user_data.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/isom_read.c
Commit message: gf_isom_get_user_data: handle null uuid (fixes #2629)


Vulnerable code:
		if ((map->boxType == GF_ISOM_BOX_TYPE_UUID) && !memcmp(map->uuid, UUID, 16)) goto found;

Fixed code:
		if ((map->boxType == GF_ISOM_BOX_TYPE_UUID) && UUID && !memcmp(map->uuid, UUID, 16)) goto found;
CVE-2023-4678 (C, published 2023-08-31T16:15Z)
Description: value: Divide By Zero in GitHub repository gpac/gpac prior to 2.3-DEV.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/gpac/gpac
Files changed:
src/filters/dasher.c
src/filters/dmx_avi.c
src/filters/reframe_mhas.c
src/scene_manager/swf_parse.c
Commit message: fixed #2576


Vulnerable code:
			mhas_dmx_check_pid(filter, ctx, pl, sr, frame_len, CICPspeakerLayoutIdx, numSpeakers, start + pay_start, (u32) mhas_size);

			has_cfg = GF_TRUE;


	gf_list_add(read->fonts, ft);

Fixed code:
		if (!ds->timescale) {
			GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[Dasher] Input PID %s has no timescale, cannot dash\n", gf_filter_pid_get_name(pid) ));
			return GF_NON_COMPLIANT_BITSTREAM;
		}

		if (!ctx->fps.num) ctx->fps.num = ctx->fps.den = 1000;
			if (sr) {
				mhas_dmx_check_pid(filter, ctx, pl, sr, frame_len, CICPspeakerLayoutIdx, numSpeakers, start + pay_start, (u32) mhas_size);
				has_cfg = GF_TRUE;
			}
	gf_list_add(read->fonts, ft);
	if (!read->frame_rate) read->frame_rate = 1;
CVE-2023-4681 (C, published 2023-08-31T16:15Z)
Description: value: NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3-DEV.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/filters/dasher.c
src/media_tools/avilib.c
src/media_tools/mpeg2_ps.c
Commit message: fixed #2575


Vulnerable code:
				if( avi_read(AVI->fdes,(char *)hdrl_data, (u32) n) != n ) ERR_EXIT(AVI_ERR_READ)
			if(AVI->idx==0) ERR_EXIT(AVI_ERR_NO_MEM)
				if(avi_read(AVI->fdes, (char *) AVI->idx, (u32) n) != n ) {
					gf_free( AVI->idx);
					AVI->idx=NULL;
					AVI->n_idx = 0;
				}
	if(!hdrl_data      ) ERR_EXIT(AVI_ERR_NO_HDRL)
		if(!AVI->movi_start) ERR_EXIT(AVI_ERR_NO_MOVI)
			if (sptr->first_pes_has_dts == 0) {

Fixed code:
			if (ctx->force_period_switch) {
				break;
			}

		if (ctx->force_period_switch)
			count = gf_list_count(ctx->current_period->streams);
				if( avi_read(AVI->fdes,(char *)hdrl_data, (u32) n) != n ) {
					if (hdrl_data) gf_free(hdrl_data);
					ERR_EXIT(AVI_ERR_READ)
			}
			if(AVI->idx==0) {
				if (hdrl_data) gf_free(hdrl_data);
				ERR_EXIT(AVI_ERR_NO_MEM)
			}
			if(avi_read(AVI->fdes, (char *) AVI->idx, (u32) n) != n ) {
				gf_free( AVI->idx);
				AVI->idx=NULL;
				AVI->n_idx = 0;
				if (hdrl_data) gf_free(hdrl_data);
				ERR_EXIT(AVI_ERR_READ)
			}
	if(!hdrl_data) ERR_EXIT(AVI_ERR_NO_HDRL)
	if(!AVI->movi_start) ERR_EXIT(AVI_ERR_NO_MOVI)
			return;
			if ((sptr->first_pes_has_dts == 0) && sptr->m_fd) {