hitoshura25/cvefixes huggingface dataset:
CVE-2021-32132 (C, published 2021-09-13T15:15Z)
Description: value: The abst_box_size function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
include/gpac/internal/isomedia_dev.h
src/isomedia/box_code_adobe.c
Commit message: fixed #1753


Vulnerable code:
	GF_Err e;
		ISOM_DECREASE_SIZE(ptr, 1)
	if (!zfound)
		return GF_ISOM_INVALID_FILE;
	ISOM_DECREASE_SIZE(ptr, 1)
			ISOM_DECREASE_SIZE(ptr, 1)
		if (!zfound)
			return GF_ISOM_INVALID_FILE;
	ISOM_DECREASE_SIZE(ptr, 1)
			ISOM_DECREASE_SIZE(ptr, 1)
		if (!zfound)
			return GF_ISOM_INVALID_FILE;
		ISOM_DECREASE_SIZE(ptr, 1)
	if (!zfound)
		return GF_ISOM_INVALID_FILE;
		ISOM_DECREASE_SIZE(ptr, 1)
	if (!zfound)
		return GF_ISOM_INVALID_FILE;
	ISOM_DECREASE_SIZE(ptr, 1)
			gf_free(tmp_str);
			return e;
	ISOM_DECREASE_SIZE(ptr, 1)
			gf_free(tmp_str);
			return e;

	return GF_OK;

Fixed code:
#define ISOM_DECREASE_SIZE_GOTO_EXIT(__ptr, bytes)	if (__ptr->size < (bytes) ) {\
			GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[isom] not enough bytes in box %s: %d left, reading %d (file %s, line %d)\n", gf_4cc_to_str(__ptr->type), (u32) __ptr->size, (bytes), __FILE__, __LINE__ )); \
			e = GF_ISOM_INVALID_FILE; \
			goto exit;\
		}\
		__ptr->size -= bytes; \

	GF_Err e = GF_OK;
		ISOM_DECREASE_SIZE_GOTO_EXIT(ptr, 1)
	if (!zfound) {
		e = GF_ISOM_INVALID_FILE;
		goto exit;
	}
	ISOM_DECREASE_SIZE_GOTO_EXIT(ptr, 1)
			ISOM_DECREASE_SIZE_GOTO_EXIT(ptr, 1)
		if (!zfound) {
			e = GF_ISOM_INVALID_FILE;
			goto exit;
		}
	if (ptr->server_entry_count != gf_list_count(ptr->server_entry_table)) {
		e = GF_ISOM_INVALID_FILE;
		goto exit;
	}
	ISOM_DECREASE_SIZE_GOTO_EXIT(ptr, 1)
			ISOM_DECREASE_SIZE_GOTO_EXIT(ptr, 1)
		if (!zfound) {
			e = GF_ISOM_INVALID_FILE;
			goto exit;
		}
	if (ptr->quality_entry_count != gf_list_count(ptr->quality_entry_table)) {
		e = GF_ISOM_INVALID_FILE;
		goto exit;
	}
		ISOM_DECREASE_SIZE_GOTO_EXIT(ptr, 1)
	if (!zfound) {
		e = GF_ISOM_INVALID_FILE;
		goto exit;
	}

		ISOM_DECREASE_SIZE_GOTO_EXIT(ptr, 1)
	if (!zfound) {
		e = GF_ISOM_INVALID_FILE;
		goto exit;
	}

	ISOM_DECREASE_SIZE_GOTO_EXIT(ptr, 1)
			goto exit;
	if (ptr->segment_run_table_count != gf_list_count(ptr->segment_run_table_entries)) {
		e = GF_ISOM_INVALID_FILE;
		goto exit;
	}
	ISOM_DECREASE_SIZE_GOTO_EXIT(ptr, 1)
			goto exit;
	if (ptr->fragment_run_table_count != gf_list_count(ptr->fragment_run_table_entries)) {
		e = GF_ISOM_INVALID_FILE;
		goto exit;
	}
exit:
	return e;
CVE-2021-32134 (C, published 2021-09-13T14:15Z)
Description: value: The gf_odf_desc_copy function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/box_code_base.c
src/isomedia/media.c
src/isomedia/sample_descs.c
Commit message: fixed #1756


Vulnerable code:
	tmp->internal_type = GF_ISOM_SAMPLE_ENTRY_MP4S;
	tmp->internal_type = GF_ISOM_SAMPLE_ENTRY_MP4S;
	case GF_ISOM_SUBTYPE_OPUS: {

Fixed code:

		if (entry->internal_type != GF_ISOM_SAMPLE_ENTRY_VIDEO)
			return GF_ISOM_INVALID_MEDIA;
		if (entry->internal_type != GF_ISOM_SAMPLE_ENTRY_VIDEO)
			return GF_ISOM_INVALID_MEDIA;
		if (entry->internal_type != GF_ISOM_SAMPLE_ENTRY_VIDEO)
			return GF_ISOM_INVALID_MEDIA;
		if (entry->internal_type != GF_ISOM_SAMPLE_ENTRY_VIDEO)
			return GF_ISOM_INVALID_MEDIA;
		if (entry->internal_type != GF_ISOM_SAMPLE_ENTRY_VIDEO)
			return GF_ISOM_INVALID_MEDIA;
		if (entry->internal_type != GF_ISOM_SAMPLE_ENTRY_VIDEO)
			return GF_ISOM_INVALID_MEDIA;
		if (entry->internal_type != GF_ISOM_SAMPLE_ENTRY_AUDIO)
			return GF_ISOM_INVALID_MEDIA;
		if (entry->internal_type != GF_ISOM_SAMPLE_ENTRY_MP4S)
			return GF_ISOM_INVALID_MEDIA;

		if (entry->internal_type != GF_ISOM_SAMPLE_ENTRY_MP4S)
			return GF_ISOM_INVALID_MEDIA;
		if (entry->internal_type != GF_ISOM_SAMPLE_ENTRY_AUDIO)
			return GF_ISOM_INVALID_MEDIA;
	case GF_ISOM_SUBTYPE_OPUS:
		if (entry->internal_type != GF_ISOM_SAMPLE_ENTRY_AUDIO)
			return GF_ISOM_INVALID_MEDIA;
	{
		if (entry->internal_type != GF_ISOM_SAMPLE_ENTRY_VIDEO)
			return GF_ISOM_INVALID_MEDIA;
		if (entry->internal_type != GF_ISOM_SAMPLE_ENTRY_AUDIO)
			return GF_ISOM_INVALID_MEDIA;
		if (entry->internal_type != GF_ISOM_SAMPLE_ENTRY_MP4S)
			return GF_ISOM_INVALID_MEDIA;
		if (entry->internal_type != GF_ISOM_SAMPLE_ENTRY_AUDIO)
			return GF_ISOM_INVALID_MEDIA;

	ent->internal_type = GF_ISOM_SAMPLE_ENTRY_MP4S;
CVE-2021-32135 (C, published 2021-09-13T15:15Z)
Description: value: The trak_box_size function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/box_code_base.c
Commit message: fixed #1757


Vulnerable code:

Fixed code:
		if (!ptr->moov || !!ptr->moov->mov || !ptr->moov->mov->movieFileMap)
			return GF_ISOM_INVALID_FILE;
CVE-2021-32136 (C, published 2021-09-13T13:15Z)
Description: value: Heap buffer overflow in the print_udta function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gpac/gpac
Files changed:
applications/mp4box/filedump.c
Commit message: fixed #1765


Vulnerable code:
			if (gf_utf8_is_legal(udta, udta_size)) {
				fprintf(stderr, "\t%s\n", (char *) udta);

Fixed code:
			if (udta_size && gf_utf8_is_legal(udta, udta_size)) {
				u32 idx;
				fprintf(stderr, "\t");
				for (idx=0; idx<udta_size; idx++) {
					if (!udta[idx]) break;
					fprintf(stderr, "%c", udta[idx]);
				}
				fprintf(stderr, "\n");
CVE-2021-32137 (C, published 2021-09-13T14:15Z)
Description: value: Heap buffer overflow in the URL_GetProtocolType function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/media.c
Commit message: fixed #1766 (fuzz)


Vulnerable code:

	//we don't know what's a URN yet
	if (entry->type == GF_ISOM_BOX_TYPE_URN) return GF_NOT_SUPPORTED;

Fixed code:
	//we only support alias and URL boxes
	if ((entry->type != GF_ISOM_BOX_TYPE_URL) && (entry->type != GF_QT_BOX_TYPE_ALIS) )
		return GF_NOT_SUPPORTED;
CVE-2021-32138 (C, published 2021-09-13T20:15Z)
Description: value: The DumpTrackInfo function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
applications/mp4box/filedump.c
Commit message: fixed #1767 (fuzz)


Vulnerable code:
		fprintf(stderr, "\tversion=%u, profile=%u, level_idx0=%u, tier=%u\n", (u32)av1c->version, (u32)av1c->seq_profile, (u32)av1c->seq_level_idx_0, (u32)av1c->seq_tier_0);
		fprintf(stderr, "\thigh_bitdepth=%u, twelve_bit=%u, monochrome=%u\n", (u32)av1c->high_bitdepth, (u32)av1c->twelve_bit, (u32)av1c->monochrome);
		fprintf(stderr, "\tchroma: subsampling_x=%u, subsampling_y=%u, sample_position=%u\n", (u32)av1c->chroma_subsampling_x, (u32)av1c->chroma_subsampling_y, (u32)av1c->chroma_sample_position);
		if (av1c->initial_presentation_delay_present)
			fprintf(stderr, "\tInitial presentation delay %u\n", (u32) av1c->initial_presentation_delay_minus_one+1);
		count = gf_list_count(av1c->obu_array);
		for (i=0; i<count; i++) {
			u8 hash[20];
			GF_AV1_OBUArrayEntry *obu = gf_list_get(av1c->obu_array, i);
			gf_sha1_csum((u8*)obu->obu, (u32)obu->obu_length, hash);
			fprintf(stderr, "\tOBU#%d %s hash: ", i+1, gf_av1_get_obu_name(obu->obu_type) );
			for (j=0; j<20; j++) fprintf(stderr, "%02X", hash[j]);
			fprintf(stderr, "\n");
		gf_odf_av1_cfg_del(av1c);

Fixed code:
		if (!av1c) {
			fprintf(stderr, "\tCorrupted av1 config\n");
		} else {
			fprintf(stderr, "\tversion=%u, profile=%u, level_idx0=%u, tier=%u\n", (u32)av1c->version, (u32)av1c->seq_profile, (u32)av1c->seq_level_idx_0, (u32)av1c->seq_tier_0);
			fprintf(stderr, "\thigh_bitdepth=%u, twelve_bit=%u, monochrome=%u\n", (u32)av1c->high_bitdepth, (u32)av1c->twelve_bit, (u32)av1c->monochrome);
			fprintf(stderr, "\tchroma: subsampling_x=%u, subsampling_y=%u, sample_position=%u\n", (u32)av1c->chroma_subsampling_x, (u32)av1c->chroma_subsampling_y, (u32)av1c->chroma_sample_position);
			if (av1c->initial_presentation_delay_present)
				fprintf(stderr, "\tInitial presentation delay %u\n", (u32) av1c->initial_presentation_delay_minus_one+1);
			count = gf_list_count(av1c->obu_array);
			for (i=0; i<count; i++) {
				u8 hash[20];
				GF_AV1_OBUArrayEntry *obu = gf_list_get(av1c->obu_array, i);
				gf_sha1_csum((u8*)obu->obu, (u32)obu->obu_length, hash);
				fprintf(stderr, "\tOBU#%d %s hash: ", i+1, gf_av1_get_obu_name(obu->obu_type) );
				for (j=0; j<20; j++) fprintf(stderr, "%02X", hash[j]);
				fprintf(stderr, "\n");
			}
			gf_odf_av1_cfg_del(av1c);
CVE-2021-32268 (C, published 2021-09-20T16:15Z)
Description: value: Buffer overflow vulnerability in function gf_fprintf in os_file.c in gpac before 1.0.1 allows attackers to execute arbitrary code. The fixed version is 1.0.1.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/box_code_base.c
Commit message: fixed #1587


Vulnerable code:

Fixed code:
		if (ptr->location[ptr->size-1]) {
			GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[iso file] url box location is not 0-terminated\n" ));
			return GF_ISOM_INVALID_FILE;
		}
CVE-2021-32437 (C, published 2021-08-11T20:15Z)
Description: value: The gf_hinter_finalize function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/media_tools/isom_hinter.c
Commit message: fixed #1770 (fuzz)


Vulnerable code:
			if (gf_hinter_can_embbed_data(samp->data, samp->dataLength, GF_STREAM_SCENE)) {

Fixed code:
			if (samp && gf_hinter_can_embbed_data(samp->data, samp->dataLength, GF_STREAM_SCENE)) {
CVE-2021-32438 (C, published 2021-08-11T20:15Z)
Description: value: The gf_media_export_filters function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/media_tools/media_export.c
Commit message: fixed #1769 (fuzz)


Vulnerable code:
		if (esd) {

Fixed code:
		if (esd && esd->decoderConfig) {
CVE-2021-32440 (C, published 2021-08-11T20:15Z)
Description: value: The Media_RewriteODFrame function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/media_odf.c
Commit message: fixed #1772 (fuzz)


Vulnerable code:
					if (!mpod->trackIDs || gf_isom_get_track_from_id(mdia->mediaTrack->moov, mpod->trackIDs[ref->trackRef - 1]) == NULL) continue;

Fixed code:
					if (!mpod->trackIDs || !ref->trackRef || (ref->trackRef>mpod->trackIDCount)) continue;
					if (gf_isom_get_track_from_id(mdia->mediaTrack->moov, mpod->trackIDs[ref->trackRef - 1]) == NULL) continue;
				if (!mpod->trackIDs || !ref->trackRef || (ref->trackRef>mpod->trackIDCount)) continue;
				if (!mpod->trackIDs || !esdR->ES_ID[i] || (esdR->ES_ID[i]>mpod->trackIDCount)) continue;
CVE-2021-33361 (C, published 2021-09-13T20:15Z)
Description: value: Memory leak in the afra_box_read function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/gpac/gpac
Files changed:
applications/mp4box/main.c
src/isomedia/box_code_adobe.c
Commit message: fixed #1782 (fuzz)


Vulnerable code:

		gf_list_insert(ptr->local_access_entries, ae, i);

			gf_list_insert(ptr->global_access_entries, ae, i);

Fixed code:

#ifdef GPAC_MEMORY_TRACKING
	if (mem_track && (gf_memory_size() || gf_file_handles_count() )) {
		gf_log_set_tool_level(GF_LOG_MEMORY, GF_LOG_INFO);
		gf_memory_print();
	}
#endif

		gf_list_insert(ptr->local_access_entries, ae, i);
			gf_list_insert(ptr->global_access_entries, ae, i);
CVE-2021-33362 (C, published 2021-09-13T19:15Z)
Description: value: Stack buffer overflow in the hevc_parse_vps_extension function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gpac/gpac
Files changed:
src/media_tools/av_parsers.c
Commit message: fixed #1780 (fuzz)


Vulnerable code:

Fixed code:
	if (vps->num_output_layer_sets > MAX_LHVC_LAYERS) {
		GF_LOG(GF_LOG_ERROR, GF_LOG_CODING, ("[HEVC] Wrong number of output layer sets in VPS %d, max %d supported\n", vps->num_output_layer_sets, MAX_LHVC_LAYERS));
		vps->num_output_layer_sets = 1;
		return GF_FALSE;
	}
CVE-2021-33363 (C, published 2021-09-13T20:15Z)
Description: value: Memory leak in the infe_box_read function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/box_code_meta.c
Commit message: fixed #1786 (fuzz)


Vulnerable code:
			} else {

Fixed code:
			} else if (!ptr->content_encoding) {
			} else {
				//we could throw an error but we silently accept this infe
				break;
CVE-2021-33364 (C, published 2021-09-13T19:15Z)
Description: value: Memory leak in the def_parent_box_new function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/isom_intern.c
Commit message: fixed #1783 (fuzz)


Vulnerable code:

Fixed code:
				gf_isom_box_del(a);
CVE-2021-33365 (C, published 2021-09-13T20:15Z)
Description: value: Memory leak in the gf_isom_get_root_od function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/isom_read.c
Commit message: fixed #1784 (fuzz)


Vulnerable code:
	if (movie->LastError) return NULL;

Fixed code:
	if (movie->LastError) {
		if (od) {
			gf_list_del(od->ESDescriptors);
			gf_free(od);
		}
		if (iod) {
			gf_list_del(iod->ESDescriptors);
			gf_free(iod);
		}
		return NULL;
	}
CVE-2021-33366 (C, published 2021-09-13T19:15Z)
Description: value: Memory leak in the gf_isom_oinf_read_entry function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/avc_ext.c
Commit message: fixed #1785 (fuzz)


Vulnerable code:
		if (op->layer_count > GF_ARRAY_LENGTH(op->layers_info))

Fixed code:
		if (op->layer_count > GF_ARRAY_LENGTH(op->layers_info)) {
			gf_free(op);
		}
CVE-2021-4043 (C, published 2022-02-04T23:15Z)
Description: value: NULL Pointer Dereference in GitHub repository gpac/gpac prior to 1.1.0.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/box_code_base.c
Commit message: fixed #2092


Vulnerable code:
	for (i=0; i<ptr->nb_entries; i++) {
		if (ptr->entries[i].name) gf_free(ptr->entries[i].name);
	if (ptr->entries) gf_free(ptr->entries);

Fixed code:
	if (ptr->entries) {
		for (i=0; i<ptr->nb_entries; i++) {
			if (ptr->entries[i].name) gf_free(ptr->entries[i].name);
		}
		gf_free(ptr->entries);
CVE-2021-40562 (C, published 2022-01-12T22:15Z)
Description: value: A Segmentation fault caused by a floating point exception exists in Gpac through 1.0.1 using mp4box via the naludmx_enqueue_or_dispatch function in reframe_nalu.c, which causes a denial of service.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-697 \u2014 Incorrect Comparison
The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
Repository: https://github.com/gpac/gpac
Files changed:
src/filters/reframe_nalu.c
Commit message: fixed #1901


Vulnerable code:
				if (!ctx->timescale) {
					ctx->cur_fps.den =  2 * sps->vui.num_units_in_tick * DeltaTfiDivisorIdx;

Fixed code:
				if (!ctx->timescale && sps->vui.time_scale && sps->vui.num_units_in_tick) {
					ctx->cur_fps.den = 2 * sps->vui.num_units_in_tick * DeltaTfiDivisorIdx;
CVE-2021-40563 (C, published 2022-01-12T22:15Z)
Description: value: A Segmentation fault exists casued by null pointer dereference exists in Gpac through 1.0.1 via the naludmx_create_avc_decoder_config function in reframe_nalu.c when using mp4box, which causes a denial of service.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/filters/reframe_nalu.c
Commit message: fixed #1892


Vulnerable code:
	u32 i, count;
	u32 crc = gf_crc_32(data, size);

Fixed code:
	u32 i, count, crc;

	if (!size) return;
	crc = gf_crc_32(data, size);
CVE-2021-40564 (C, published 2022-01-12T22:15Z)
Description: value: A Segmentation fault caused by null pointer dereference vulnerability eists in Gpac through 1.0.2 via the avc_parse_slice function in av_parsers.c when using mp4box, which causes a denial of service.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/media_tools/av_parsers.c
Commit message: fixed #1898


Vulnerable code:
		val += (1 << nb_lead) - 1;
	if (pps_id > 255) return -1;

Fixed code:
		u32 leads=1;
		leads <<= nb_lead;
		leads -= 1;
		val += leads;
//		val += (1 << nb_lead) - 1;
	if ((pps_id<0) || (pps_id > 255)) return -1;
CVE-2021-40565 (C, published 2022-01-12T22:15Z)
Description: value: A Segmentation fault caused by a null pointer dereference vulnerability exists in Gpac through 1.0.1 via the gf_avc_parse_nalu function in av_parsers.c when using mp4box, which causes a denial of service.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/media_tools/av_parsers.c
Commit message: fixed #1902


Vulnerable code:
		assert(avc->s_info.sps);

Fixed code:
		if (!avc->s_info.sps)
			return -1;