hitoshura25/cvefixes huggingface dataset:
CVE-2020-20277 (C, published 2020-12-18T19:15Z)
Description: value: There are multiple unauthenticated directory traversal vulnerabilities in different FTP commands in uftpd FTP server versions 2.7 to 2.10 due to improper implementation of a chroot jail in common.c's compose_abspath function that can be abused to read or write to arbitrary files on the filesystem, leak process memory, or potentially lead to remote code execution.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/troglobit/uftpd
Files changed:
src/common.c
Commit message: FTP/TFTP: Fix directory traversal regression, reported by Aaron Esau

Signed-off-by: Joachim Nilsson <troglobit@gmail.com>


Vulnerable code:
	if (!chrooted && strncmp(dir, home, strlen(home))) {

Fixed code:
	if (!chrooted && strncmp(rpath, home, strlen(home))) {
CVE-2020-5204 (C, published 2020-01-06T20:15Z)
Description: value: In uftpd before 2.11, there is a buffer overflow vulnerability in handle_PORT in ftpcmd.c that is caused by a buffer that is 16 bytes large being filled via sprintf() with user input based on the format specifier string %d.%d.%d.%d. The 16 byte size is correct for valid IPv4 addresses (len(&#39;255.255.255.255&#39;) == 16), but the format specifier %d allows more than 3 digits. This has been fixed in version 2.11
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/troglobit/uftpd
Files changed:
src/ftpcmd.c
Commit message: FTP: Fix buffer overflow in PORT parser, reported by Aaron Esau

Signed-off-by: Joachim Nilsson <troglobit@gmail.com>


Vulnerable code:
	sprintf(addr, "%d.%d.%d.%d", a, b, c, d);

Fixed code:
	snprintf(addr, sizeof(addr), "%d.%d.%d.%d", a, b, c, d);
CVE-2020-5221 (C, published 2020-01-22T19:15Z)
Description: value: In uftpd before 2.11, it is possible for an unauthenticated user to perform a directory traversal attack using multiple different FTP commands and read and write to arbitrary locations on the filesystem due to the lack of a well-written chroot jail in compose_abspath(). This has been fixed in version 2.11
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/troglobit/uftpd
Files changed:
src/common.c
Commit message: FTP/TFTP: Fix directory traversal regression, reported by Aaron Esau

Signed-off-by: Joachim Nilsson <troglobit@gmail.com>


Vulnerable code:
	if (!chrooted && strncmp(dir, home, strlen(home))) {

Fixed code:
	if (!chrooted && strncmp(rpath, home, strlen(home))) {
CVE-2018-13006 (C, published 2018-06-29T14:29Z)
Description: value: An issue was discovered in MP4Box in GPAC 0.7.1. There is a heap-based buffer over-read in the isomedia/box_dump.c function hdlr_dump.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gpac/gpac
Files changed:
include/gpac/internal/isomedia_dev.h
src/isomedia/box_code_base.c
src/isomedia/box_dump.c
Commit message: fixed 2 possible heap overflows (inc. #1088)


Vulnerable code:
		gf_isom_box_del(a);\
	while ( (tmpName[i] != 0) && (i < to_read) ) {
	if (p->nameUTF8 && (u32) p->nameUTF8[0] == strlen(p->nameUTF8+1)) {
		if (op->frame_rate_info_flag) 
		if (op->bit_rate_info_flag) 
	
	
			
	if (ptr->version) 

Fixed code:
		gf_isom_box_del(__abox);\
	while ( (i < to_read) && (tmpName[i] != 0) ) {
	if (p->nameUTF8 && (u32) p->nameUTF8[0] == strlen(p->nameUTF8)-1) {
		if (op->frame_rate_info_flag)
		if (op->bit_rate_info_flag)



	if (ptr->version)
CVE-2018-20760 (C, published 2019-02-06T23:29Z)
Description: value: In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because a certain -1 return value is mishandled.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gpac/gpac
Files changed:
src/media_tools/text_import.c
Commit message: check error code on call to gf_utf8_wcstombs (#1177)


Vulnerable code:

Fixed code:
	if (i >= (u32)ARRAY_LENGTH(szLineConv))
		return NULL;
CVE-2018-20763 (C, published 2019-02-06T23:29Z)
Description: value: In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because of missing szLineConv bounds checking.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gpac/gpac
Files changed:
applications/mp4client/main.c
src/media_tools/text_import.c
Commit message: add some boundary checks on gf_text_get_utf8_line (#1188)


Vulnerable code:
						the_url[sizeof(the_cfg) - 1] = 0;
		for (i=0; i<len; i++) {
					szLineConv[j] = 0xc0 | ( (szLine[i] >> 6) & 0x3 );
					j++;
					szLine[i] &= 0xbf;
					szLineConv[j] = szLine[i];
					i++;
					j++;
					szLineConv[j] = szLine[i];
					i++;
					j++;
					szLineConv[j] = szLine[i];
					i++;
					j++;
					szLineConv[j] = szLine[i];
					i++;
					j++;
					szLineConv[j] = szLine[i];
					i++;
					j++;
					szLineConv[j] = szLine[i];
					i++;
					j++;
			szLineConv[j] = szLine[i];
			j++;
		szLineConv[j] = 0;

Fixed code:
						the_url[sizeof(the_url) - 1] = 0;
		for (i=0; i<len && j < sizeof(szLineConv) - 1; i++, j++) {

					if (j + 1 < sizeof(szLineConv) - 1) {
						szLineConv[j] = 0xc0 | ((szLine[i] >> 6) & 0x3);
						j++;
						szLine[i] &= 0xbf;
					}
					else
						break;

					// don't cut multibyte in the middle in there is no more room in dest
					if (j + 1 < sizeof(szLineConv) - 1 && i + 1 < len) {
						szLineConv[j] = szLine[i];
						i++;
						j++;
					}
					else {
						break;
					}
					if (j + 2 < sizeof(szLineConv) - 1 && i + 2 < len) {
						szLineConv[j] = szLine[i];
						i++;
						j++;
						szLineConv[j] = szLine[i];
						i++;
						j++;
					}
					else {
						break;
					}
					if (j + 3 < sizeof(szLineConv) - 1 && i + 3 < len) {
						szLineConv[j] = szLine[i];
						i++;
						j++;
						szLineConv[j] = szLine[i];
						i++;
						j++;
						szLineConv[j] = szLine[i];
						i++;
						j++;
					}
					else {
						break;
					}
			if (j < sizeof(szLineConv)-1 && i<len)
				szLineConv[j] = szLine[i];

		if (j >= sizeof(szLineConv))
			szLineConv[sizeof(szLineConv) - 1] = 0;
		else
			szLineConv[j] = 0;
CVE-2018-21017 (C, published 2019-09-16T13:15Z)
Description: value: GPAC 0.7.1 has a memory leak in dinf_Read in isomedia/box_code_base.c.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/box_code_base.c
Commit message: prevent dref memleak on invalid input (#1183)


Vulnerable code:
		((GF_DataInformationBox *)s)->dref = (GF_DataReferenceBox *)gf_isom_box_new(GF_ISOM_BOX_TYPE_DREF);

Fixed code:
		GF_Box* dref;
		dref = gf_isom_box_new(GF_ISOM_BOX_TYPE_DREF);
		((GF_DataInformationBox *)s)->dref = (GF_DataReferenceBox *)dref;
		gf_isom_box_add_for_dump_mode(s, dref);
CVE-2018-7752 (C, published 2018-03-07T23:29Z)
Description: value: GPAC through 0.7.1 has a Buffer Overflow in the gf_media_avc_read_sps function in media_tools/av_parsers.c, a different vulnerability than CVE-2018-1000100.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/gpac/gpac
Files changed:
include/gpac/tools.h
src/isomedia/avc_ext.c
src/media_tools/av_parsers.c
Commit message: fix some exploitable overflows (#994, #997)


Vulnerable code:

Fixed code:
#define ARRAY_LENGTH(a) (sizeof(a) / sizeof((a)[0]))
		if (op->layer_count > ARRAY_LENGTH(op->layers_info))
			return GF_NON_COMPLIANT_BITSTREAM;
		if (sps->poc_cycle_length > ARRAY_LENGTH(sps->offset_for_ref_frame)) {
			GF_LOG(GF_LOG_ERROR, GF_LOG_CODING, ("[avc-h264] offset_for_ref_frame overflow from poc_cycle_length\n"));
			goto exit;
		}
CVE-2019-11222 (C, published 2019-04-15T12:31Z)
Description: value: gf_bin128_parse in utils/os_divers.c in GPAC 0.7.1 has a buffer overflow issue for the crypt feature when encountering a crafted_drm_file.xml file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gpac/gpac
Files changed:
src/utils/os_divers.c
Commit message: fix buffer overrun in gf_bin128_parse

closes #1204
closes #1205


Vulnerable code:

Fixed code:
			if (i > 15) {
				// force error check below
				i++;
				break;
			}
CVE-2019-20628 (C, published 2020-03-24T19:15Z)
Description: value: An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box. It contains a Use-After-Free vulnerability in gf_m2ts_process_pmt in media_tools/mpegts.c that can cause a denial of service via a crafted MP4 file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/gpac/gpac
Files changed:
src/media_tools/mpegts.c
Commit message: be stricter in PAT processing - cf #1269


Vulnerable code:
		} else {

Fixed code:
		} else if (!pid) {
			GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("Broken PAT found reserved PID 0, ignoring\n", pid));
		} else if (! ts->ess[pid]) {
CVE-2019-20628 (C, published 2020-03-24T19:15Z)
Description: value: An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box. It contains a Use-After-Free vulnerability in gf_m2ts_process_pmt in media_tools/mpegts.c that can cause a denial of service via a crafted MP4 file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/gpac/gpac
Files changed:
src/media_tools/mpegts.c
Commit message: fixed potential crash on PMT IOD parse - cf #1268 #1269


Vulnerable code:
	if (info_length != 0) {
				u32 size;
				GF_BitStream *iod_bs;
				iod_bs = gf_bs_new((char *)data+8, len-2, GF_BITSTREAM_READ);
				if (pmt->program->pmt_iod) gf_odf_desc_del((GF_Descriptor *)pmt->program->pmt_iod);
				e = gf_odf_parse_descriptor(iod_bs , (GF_Descriptor **) &pmt->program->pmt_iod, &size);
				gf_bs_del(iod_bs );
				if (e==GF_OK) {
					/*remember program number for service/program selection*/
					if (pmt->program->pmt_iod) pmt->program->pmt_iod->ServiceID = pmt->program->number;
					/*if empty IOD (freebox case), discard it and use dynamic declaration of object*/
					if (!gf_list_count(pmt->program->pmt_iod->ESDescriptors)) {
						gf_odf_desc_del((GF_Descriptor *)pmt->program->pmt_iod);
						pmt->program->pmt_iod = NULL;

Fixed code:
	if (info_length + 4 > data_size) {
		GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("Broken PMT first loop, %d bytes avail but first loop size %d\n", data_size, info_length));
		return;
	} else if (info_length != 0) {
				if ((len>2) && (len - 2 <= info_length)) {
					u32 size;
					GF_BitStream *iod_bs;
					iod_bs = gf_bs_new((char *)data+8, len-2, GF_BITSTREAM_READ);
					if (pmt->program->pmt_iod) gf_odf_desc_del((GF_Descriptor *)pmt->program->pmt_iod);
					e = gf_odf_parse_descriptor(iod_bs , (GF_Descriptor **) &pmt->program->pmt_iod, &size);
					gf_bs_del(iod_bs );
					if (e==GF_OK) {
						/*remember program number for service/program selection*/
						if (pmt->program->pmt_iod) pmt->program->pmt_iod->ServiceID = pmt->program->number;
						/*if empty IOD (freebox case), discard it and use dynamic declaration of object*/
						if (!gf_list_count(pmt->program->pmt_iod->ESDescriptors)) {
							gf_odf_desc_del((GF_Descriptor *)pmt->program->pmt_iod);
							pmt->program->pmt_iod = NULL;
						}
				} else {
					GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("Broken IOD! len %d less than 2 bytes to declare IOD\n", len));
CVE-2019-20629 (C, published 2020-03-24T19:15Z)
Description: value: An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer over-read in gf_m2ts_process_pmt in media_tools/mpegts.c that can cause a denial of service via a crafted MP4 file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gpac/gpac
Files changed:
src/media_tools/mpegts.c
Commit message: fixed potential crash in TS - cf #1264


Vulnerable code:
		}
		if (es->stream_type == GF_M2TS_VIDEO_HEVC) nb_hevc++;
		else if (es->stream_type == GF_M2TS_VIDEO_HEVC_TEMPORAL) nb_hevc_temp++;
		else if (es->stream_type == GF_M2TS_VIDEO_SHVC) nb_shvc++;
		else if (es->stream_type == GF_M2TS_VIDEO_SHVC_TEMPORAL) nb_shvc_temp++;
		else if (es->stream_type == GF_M2TS_VIDEO_MHVC) nb_mhvc++;
		else if (es->stream_type == GF_M2TS_VIDEO_MHVC_TEMPORAL) nb_mhvc_temp++;

Fixed code:
			if (es->stream_type == GF_M2TS_VIDEO_HEVC) nb_hevc++;
			else if (es->stream_type == GF_M2TS_VIDEO_HEVC_TEMPORAL) nb_hevc_temp++;
			else if (es->stream_type == GF_M2TS_VIDEO_SHVC) nb_shvc++;
			else if (es->stream_type == GF_M2TS_VIDEO_SHVC_TEMPORAL) nb_shvc_temp++;
			else if (es->stream_type == GF_M2TS_VIDEO_MHVC) nb_mhvc++;
			else if (es->stream_type == GF_M2TS_VIDEO_MHVC_TEMPORAL) nb_mhvc_temp++;
		}
CVE-2019-20630 (C, published 2020-03-24T19:15Z)
Description: value: An issue was discovered in libgpac.a in GPAC before 0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer over-read in BS_ReadByte (called from gf_bs_read_bit) in utils/bitstream.c that can cause a denial of service via a crafted MP4 file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gpac/gpac
Files changed:
src/media_tools/mpegts.c
Commit message: fixed potential crash on PMT IOD parse - cf #1268 #1269


Vulnerable code:
	if (info_length != 0) {
				u32 size;
				GF_BitStream *iod_bs;
				iod_bs = gf_bs_new((char *)data+8, len-2, GF_BITSTREAM_READ);
				if (pmt->program->pmt_iod) gf_odf_desc_del((GF_Descriptor *)pmt->program->pmt_iod);
				e = gf_odf_parse_descriptor(iod_bs , (GF_Descriptor **) &pmt->program->pmt_iod, &size);
				gf_bs_del(iod_bs );
				if (e==GF_OK) {
					/*remember program number for service/program selection*/
					if (pmt->program->pmt_iod) pmt->program->pmt_iod->ServiceID = pmt->program->number;
					/*if empty IOD (freebox case), discard it and use dynamic declaration of object*/
					if (!gf_list_count(pmt->program->pmt_iod->ESDescriptors)) {
						gf_odf_desc_del((GF_Descriptor *)pmt->program->pmt_iod);
						pmt->program->pmt_iod = NULL;

Fixed code:
	if (info_length + 4 > data_size) {
		GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("Broken PMT first loop, %d bytes avail but first loop size %d\n", data_size, info_length));
		return;
	} else if (info_length != 0) {
				if ((len>2) && (len - 2 <= info_length)) {
					u32 size;
					GF_BitStream *iod_bs;
					iod_bs = gf_bs_new((char *)data+8, len-2, GF_BITSTREAM_READ);
					if (pmt->program->pmt_iod) gf_odf_desc_del((GF_Descriptor *)pmt->program->pmt_iod);
					e = gf_odf_parse_descriptor(iod_bs , (GF_Descriptor **) &pmt->program->pmt_iod, &size);
					gf_bs_del(iod_bs );
					if (e==GF_OK) {
						/*remember program number for service/program selection*/
						if (pmt->program->pmt_iod) pmt->program->pmt_iod->ServiceID = pmt->program->number;
						/*if empty IOD (freebox case), discard it and use dynamic declaration of object*/
						if (!gf_list_count(pmt->program->pmt_iod->ESDescriptors)) {
							gf_odf_desc_del((GF_Descriptor *)pmt->program->pmt_iod);
							pmt->program->pmt_iod = NULL;
						}
				} else {
					GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("Broken IOD! len %d less than 2 bytes to declare IOD\n", len));
CVE-2020-11558 (C, published 2020-04-05T20:15Z)
Description: value: An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box. audio_sample_entry_Read in isomedia/box_code_base.c does not properly decide when to make gf_isom_box_del calls. This leads to various use-after-free outcomes involving mdia_Read, gf_isom_delete_movie, and gf_isom_parse_movie_boxes.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/box_code_base.c
Commit message: fix UAF in audio_sample_entry_Read (#1440)


Vulnerable code:
				gf_isom_box_del((GF_Box *)ptr->esd);

Fixed code:
			extern Bool use_dump_mode;
				if (!use_dump_mode) gf_isom_box_del((GF_Box *)ptr->esd);
CVE-2020-19481 (C, published 2021-07-21T18:15Z)
Description: value: An issue was discovered in GPAC before 0.8.0, as demonstrated by MP4Box. It contains an invalid memory read in gf_m2ts_process_pmt in media_tools/mpegts.c that can cause a denial of service via a crafted MP4 file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gpac/gpac
Files changed:
src/media_tools/mpegts.c
Commit message: fixed potential crash in TS - cf #1264


Vulnerable code:
		}
		if (es->stream_type == GF_M2TS_VIDEO_HEVC) nb_hevc++;
		else if (es->stream_type == GF_M2TS_VIDEO_HEVC_TEMPORAL) nb_hevc_temp++;
		else if (es->stream_type == GF_M2TS_VIDEO_SHVC) nb_shvc++;
		else if (es->stream_type == GF_M2TS_VIDEO_SHVC_TEMPORAL) nb_shvc_temp++;
		else if (es->stream_type == GF_M2TS_VIDEO_MHVC) nb_mhvc++;
		else if (es->stream_type == GF_M2TS_VIDEO_MHVC_TEMPORAL) nb_mhvc_temp++;

Fixed code:
			if (es->stream_type == GF_M2TS_VIDEO_HEVC) nb_hevc++;
			else if (es->stream_type == GF_M2TS_VIDEO_HEVC_TEMPORAL) nb_hevc_temp++;
			else if (es->stream_type == GF_M2TS_VIDEO_SHVC) nb_shvc++;
			else if (es->stream_type == GF_M2TS_VIDEO_SHVC_TEMPORAL) nb_shvc_temp++;
			else if (es->stream_type == GF_M2TS_VIDEO_MHVC) nb_mhvc++;
			else if (es->stream_type == GF_M2TS_VIDEO_MHVC_TEMPORAL) nb_mhvc_temp++;
		}
CVE-2020-19488 (C, published 2021-07-21T18:15Z)
Description: value: An issue was discovered in box_code_apple.c:119 in Gpac MP4Box 0.8.0, allows attackers to cause a Denial of Service due to an invalid read on function ilst_item_Read.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/box_code_apple.c
Commit message: fixed potential crash - cf #1263


Vulnerable code:
		if (!e && ptr->size < a->size) {

Fixed code:
		if (!e && a && (ptr->size < a->size)) {
		if (!a) return GF_NON_COMPLIANT_BITSTREAM;
CVE-2020-23928 (C, published 2021-04-21T18:15Z)
Description: value: An issue was discovered in gpac before 1.0.1. The abst_box_read function in box_code_adobe.c has a heap-based buffer over-read.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/box_code_adobe.c
Commit message: fixed #1568


Vulnerable code:
	tmp_strsize =(u32)ptr->size-8;

Fixed code:
	tmp_strsize =(u32)ptr->size;
CVE-2020-23930 (C, published 2021-04-21T18:15Z)
Description: value: An issue was discovered in gpac through 20200801. A NULL pointer dereference exists in the function nhmldump_send_header located in write_nhml.c. It allows an attacker to cause Denial of Service.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
applications/mp4box/main.c
src/filters/write_nhml.c
Commit message: fixed #1565


Vulnerable code:
			fprintf(stderr, "File %s has no IOD", inName);
		sprintf(nhml, "bitsPerSample=\"%d\" ", gf_audio_fmt_bit_depth(p->value.uint));

Fixed code:
			fprintf(stderr, "File %s has no IOD\n", inName);
		if (p)
			sprintf(nhml, "bitsPerSample=\"%d\" ", gf_audio_fmt_bit_depth(p->value.uint));
CVE-2020-23931 (C, published 2021-04-21T18:15Z)
Description: value: An issue was discovered in gpac before 1.0.1. The abst_box_read function in box_code_adobe.c has a heap-based buffer over-read.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/box_code_adobe.c
Commit message: fixed #1564


Vulnerable code:
		tmp_strsize=(u32)ptr->size-8;
		tmp_strsize=(u32)ptr->size-8;
	tmp_strsize=(u32)ptr->size-8;
	tmp_strsize=(u32)ptr->size-8;

Fixed code:
		ISOM_DECREASE_SIZE(ptr, 1)
	ISOM_DECREASE_SIZE(ptr, 1)
		tmp_strsize=(u32)ptr->size;
			ISOM_DECREASE_SIZE(ptr, 1)
	ISOM_DECREASE_SIZE(ptr, 1)
		tmp_strsize=(u32)ptr->size;
			ISOM_DECREASE_SIZE(ptr, 1)
	tmp_strsize=(u32)ptr->size;
		ISOM_DECREASE_SIZE(ptr, 1)
	tmp_strsize=(u32)ptr->size;
		ISOM_DECREASE_SIZE(ptr, 1)
	ISOM_DECREASE_SIZE(ptr, 1)
	ISOM_DECREASE_SIZE(ptr, 1)