hitoshura25/cvefixes huggingface dataset:
CVE-2021-40566 (C, published 2022-01-12T22:15Z)
Description: value: A Segmentation fault casued by heap use after free vulnerability exists in Gpac through 1.0.1 via the mpgviddmx_process function in reframe_mpgvid.c when using mp4box, which causes a denial of service.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/gpac/gpac
Files changed:
src/filters/dec_xvid.c
src/filters/reframe_mpgvid.c
Commit message: fixed #1887


Vulnerable code:
	if (!dsi.width || !dsi.height) return GF_NON_COMPLIANT_BITSTREAM;
					if (ctx->hdr_store_alloc < ctx->hdr_store_size + pck_size - vosh_start) {
						ctx->hdr_store_alloc = (u32) (ctx->hdr_store_size + pck_size - vosh_start);
						ctx->hdr_store = gf_realloc(ctx->hdr_store, sizeof(char)*ctx->hdr_store_alloc);
					memcpy(ctx->hdr_store + ctx->hdr_store_size, data + vosh_start, (size_t) (pck_size - vosh_start) );
					ctx->hdr_store_size += pck_size - (u32) vosh_start;
					if (ctx->hdr_store_alloc < ctx->hdr_store_size + pck_size - vosh_start) {
						ctx->hdr_store_alloc = (u32) (ctx->hdr_store_size + pck_size - (u32) vosh_start);
						ctx->hdr_store = gf_realloc(ctx->hdr_store, sizeof(char)*ctx->hdr_store_alloc);
					memcpy(ctx->hdr_store + ctx->hdr_store_size, data + vosh_start, (size_t) (pck_size - vosh_start) );
					ctx->hdr_store_size += pck_size - (u32) vosh_start;

Fixed code:
	if (!dsi.width || (dsi.width%2) || !dsi.height) return GF_NON_COMPLIANT_BITSTREAM;
					if (data == ctx->hdr_store) {
						memmove(ctx->hdr_store, start, remain);
						ctx->hdr_store_size = remain;
					} else {
						if (ctx->hdr_store_alloc < ctx->hdr_store_size + pck_size - vosh_start) {
							ctx->hdr_store_alloc = (u32) (ctx->hdr_store_size + pck_size - vosh_start);
							ctx->hdr_store = gf_realloc(ctx->hdr_store, sizeof(char)*ctx->hdr_store_alloc);
						}
						memcpy(ctx->hdr_store + ctx->hdr_store_size, data + vosh_start, (size_t) (pck_size - vosh_start) );
						ctx->hdr_store_size += pck_size - (u32) vosh_start;
					if (data == ctx->hdr_store) {
						memmove(ctx->hdr_store, start, remain);
						ctx->hdr_store_size = remain;
					} else {
						if (ctx->hdr_store_alloc < ctx->hdr_store_size + pck_size - vosh_start) {
							ctx->hdr_store_alloc = (u32) (ctx->hdr_store_size + pck_size - (u32) vosh_start);
							ctx->hdr_store = gf_realloc(ctx->hdr_store, sizeof(char)*ctx->hdr_store_alloc);
						}
						memcpy(ctx->hdr_store + ctx->hdr_store_size, data + vosh_start, (size_t) (pck_size - vosh_start) );
						ctx->hdr_store_size += pck_size - (u32) vosh_start;
CVE-2021-40567 (C, published 2022-01-13T18:15Z)
Description: value: Segmentation fault vulnerability exists in Gpac through 1.0.1 via the gf_odf_size_descriptor function in desc_private.c when using mp4box, which causes a denial of service.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/gpac/gpac
Files changed:
src/media_tools/isom_hinter.c
Commit message: fixed #1885


Vulnerable code:

Fixed code:
				InitSL_NULL(&slc);
CVE-2021-40568 (C, published 2022-01-13T18:15Z)
Description: value: A buffer overflow vulnerability exists in Gpac through 1.0.1 via a malformed MP4 file in the svc_parse_slice function in av_parsers.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/gpac/gpac
Files changed:
src/media_tools/av_parsers.c
Commit message: fixed #1900


Vulnerable code:
			//gf_bs_read_int keeps returning 0 on EOS, so if no more bits available, rbsp was truncated otherwise code is broken in rbsp)
			//we only test once nb_lead>=32 to avoid testing at each bit read
			if (!gf_bs_available(bs)) {
				GF_LOG(GF_LOG_ERROR, GF_LOG_CODING, ("[Core] exp-golomb read failed, not enough bits in bitstream !\n"));
			} else {
				GF_LOG(GF_LOG_ERROR, GF_LOG_CODING, ("[Core] corrupted exp-golomb code, %d leading zeros, max 31 allowed !\n", nb_lead));
			}
			return 0;

	if (pps_id > 255)

Fixed code:
			break;
	if (nb_lead>=32) {
		//gf_bs_read_int keeps returning 0 on EOS, so if no more bits available, rbsp was truncated otherwise code is broken in rbsp)
		//we only test once nb_lead>=32 to avoid testing at each bit read
		if (!gf_bs_available(bs)) {
			GF_LOG(GF_LOG_ERROR, GF_LOG_CODING, ("[Core] exp-golomb read failed, not enough bits in bitstream !\n"));
		} else {
			GF_LOG(GF_LOG_ERROR, GF_LOG_CODING, ("[Core] corrupted exp-golomb code, %d leading zeros, max 31 allowed !\n", nb_lead));
		}
		return 0;
	}

	if ((pps_id<0) || (pps_id > 255))
CVE-2021-40569 (C, published 2022-01-13T18:15Z)
Description: value: The binary MP4Box in Gpac through 1.0.1 has a double-free vulnerability in the iloc_entry_del funciton in box_code_meta.c, which allows attackers to cause a denial of service.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/box_code_meta.c
Commit message: fixed #1890


Vulnerable code:
		GF_ItemLocationEntry *location_entry = (GF_ItemLocationEntry *)gf_malloc(sizeof(GF_ItemLocationEntry));
			GF_ItemExtentEntry *extent_entry = (GF_ItemExtentEntry *)gf_malloc(sizeof(GF_ItemExtentEntry));

Fixed code:
		GF_ItemLocationEntry *location_entry;
		GF_SAFEALLOC(location_entry, GF_ItemLocationEntry);
			GF_ItemExtentEntry *extent_entry;
			GF_SAFEALLOC(extent_entry, GF_ItemExtentEntry);
CVE-2021-40570 (C, published 2022-01-13T18:15Z)
Description: value: The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the avc_compute_poc function in av_parsers.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/gpac/gpac
Files changed:
src/media_tools/av_parsers.c
Commit message: fixed #1899


Vulnerable code:

Fixed code:
			sps->poc_cycle_length = 255;
CVE-2021-40571 (C, published 2022-01-13T18:15Z)
Description: value: The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the ilst_box_read function in box_code_apple.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/gpac/gpac
Files changed:
src/odf/descriptors.c
Commit message: fixed #1895


Vulnerable code:

Fixed code:
	gf_bs_align(bs);
CVE-2021-40572 (C, published 2022-01-13T19:15Z)
Description: value: The binary MP4Box in Gpac 1.0.1 has a double-free bug in the av1dmx_finalize function in reframe_av1.c, which allows attackers to cause a denial of service.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/gpac/gpac
Files changed:
src/media_tools/av_parsers.c
Commit message: fixed #1893


Vulnerable code:
			if (gf_bs_get_position(state->bs)) {
				u32 size;
				gf_bs_get_content_no_truncate(state->bs, &state->frame_obus, &size, &state->frame_obus_alloc);
			}

Fixed code:
			u32 size;
			gf_bs_get_content_no_truncate(state->bs, &state->frame_obus, &size, &state->frame_obus_alloc);
CVE-2021-40573 (C, published 2022-01-13T19:15Z)
Description: value: The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the gf_list_del function in list.c, which allows attackers to cause a denial of service.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/box_code_meta.c
Commit message: fixed #1890


Vulnerable code:
		GF_ItemLocationEntry *location_entry = (GF_ItemLocationEntry *)gf_malloc(sizeof(GF_ItemLocationEntry));
			GF_ItemExtentEntry *extent_entry = (GF_ItemExtentEntry *)gf_malloc(sizeof(GF_ItemExtentEntry));

Fixed code:
		GF_ItemLocationEntry *location_entry;
		GF_SAFEALLOC(location_entry, GF_ItemLocationEntry);
			GF_ItemExtentEntry *extent_entry;
			GF_SAFEALLOC(extent_entry, GF_ItemExtentEntry);
CVE-2021-40574 (C, published 2022-01-13T19:15Z)
Description: value: The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the gf_text_get_utf8_line function in load_text.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/gpac/gpac
Files changed:
src/filters/load_text.c
Commit message: fixed #1897


Vulnerable code:
	char szLineConv[1024];
	i = (u32) gf_utf8_wcstombs(szLineConv, 1024, (const unsigned short **) &sptr);

Fixed code:
	char szLineConv[2048];
	i = (u32) gf_utf8_wcstombs(szLineConv, 2048, (const unsigned short **) &sptr);
			if (i>=19)
				break;
CVE-2021-40575 (C, published 2022-01-13T19:15Z)
Description: value: The binary MP4Box in Gpac 1.0.1 has a null pointer dereference vulnerability in the mpgviddmx_process function in reframe_mpgvid.c, which allows attackers to cause a denial of service. This vulnerability is possibly due to an incomplete fix for CVE-2021-40566.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/filters/reframe_mpgvid.c
Commit message: fixed #1905


Vulnerable code:
		//parse headers

Fixed code:
		//not enough bytes to parse start code
		if (remain<5) {
			memcpy(ctx->hdr_store, start, remain);
			ctx->bytes_in_header = remain;
			break;
		}
		//parse headers
CVE-2021-40576 (C, published 2022-01-13T19:15Z)
Description: value: The binary MP4Box in Gpac 1.0.1 has a null pointer dereference vulnerability in the gf_isom_get_payt_count function in hint_track.c, which allows attackers to cause a denial of service.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/hint_track.c
Commit message: fixed #1904


Vulnerable code:
	if (hmhd->type != GF_ISOM_BOX_TYPE_HMHD)

Fixed code:
	if (!hmhd || (hmhd->type != GF_ISOM_BOX_TYPE_HMHD))
CVE-2021-40592 (C, published 2022-06-08T18:15Z)
Description: value: GPAC version before commit 71460d72ec07df766dab0a4d52687529f3efcf0a (version v1.0.1 onwards) contains loop with unreachable exit condition ('infinite loop') vulnerability in ISOBMFF reader filter, isoffin_read.c. Function isoffin_process() can result in DoS by infinite loop. To exploit, the victim must open a specially crafted mp4 file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/gpac/gpac
Files changed:
src/filters/isoffin_read.c
src/filters/isoffin_read_ch.c
Commit message: fixed #1876


Vulnerable code:

Fixed code:
			} else if (ch->last_state==GF_ISOM_INVALID_FILE) {
				if (!ch->eos_sent) {
					ch->eos_sent = GF_TRUE;
					read->eos_signaled = GF_TRUE;
					gf_filter_pid_set_eos(ch->pid);
				}
				return ch->last_state;
				if (ch->to_init && ch->sample_num) {
					GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[IsoMedia] Failed to fetch initial sample %d for track %d\n"));
					ch->last_state = GF_ISOM_INVALID_FILE;
				}
CVE-2022-1035 (C, published 2022-03-21T13:15Z)
Description: value: Segmentation Fault caused by MP4Box -lsr in GitHub repository gpac/gpac prior to 2.1.0-DEV.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/scene_manager/scene_dump.c
Commit message: fixed #2146


Vulnerable code:
		assert ( *(GF_Node **)field.far_ptr);
		gf_dump_vrml_node(sdump, *(GF_Node **)field.far_ptr, 0, NULL);

Fixed code:
		gf_dump_vrml_node(sdump, field.far_ptr ? *(GF_Node **)field.far_ptr : NULL, 0, NULL);
CVE-2022-1172 (C, published 2022-03-30T10:15Z)
Description: value: Null Pointer Dereference Caused Segmentation Fault in GitHub repository gpac/gpac prior to 2.1.0-DEV.
Severity: MEDIUM (CVSS v3 base score: 5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/bifs/field_decode.c
Commit message: fixed #2153


Vulnerable code:

Fixed code:
			sfcb->bufferSize = 0;
CVE-2022-1222 (C, published 2022-04-04T10:15Z)
Description: value: Inf loop in GitHub repository gpac/gpac prior to 2.1.0-DEV.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/gpac/gpac
Files changed:
src/media_tools/avilib.c
Commit message: fixed #2159


Vulnerable code:
	int i, rate, scale, idx_type;
	s64 n;

Fixed code:
	int rate, scale, idx_type;
	s64 n, i;
				if (n>0xFFFFFFFF) ERR_EXIT(AVI_ERR_READ)
							if (n>0xFFFFFFFF) ERR_EXIT(AVI_ERR_READ)
							if (!AVI->extradata) ERR_EXIT(AVI_ERR_NO_MEM)
CVE-2022-1441 (C, published 2022-04-25T17:15Z)
Description: value: MP4Box is a component of GPAC-2.0.0, which is a widely-used third-party package on RPM Fusion. When MP4Box tries to parse a MP4 file, it calls the function `diST_box_read()` to read from video. In this function, it allocates a buffer `str` with fixed length. However, content read from `bs` is controllable by user, so is the length, which causes a buffer overflow.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/box_code_3gpp.c
Commit message: fixed #2175


Vulnerable code:
	u32 i;
	char str[1024];
	i=0;
	str[0]=0;
	while (1) {
		str[i] = gf_bs_read_u8(bs);
		if (!str[i]) break;
		i++;
	}
	ISOM_DECREASE_SIZE(p, i);

	p->content_script_types = gf_strdup(str);

Fixed code:
	p->content_script_types = gf_malloc(sizeof(char) * (s->size+1));
	if (!p->content_script_types) return GF_OUT_OF_MEM;
	gf_bs_read_data(bs, p->content_script_types, s->size);
	p->content_script_types[s->size] = 0;
CVE-2022-1795 (C, published 2022-05-18T15:15Z)
Description: value: Use After Free in GitHub repository gpac/gpac prior to v2.1.0-DEV.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/gpac/gpac
Files changed:
src/bifs/memory_decoder.c
Commit message: fixed #2194


Vulnerable code:
		gf_node_unregister(node, NULL);
	node->sgprivate->num_instances = 2;

Fixed code:
		//if node was just created (num_instances == 0), unregister
		//otherwise (USE node) don't do anything
		if (!node->sgprivate->num_instances) {
			node->sgprivate->num_instances = 1;
			gf_node_unregister(node, NULL);
		}
	gf_node_unregister(node, NULL);
	gf_node_unregister(node, NULL);
CVE-2022-2454 (C, published 2022-07-19T14:15Z)
Description: value: Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.1-DEV.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/gpac/gpac
Files changed:
src/laser/lsr_dec.c
Commit message: fixed #2213


Vulnerable code:

Fixed code:
	if (!nb_bits) return 0;
CVE-2022-2549 (C, published 2022-07-27T15:15Z)
Description: value: NULL Pointer Dereference in GitHub repository gpac/gpac prior to v2.1.0-DEV.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/scene_manager/scene_dump.c
Commit message: fixed #2232


Vulnerable code:
		for (i=0; i<mffield->count; i++) {
		if (mffield) {
			for (i=0; i<mffield->count; i++) {
				if (i) gf_fprintf(sdump->trace, " ");
				gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
				gf_dump_vrml_sffield(sdump, sf_type, slot_ptr, 1, node);
			}
					for (i=0; i<mffield->count; i++) {
					for (i=0; i<mffield->count; i++) {
				if (mffield) {
					for (i=0; i<mffield->count; i++) {
						if (i) gf_fprintf(sdump->trace, " ");
						if (field.fieldType != GF_SG_VRML_MFNODE) {
							gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
							gf_dump_vrml_sffield(sdump, sf_type, slot_ptr, (mffield->count>1) ? 1 : 0, node);
						}

Fixed code:
		for (i=0; mffield && (i<mffield->count); i++) {
		for (i=0; mffield && (i<mffield->count); i++) {
			if (i) gf_fprintf(sdump->trace, " ");
			gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
			gf_dump_vrml_sffield(sdump, sf_type, slot_ptr, 1, node);
					for (i=0; mffield && (i<mffield->count); i++) {
					for (i=0; mffield && (i<mffield->count); i++) {
				for (i=0; mffield && (i<mffield->count); i++) {
					if (i) gf_fprintf(sdump->trace, " ");
					if (field.fieldType != GF_SG_VRML_MFNODE) {
						gf_sg_vrml_mf_get_item(field.far_ptr, field.fieldType, &slot_ptr, i);
						gf_dump_vrml_sffield(sdump, sf_type, slot_ptr, (mffield->count>1) ? 1 : 0, node);
CVE-2022-29339 (C, published 2022-05-05T13:15Z)
Description: value: In GPAC 2.1-DEV-rev87-g053aae8-master, function BS_ReadByte() in utils/bitstream.c has a failed assertion, which causes a Denial of Service. This vulnerability was fixed in commit 9ea93a2.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/avc_ext.c
src/utils/bitstream.c
Commit message: fixed #2165


Vulnerable code:
	if (!is_eos || bs->cache_read) {
		GF_LOG(GF_LOG_ERROR, GF_LOG_CORE, ("[BS] Attempt to overread bitstream\n"));

Fixed code:

			if (gf_bs_is_overflow(bs)) {
				gf_free(op);
				return GF_NON_COMPLIANT_BITSTREAM;
			}
		if (gf_bs_is_overflow(bs)) {
			gf_free(op);
			return GF_NON_COMPLIANT_BITSTREAM;
		}
		if (gf_bs_is_overflow(bs)) {
			gf_free(dep);
			return GF_NON_COMPLIANT_BITSTREAM;
		}
	//cache not fully read, reset EOS
	if (bs->cache_read && (bs->cache_read_pos<bs->cache_read_size))
		is_eos = GF_FALSE;
	if (!is_eos) {
		if (!bs->overflow_state) {
			bs->overflow_state = 1;
			GF_LOG(GF_LOG_ERROR, GF_LOG_CORE, ("[BS] Attempt to overread bitstream\n"));
		}
CVE-2022-29340 (C, published 2022-05-05T13:15Z)
Description: value: GPAC 2.1-DEV-rev87-g053aae8-master. has a Null Pointer Dereference vulnerability in gf_isom_parse_movie_boxes_internal due to improper return value handling of GF_SKIP_BOX, which causes a Denial of Service. This vulnerability was fixed in commit 37592ad.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/box_funcs.c
src/isomedia/isom_intern.c
Commit message: fixed #2163


Vulnerable code:
		if (!skip_logs) {


Fixed code:
		if (is_root_box && (e==GF_SKIP_BOX))
			e = GF_ISOM_INVALID_FILE;
		if (!skip_logs && (e!=GF_SKIP_BOX)) {
			//safety check, should never happen
			if (!a) return GF_ISOM_INVALID_FILE;
CVE-2022-3178 (C, published 2022-09-12T17:15Z)
Description: value: Buffer Over-read in GitHub repository gpac/gpac prior to 2.1.0-DEV.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gpac/gpac
Files changed:
src/isomedia/box_code_base.c
Commit message: fixed #2255


Vulnerable code:
			//add 2 extra bytes for UTF16 case string dump
			data2 = gf_malloc(sizeof(char) * (prop_size+2));

Fixed code:
			//add 3 extra bytes for UTF16 case string dump (3 because we need 0-aligned short value)
			data2 = gf_malloc(sizeof(char) * (prop_size+3));
			data2[prop_size+2] = 0;
CVE-2022-3222 (Other, published 2022-09-15T09:15Z)
Description: value: Uncontrolled Recursion in GitHub repository gpac/gpac prior to 2.1.0-DEV.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-674 \u2014 Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
Repository: https://github.com/gpac/gpac
Files changed:
build/xcode/gpac.xcodeproj/project.pbxproj
src/bifs/script_dec.c
Commit message: fixed #2238


Vulnerable code:
				MACOSX_DEPLOYMENT_TARGET = 10.6;
				MACOSX_DEPLOYMENT_TARGET = 10.6;


Fixed code:
				MACOSX_DEPLOYMENT_TARGET = 10.9;
				MACOSX_DEPLOYMENT_TARGET = 10.9;
	u32 expr_stack_size;
	memset(&parser, 0, sizeof(ScriptParser));
		if (codec->LastError) {
			e = codec->LastError;
			goto exit;
		}
	if (parser->codec->LastError) return;
#define MAX_EXPR_STACK	500
	//limit max expression stack size
	parser->expr_stack_size++;
	if (parser->expr_stack_size>MAX_EXPR_STACK) {
		GF_LOG(GF_LOG_ERROR, GF_LOG_CODEC, ("[BIFS] Max stack size %d reached for expressions, not supported\n", MAX_EXPR_STACK))
		parser->codec->LastError = GF_NON_COMPLIANT_BITSTREAM;
		return;
	}

	parser->expr_stack_size--;
	if (parser->codec->LastError) return;
	if (parser->codec->LastError) return;
	if (parser->codec->LastError) return;
		if (parser->codec->LastError) return;