rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: A flaw was found in ImageMagick where it did not properly sanitize certain input before using it to invoke convert processes. This flaw allows an attacker to create a specially crafted image that leads to a use-after-free vulnerability when processed by ImageMagick. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Vulnerability ID: CVE-2021-3962
CWE: CWE-416
Severity score: 6.4
Project: https://github.com/ImageMagick/ImageMagick
Published: 2021-11-19
File: coders/dcm.c
Commit message: Moved the free to the correct position to fix #4446.
Commit author: Dirk Lemstra

Vulnerable version (before fix):
 static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)           (void) RelinquishUniqueFileResource(filename);         }         read_info=DestroyImageInfo(read_info);         RelinquishDCMMemory(&info,&map,stream_info,stack,data);         image=DestroyImageList(image);         if ((status == MagickFalse) && (exception->severity < ErrorException))           ThrowDCMException(CorruptImageError,"CorruptImageError")         return(GetFirstImageInList(images));       }     if (info.depth != (1UL*MAGICKCORE_QUANTUM_DEPTH))

Fixed version (after fix):
 static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)           (void) RelinquishUniqueFileResource(filename);         }         read_info=DestroyImageInfo(read_info);         image=DestroyImageList(image);         if ((status == MagickFalse) && (exception->severity < ErrorException))           ThrowDCMException(CorruptImageError,"CorruptImageError")         else           RelinquishDCMMemory(&info,&map,stream_info,stack,data);         return(GetFirstImageInList(images));       }     if (info.depth != (1UL*MAGICKCORE_QUANTUM_DEPTH))

Patch:
patch: @@ -3996,10 +3996,11 @@ static Image *ReadDCMImage(const ImageInfo *image_info,ExceptionInfo *exception)
           (void) RelinquishUniqueFileResource(filename);
         }
         read_info=DestroyImageInfo(read_info);
-        RelinquishDCMMemory(&info,&map,stream_info,stack,data);
         image=DestroyImageList(image);
         if ((status == MagickFalse) && (exception->severity < ErrorException))
           ThrowDCMException(CorruptImageError,"CorruptImageError")
+        else
+          RelinquishDCMMemory(&info,&map,stream_info,stack,data);
         return(GetFirstImageInList(images));
       }
     if (info.depth != (1UL*MAGICKCORE_QUANTUM_DEPTH))
path: coders/dcm.c
Vulnerability: NULL Pointer Dereference in GitHub repository gpac/gpac prior to 1.1.0.
Vulnerability ID: CVE-2021-4043
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2022-02-04
File: src/isomedia/box_code_base.c
Commit message: fixed #2092
Commit author: jeanlf

Vulnerable version (before fix):
 void gitn_box_del(GF_Box *s) 	u32 i; 	GroupIdToNameBox *ptr = (GroupIdToNameBox *)s; 	if (ptr == NULL) return; 	for (i=0; i<ptr->nb_entries; i++) { 		if (ptr->entries[i].name) gf_free(ptr->entries[i].name); 	} 	if (ptr->entries) gf_free(ptr->entries); 	gf_free(ptr); } 

Fixed version (after fix):
 void gitn_box_del(GF_Box *s) 	u32 i; 	GroupIdToNameBox *ptr = (GroupIdToNameBox *)s; 	if (ptr == NULL) return; 	if (ptr->entries) { 		for (i=0; i<ptr->nb_entries; i++) { 			if (ptr->entries[i].name) gf_free(ptr->entries[i].name); 		} 		gf_free(ptr->entries); 	} 	gf_free(ptr); } 

Patch:
patch: @@ -11083,10 +11083,12 @@ void gitn_box_del(GF_Box *s)
 	u32 i;
 	GroupIdToNameBox *ptr = (GroupIdToNameBox *)s;
 	if (ptr == NULL) return;
-	for (i=0; i<ptr->nb_entries; i++) {
-		if (ptr->entries[i].name) gf_free(ptr->entries[i].name);
+	if (ptr->entries) {
+		for (i=0; i<ptr->nb_entries; i++) {
+			if (ptr->entries[i].name) gf_free(ptr->entries[i].name);
+		}
+		gf_free(ptr->entries);
 	}
-	if (ptr->entries) gf_free(ptr->entries);
 	gf_free(ptr);
 }
path: src/isomedia/box_code_base.c
Vulnerability: In Pure-FTPd before 1.0.50, an incorrect max_filesize quota mechanism in the server allows attackers to upload files of unbounded size, which may lead to denial of service or a server hang. This occurs because a certain greater-than-zero test does not anticipate an initial -1 value. (Versions 1.0.23 through 1.0.49 are affected.)
Vulnerability ID: CVE-2021-40524
CWE: CWE-434
Severity score: 2.9
Project: https://github.com/jedisct1/pure-ftpd
Published: 2021-09-05
File: src/ftpd.c
Commit message: Initialize the max upload file size when quotas are enabled

Due to an unwanted check, files causing the quota to be exceeded
were deleted after the upload, but not during the upload.

The bug was introduced in 2009 in version 1.0.23

Spotted by @DroidTest, thanks!
Commit author: Frank Denis

Vulnerable version (before fix):
 void dostor(char *name, const int append, const int autorename)     if (quota_update(&quota, 0LL, 0LL, &overflow) == 0 &&         (overflow > 0 || quota.files >= user_quota_files ||          quota.size > user_quota_size ||          (max_filesize >= (off_t) 0 &&           (max_filesize = user_quota_size - quota.size) < (off_t) 0))) {         overflow = 1;         (void) close(f);         goto afterquota;

Fixed version (after fix):
 void dostor(char *name, const int append, const int autorename)     if (quota_update(&quota, 0LL, 0LL, &overflow) == 0 &&         (overflow > 0 || quota.files >= user_quota_files ||          quota.size > user_quota_size ||          (max_filesize = user_quota_size - quota.size) < (off_t) 0)) {         overflow = 1;         (void) close(f);         goto afterquota;

Patch:
patch: @@ -4247,8 +4247,7 @@ void dostor(char *name, const int append, const int autorename)
     if (quota_update(&quota, 0LL, 0LL, &overflow) == 0 &&
         (overflow > 0 || quota.files >= user_quota_files ||
          quota.size > user_quota_size ||
-         (max_filesize >= (off_t) 0 &&
-          (max_filesize = user_quota_size - quota.size) < (off_t) 0))) {
+         (max_filesize = user_quota_size - quota.size) < (off_t) 0)) {
         overflow = 1;
         (void) close(f);
         goto afterquota;
path: src/ftpd.c
Vulnerability: A Segmentation fault exists casued by null pointer dereference exists in Gpac through 1.0.1 via the naludmx_create_avc_decoder_config function in reframe_nalu.c when using mp4box, which causes a denial of service.
Vulnerability ID: CVE-2021-40563
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2022-01-12
File: src/filters/reframe_nalu.c
Commit message: fixed #1892
Commit author: jeanlf

Vulnerable version (before fix):
 static void naludmx_queue_param_set(GF_NALUDmxCtx *ctx, char *data, u32 size, u3 { 	GF_List *list = NULL, *alt_list = NULL; 	GF_NALUFFParam *sl; 	u32 i, count; 	u32 crc = gf_crc_32(data, size);  	if (ctx->codecid==GF_CODECID_HEVC) { 		switch (ps_type) {

Fixed version (after fix):
 static void naludmx_queue_param_set(GF_NALUDmxCtx *ctx, char *data, u32 size, u3 { 	GF_List *list = NULL, *alt_list = NULL; 	GF_NALUFFParam *sl; 	u32 i, count, crc;  	if (!size) return; 	crc = gf_crc_32(data, size);  	if (ctx->codecid==GF_CODECID_HEVC) { 		switch (ps_type) {

Patch:
patch: @@ -1680,8 +1680,10 @@ static void naludmx_queue_param_set(GF_NALUDmxCtx *ctx, char *data, u32 size, u3
 {
 	GF_List *list = NULL, *alt_list = NULL;
 	GF_NALUFFParam *sl;
-	u32 i, count;
-	u32 crc = gf_crc_32(data, size);
+	u32 i, count, crc;
+
+	if (!size) return;
+	crc = gf_crc_32(data, size);
 
 	if (ctx->codecid==GF_CODECID_HEVC) {
 		switch (ps_type) {
path: src/filters/reframe_nalu.c
Vulnerability: A Segmentation fault caused by null pointer dereference vulnerability eists in Gpac through 1.0.2 via the avc_parse_slice function in av_parsers.c when using mp4box, which causes a denial of service.
Vulnerability ID: CVE-2021-40564
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2022-01-12
File: src/media_tools/av_parsers.c
Commit message: fixed #1898
Commit author: jeanlf

Vulnerable version (before fix):
 u32 gf_bs_read_ue_log_idx3(GF_BitStream *bs, const char *fname, s32 idx1, s32 id 	}  	if (nb_lead) { 		val = gf_bs_read_int(bs, nb_lead); 		val += (1 << nb_lead) - 1; 		bits += nb_lead; 	}  static s32 avc_parse_slice(GF_BitStream *bs, AVCState *avc, Bool svc_idr_flag, A 	if (si->slice_type > 9) return -1;  	pps_id = gf_bs_read_ue_log(bs, "pps_id"); 	if (pps_id > 255) return -1; 	si->pps = &avc->pps[pps_id]; 	if (!si->pps->slice_group_count) return -2; 	si->sps = &avc->sps[si->pps->sps_id];

Fixed version (after fix):
 u32 gf_bs_read_ue_log_idx3(GF_BitStream *bs, const char *fname, s32 idx1, s32 id 	}  	if (nb_lead) { 		u32 leads=1; 		val = gf_bs_read_int(bs, nb_lead); 		leads <<= nb_lead; 		leads -= 1; 		val += leads; //		val += (1 << nb_lead) - 1; 		bits += nb_lead; 	}  static s32 avc_parse_slice(GF_BitStream *bs, AVCState *avc, Bool svc_idr_flag, A 	if (si->slice_type > 9) return -1;  	pps_id = gf_bs_read_ue_log(bs, "pps_id"); 	if ((pps_id<0) || (pps_id > 255)) return -1; 	si->pps = &avc->pps[pps_id]; 	if (!si->pps->slice_group_count) return -2; 	si->sps = &avc->sps[si->pps->sps_id];

Patch:
patch: @@ -4705,8 +4705,12 @@ u32 gf_bs_read_ue_log_idx3(GF_BitStream *bs, const char *fname, s32 idx1, s32 id
 	}
 
 	if (nb_lead) {
+		u32 leads=1;
 		val = gf_bs_read_int(bs, nb_lead);
-		val += (1 << nb_lead) - 1;
+		leads <<= nb_lead;
+		leads -= 1;
+		val += leads;
+//		val += (1 << nb_lead) - 1;
 		bits += nb_lead;
 	}
 
@@ -5671,7 +5675,7 @@ static s32 avc_parse_slice(GF_BitStream *bs, AVCState *avc, Bool svc_idr_flag, A
 	if (si->slice_type > 9) return -1;
 
 	pps_id = gf_bs_read_ue_log(bs, "pps_id");
-	if (pps_id > 255) return -1;
+	if ((pps_id<0) || (pps_id > 255)) return -1;
 	si->pps = &avc->pps[pps_id];
 	if (!si->pps->slice_group_count) return -2;
 	si->sps = &avc->sps[si->pps->sps_id];
path: src/media_tools/av_parsers.c
Vulnerability: A Segmentation fault caused by a null pointer dereference vulnerability exists in Gpac through 1.0.1 via the gf_avc_parse_nalu function in av_parsers.c when using mp4box, which causes a denial of service.
Vulnerability ID: CVE-2021-40565
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2022-01-12
File: src/media_tools/av_parsers.c
Commit message: fixed #1902
Commit author: jeanlf

Vulnerable version (before fix):
 s32 gf_avc_parse_nalu(GF_BitStream *bs, AVCState *avc) 			ret = 1; 			break; 		} 		assert(avc->s_info.sps);  		if (avc->s_info.sps->poc_type == n_state.sps->poc_type) { 			if (!avc->s_info.sps->poc_type) {

Fixed version (after fix):
 s32 gf_avc_parse_nalu(GF_BitStream *bs, AVCState *avc) 			ret = 1; 			break; 		} 		if (!avc->s_info.sps) 			return -1;  		if (avc->s_info.sps->poc_type == n_state.sps->poc_type) { 			if (!avc->s_info.sps->poc_type) {

Patch:
patch: @@ -6113,7 +6113,8 @@ s32 gf_avc_parse_nalu(GF_BitStream *bs, AVCState *avc)
 			ret = 1;
 			break;
 		}
-		assert(avc->s_info.sps);
+		if (!avc->s_info.sps)
+			return -1;
 
 		if (avc->s_info.sps->poc_type == n_state.sps->poc_type) {
 			if (!avc->s_info.sps->poc_type) {
path: src/media_tools/av_parsers.c
Vulnerability: The binary MP4Box in Gpac through 1.0.1 has a double-free vulnerability in the iloc_entry_del funciton in box_code_meta.c, which allows attackers to cause a denial of service.
Vulnerability ID: CVE-2021-40569
CWE: CWE-415
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2022-01-13
File: src/isomedia/box_code_meta.c
Commit message: fixed #1890
Commit author: jeanlf

Vulnerable version (before fix):
 GF_Err iloc_box_read(GF_Box *s, GF_BitStream *bs) 	}  	for (i = 0; i < item_count; i++) { 		GF_ItemLocationEntry *location_entry = (GF_ItemLocationEntry *)gf_malloc(sizeof(GF_ItemLocationEntry)); 		if (!location_entry) return GF_OUT_OF_MEM;  		gf_list_add(ptr->location_entries, location_entry); GF_Err iloc_box_read(GF_Box *s, GF_BitStream *bs) 		extent_count = gf_bs_read_u16(bs); 		location_entry->extent_entries = gf_list_new(); 		for (j = 0; j < extent_count; j++) { 			GF_ItemExtentEntry *extent_entry = (GF_ItemExtentEntry *)gf_malloc(sizeof(GF_ItemExtentEntry)); 			if (!extent_entry) return GF_OUT_OF_MEM; 			 			gf_list_add(location_entry->extent_entries, extent_entry);

Fixed version (after fix):
 GF_Err iloc_box_read(GF_Box *s, GF_BitStream *bs) 	}  	for (i = 0; i < item_count; i++) { 		GF_ItemLocationEntry *location_entry; 		GF_SAFEALLOC(location_entry, GF_ItemLocationEntry); 		if (!location_entry) return GF_OUT_OF_MEM;  		gf_list_add(ptr->location_entries, location_entry); GF_Err iloc_box_read(GF_Box *s, GF_BitStream *bs) 		extent_count = gf_bs_read_u16(bs); 		location_entry->extent_entries = gf_list_new(); 		for (j = 0; j < extent_count; j++) { 			GF_ItemExtentEntry *extent_entry; 			GF_SAFEALLOC(extent_entry, GF_ItemExtentEntry); 			if (!extent_entry) return GF_OUT_OF_MEM; 			 			gf_list_add(location_entry->extent_entries, extent_entry);

Patch:
patch: @@ -282,7 +282,8 @@ GF_Err iloc_box_read(GF_Box *s, GF_BitStream *bs)
 	}
 
 	for (i = 0; i < item_count; i++) {
-		GF_ItemLocationEntry *location_entry = (GF_ItemLocationEntry *)gf_malloc(sizeof(GF_ItemLocationEntry));
+		GF_ItemLocationEntry *location_entry;
+		GF_SAFEALLOC(location_entry, GF_ItemLocationEntry);
 		if (!location_entry) return GF_OUT_OF_MEM;
 
 		gf_list_add(ptr->location_entries, location_entry);
@@ -311,7 +312,8 @@ GF_Err iloc_box_read(GF_Box *s, GF_BitStream *bs)
 		extent_count = gf_bs_read_u16(bs);
 		location_entry->extent_entries = gf_list_new();
 		for (j = 0; j < extent_count; j++) {
-			GF_ItemExtentEntry *extent_entry = (GF_ItemExtentEntry *)gf_malloc(sizeof(GF_ItemExtentEntry));
+			GF_ItemExtentEntry *extent_entry;
+			GF_SAFEALLOC(extent_entry, GF_ItemExtentEntry);
 			if (!extent_entry) return GF_OUT_OF_MEM;
 			
 			gf_list_add(location_entry->extent_entries, extent_entry);
path: src/isomedia/box_code_meta.c
Vulnerability: The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the avc_compute_poc function in av_parsers.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges.
Vulnerability ID: CVE-2021-40570
CWE: CWE-415
Severity score: 6.4
Project: https://github.com/gpac/gpac
Published: 2022-01-13
File: src/media_tools/av_parsers.c
Commit message: fixed #1899
Commit author: jeanlf

Vulnerable version (before fix):
 static s32 gf_avc_read_sps_bs_internal(GF_BitStream *bs, AVCState *avc, u32 subs 		sps->offset_for_top_to_bottom_field = gf_bs_read_se_log(bs, "offset_for_top_to_bottom_field"); 		sps->poc_cycle_length = gf_bs_read_ue_log(bs, "poc_cycle_length"); 		if (sps->poc_cycle_length > GF_ARRAY_LENGTH(sps->offset_for_ref_frame)) { 			GF_LOG(GF_LOG_ERROR, GF_LOG_CODING, ("[avc-h264] offset_for_ref_frame overflow from poc_cycle_length\n")); 			return -1; 		}

Fixed version (after fix):
 static s32 gf_avc_read_sps_bs_internal(GF_BitStream *bs, AVCState *avc, u32 subs 		sps->offset_for_top_to_bottom_field = gf_bs_read_se_log(bs, "offset_for_top_to_bottom_field"); 		sps->poc_cycle_length = gf_bs_read_ue_log(bs, "poc_cycle_length"); 		if (sps->poc_cycle_length > GF_ARRAY_LENGTH(sps->offset_for_ref_frame)) { 			sps->poc_cycle_length = 255; 			GF_LOG(GF_LOG_ERROR, GF_LOG_CODING, ("[avc-h264] offset_for_ref_frame overflow from poc_cycle_length\n")); 			return -1; 		}

Patch:
patch: @@ -5198,6 +5198,7 @@ static s32 gf_avc_read_sps_bs_internal(GF_BitStream *bs, AVCState *avc, u32 subs
 		sps->offset_for_top_to_bottom_field = gf_bs_read_se_log(bs, "offset_for_top_to_bottom_field");
 		sps->poc_cycle_length = gf_bs_read_ue_log(bs, "poc_cycle_length");
 		if (sps->poc_cycle_length > GF_ARRAY_LENGTH(sps->offset_for_ref_frame)) {
+			sps->poc_cycle_length = 255;
 			GF_LOG(GF_LOG_ERROR, GF_LOG_CODING, ("[avc-h264] offset_for_ref_frame overflow from poc_cycle_length\n"));
 			return -1;
 		}
path: src/media_tools/av_parsers.c
Vulnerability: The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the ilst_box_read function in box_code_apple.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges.
Vulnerability ID: CVE-2021-40571
CWE: CWE-415
Severity score: 6.4
Project: https://github.com/gpac/gpac
Published: 2022-01-13
File: src/odf/descriptors.c
Commit message: fixed #1895
Commit author: jeanlf

Vulnerable version (before fix):
 GF_AV1Config *gf_odf_av1_cfg_read_bs_size(GF_BitStream *bs, u32 size) 		size -= (u32) obu_size; 	} 	gf_av1_reset_state(& state, GF_TRUE); 	return cfg; #else 	return NULL;

Fixed version (after fix):
 GF_AV1Config *gf_odf_av1_cfg_read_bs_size(GF_BitStream *bs, u32 size) 		size -= (u32) obu_size; 	} 	gf_av1_reset_state(& state, GF_TRUE); 	gf_bs_align(bs); 	return cfg; #else 	return NULL;

Patch:
patch: @@ -1613,6 +1613,7 @@ GF_AV1Config *gf_odf_av1_cfg_read_bs_size(GF_BitStream *bs, u32 size)
 		size -= (u32) obu_size;
 	}
 	gf_av1_reset_state(& state, GF_TRUE);
+	gf_bs_align(bs);
 	return cfg;
 #else
 	return NULL;
path: src/odf/descriptors.c
Vulnerability: The binary MP4Box in Gpac 1.0.1 has a double-free bug in the av1dmx_finalize function in reframe_av1.c, which allows attackers to cause a denial of service.
Vulnerability ID: CVE-2021-40572
CWE: CWE-415
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2022-01-13
File: src/media_tools/av_parsers.c
Commit message: fixed #1893
Commit author: jeanlf

Vulnerable version (before fix):
 void gf_av1_reset_state(AV1State *state, Bool is_destroy) 		gf_list_del(l1); 		gf_list_del(l2); 		if (state->bs) { 			if (gf_bs_get_position(state->bs)) { 				u32 size; 				gf_bs_get_content_no_truncate(state->bs, &state->frame_obus, &size, &state->frame_obus_alloc); 			} 			gf_bs_del(state->bs); 		} 		state->bs = NULL;

Fixed version (after fix):
 void gf_av1_reset_state(AV1State *state, Bool is_destroy) 		gf_list_del(l1); 		gf_list_del(l2); 		if (state->bs) { 			u32 size; 			gf_bs_get_content_no_truncate(state->bs, &state->frame_obus, &size, &state->frame_obus_alloc); 			gf_bs_del(state->bs); 		} 		state->bs = NULL;

Patch:
patch: @@ -3980,10 +3980,8 @@ void gf_av1_reset_state(AV1State *state, Bool is_destroy)
 		gf_list_del(l1);
 		gf_list_del(l2);
 		if (state->bs) {
-			if (gf_bs_get_position(state->bs)) {
-				u32 size;
-				gf_bs_get_content_no_truncate(state->bs, &state->frame_obus, &size, &state->frame_obus_alloc);
-			}
+			u32 size;
+			gf_bs_get_content_no_truncate(state->bs, &state->frame_obus, &size, &state->frame_obus_alloc);
 			gf_bs_del(state->bs);
 		}
 		state->bs = NULL;
path: src/media_tools/av_parsers.c
Vulnerability: The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the gf_text_get_utf8_line function in load_text.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges.
Vulnerability ID: CVE-2021-40574
CWE: CWE-415
Severity score: 6.4
Project: https://github.com/gpac/gpac
Published: 2022-01-13
File: src/filters/load_text.c
Commit message: fixed #1897
Commit author: jeanlf

Vulnerable version (before fix):
 char *gf_text_get_utf8_line(char *szLine, u32 lineSize, FILE *txt_in, s32 unicod { 	u32 i, j, len; 	char *sOK; 	char szLineConv[1024]; 	unsigned short *sptr;  	memset(szLine, 0, sizeof(char)*lineSize); char *gf_text_get_utf8_line(char *szLine, u32 lineSize, FILE *txt_in, s32 unicod 		} 	} 	sptr = (u16 *)szLine; 	i = (u32) gf_utf8_wcstombs(szLineConv, 1024, (const unsigned short **) &sptr); 	szLineConv[i] = 0; 	strcpy(szLine, szLineConv); 	/*this is ugly indeed: since input is UTF16-LE, there are many chances the gf_fgets never reads the \0 after a \n*/ static GF_Err gf_text_process_sub(GF_Filter *filter, GF_TXTIn *ctx) 		while (szLine[i+1] && szLine[i+1]!='}') { 			szTime[i] = szLine[i+1]; 			i++; 		} 		szTime[i] = 0; 		ctx->start = atoi(szTime);

Fixed version (after fix):
 char *gf_text_get_utf8_line(char *szLine, u32 lineSize, FILE *txt_in, s32 unicod { 	u32 i, j, len; 	char *sOK; 	char szLineConv[2048]; 	unsigned short *sptr;  	memset(szLine, 0, sizeof(char)*lineSize); char *gf_text_get_utf8_line(char *szLine, u32 lineSize, FILE *txt_in, s32 unicod 		} 	} 	sptr = (u16 *)szLine; 	i = (u32) gf_utf8_wcstombs(szLineConv, 2048, (const unsigned short **) &sptr); 	szLineConv[i] = 0; 	strcpy(szLine, szLineConv); 	/*this is ugly indeed: since input is UTF16-LE, there are many chances the gf_fgets never reads the \0 after a \n*/ static GF_Err gf_text_process_sub(GF_Filter *filter, GF_TXTIn *ctx) 		while (szLine[i+1] && szLine[i+1]!='}') { 			szTime[i] = szLine[i+1]; 			i++; 			if (i>=19) 				break; 		} 		szTime[i] = 0; 		ctx->start = atoi(szTime);

Patch:
patch: @@ -255,7 +255,7 @@ char *gf_text_get_utf8_line(char *szLine, u32 lineSize, FILE *txt_in, s32 unicod
 {
 	u32 i, j, len;
 	char *sOK;
-	char szLineConv[1024];
+	char szLineConv[2048];
 	unsigned short *sptr;
 
 	memset(szLine, 0, sizeof(char)*lineSize);
@@ -328,7 +328,7 @@ char *gf_text_get_utf8_line(char *szLine, u32 lineSize, FILE *txt_in, s32 unicod
 		}
 	}
 	sptr = (u16 *)szLine;
-	i = (u32) gf_utf8_wcstombs(szLineConv, 1024, (const unsigned short **) &sptr);
+	i = (u32) gf_utf8_wcstombs(szLineConv, 2048, (const unsigned short **) &sptr);
 	szLineConv[i] = 0;
 	strcpy(szLine, szLineConv);
 	/*this is ugly indeed: since input is UTF16-LE, there are many chances the gf_fgets never reads the \0 after a \n*/
@@ -2338,6 +2338,8 @@ static GF_Err gf_text_process_sub(GF_Filter *filter, GF_TXTIn *ctx)
 		while (szLine[i+1] && szLine[i+1]!='}') {
 			szTime[i] = szLine[i+1];
 			i++;
+			if (i>=19)
+				break;
 		}
 		szTime[i] = 0;
 		ctx->start = atoi(szTime);
path: src/filters/load_text.c
Vulnerability: The binary MP4Box in Gpac 1.0.1 has a null pointer dereference vulnerability in the mpgviddmx_process function in reframe_mpgvid.c, which allows attackers to cause a denial of service. This vulnerability is possibly due to an incomplete fix for CVE-2021-40566.
Vulnerability ID: CVE-2021-40575
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2022-01-13
File: src/filters/reframe_mpgvid.c
Commit message: fixed #1905
Commit author: jeanlf

Vulnerable version (before fix):
 GF_Err mpgviddmx_process(GF_Filter *filter) 			mpgviddmx_enqueue_or_dispatch(ctx, dst_pck, GF_FALSE, GF_FALSE); 		}  		//parse headers  		//we have a start code loaded, eg the data packet does not have a full start code at the beginning 		if (sc_type_forced) { 			gf_bs_reassign_buffer(ctx->bs, start + hdr_offset, remain - hdr_offset);

Fixed version (after fix):
 GF_Err mpgviddmx_process(GF_Filter *filter) 			mpgviddmx_enqueue_or_dispatch(ctx, dst_pck, GF_FALSE, GF_FALSE); 		}  		//not enough bytes to parse start code 		if (remain<5) { 			memcpy(ctx->hdr_store, start, remain); 			ctx->bytes_in_header = remain; 			break; 		}  		//parse headers 		//we have a start code loaded, eg the data packet does not have a full start code at the beginning 		if (sc_type_forced) { 			gf_bs_reassign_buffer(ctx->bs, start + hdr_offset, remain - hdr_offset);

Patch:
patch: @@ -784,8 +784,14 @@ GF_Err mpgviddmx_process(GF_Filter *filter)
 			mpgviddmx_enqueue_or_dispatch(ctx, dst_pck, GF_FALSE, GF_FALSE);
 		}
 
-		//parse headers
+		//not enough bytes to parse start code
+		if (remain<5) {
+			memcpy(ctx->hdr_store, start, remain);
+			ctx->bytes_in_header = remain;
+			break;
+		}
 
+		//parse headers
 		//we have a start code loaded, eg the data packet does not have a full start code at the beginning
 		if (sc_type_forced) {
 			gf_bs_reassign_buffer(ctx->bs, start + hdr_offset, remain - hdr_offset);
path: src/filters/reframe_mpgvid.c