CVE-2023-4678 (published 2023-08-31T16:15Z)

Divide By Zero in GitHub repository gpac/gpac prior to 2.3-DEV.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-369
cwe_name: Divide By Zero
description: The product divides a value by zero.
extended_description: This weakness typically occurs when an unexpected value is provided to the product, or if an error occurs that is not properly detected. It frequently occurs in calculations involving physical dimensions such as size, length, width, and height.
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2023-08-31 17:11:12+02:00
msg: fixed #2576
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: dasher.c
change_type: ModificationType.MODIFY
diff: @@ -1173,6 +1173,11 @@ static GF_Err dasher_configure_pid(GF_Filter *filter, GF_FilterPid *pid, Bool is
 		CHECK_PROP(GF_PROP_PID_CODECID, ds->codec_id, GF_NOT_SUPPORTED)
 		CHECK_PROP(GF_PROP_PID_TIMESCALE, ds->timescale, GF_NOT_SUPPORTED)
 
+		if (!ds->timescale) {
+			GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[Dasher] Input PID %s has no timescale, cannot dash\n", gf_filter_pid_get_name(pid) ));
+			return GF_NON_COMPLIANT_BITSTREAM;
+		}
+
 		if (ds->stream_type==GF_STREAM_VISUAL) {
 			CHECK_PROP(GF_PROP_PID_WIDTH, ds->width, GF_EOS)
 			CHECK_PROP(GF_PROP_PID_HEIGHT, ds->height, GF_EOS)

programming_language: C
filename: dmx_avi.c
change_type: ModificationType.MODIFY
diff: @@ -81,6 +81,7 @@ static void avidmx_setup(GF_Filter *filter, GF_AVIDmxCtx *ctx)
 	if (ctx->use_file_fps) {
 		Double fps = AVI_frame_rate(ctx->avi);
 		gf_media_get_video_timing(fps, &ctx->fps.num, &ctx->fps.den);
+		if (!ctx->fps.num) ctx->fps.num = ctx->fps.den = 1000;
 	}
 
 	dur.den = ctx->fps.num;

programming_language: C
filename: reframe_mhas.c
change_type: ModificationType.MODIFY
diff: @@ -638,10 +638,11 @@ GF_Err mhas_dmx_process(GF_Filter *filter)
 				numSpeakers = (s32) gf_mpegh_escaped_value(ctx->bs, 5, 8, 16) + 1;
 				//TODO ...
 			}
+			if (sr) {
+				mhas_dmx_check_pid(filter, ctx, pl, sr, frame_len, CICPspeakerLayoutIdx, numSpeakers, start + pay_start, (u32) mhas_size);
 
-			mhas_dmx_check_pid(filter, ctx, pl, sr, frame_len, CICPspeakerLayoutIdx, numSpeakers, start + pay_start, (u32) mhas_size);
-
-			has_cfg = GF_TRUE;
+				has_cfg = GF_TRUE;
+			}
 		}
 		//audio truncation
 		else if (mhas_type==17) {

programming_language: C
filename: swf_parse.c
change_type: ModificationType.MODIFY
diff: @@ -1438,7 +1438,7 @@ static GF_Err swf_def_font(SWFReader *read, u32 revision)
 	ft->glyphs = gf_list_new();
 	ft->fontID = swf_get_16(read);
 	e = GF_OK;
-
+	gf_list_add(read->fonts, ft);
 
 	if (revision==0) {
 		start = swf_get_file_pos(read);
@@ -1538,8 +1538,6 @@ static GF_Err swf_def_font(SWFReader *read, u32 revision)
 			}
 		}
 	}
-
-	gf_list_add(read->fonts, ft);
 	return GF_OK;
 }
 
@@ -2642,6 +2640,7 @@ GF_Err gf_swf_read_header(SWFReader *read)
 	read->frame_rate = swf_get_16(read)>>8;
 	read->frame_count = swf_get_16(read);
 	GF_LOG(GF_LOG_INFO, GF_LOG_PARSER, ("SWF Import - Scene Size %gx%g - %d frames @ %d FPS\n", read->width, read->height, read->frame_count, read->frame_rate));
+	if (!read->frame_rate) read->frame_rate = 1;
 	return GF_OK;
 }
 

programming_language: C