In the adtsdmxprocess function in filters/reframeadts.c in GPAC 1.0.1, a crafted file may cause ctx->hdr.framesize to be smaller than ctx->hdr.hdr_size, resulting in size to be a negative number and a heap overflow in the memcpy.
[
{
"source": "https://github.com/gpac/gpac/commit/22774aa9e62f586319c8f107f5bae950fed900bc",
"signature_version": "v1",
"id": "CVE-2021-30019-471ca0eb",
"signature_type": "Function",
"digest": {
"function_hash": "227599067399516482075011625574724207137",
"length": 7358.0
},
"deprecated": false,
"target": {
"file": "src/filters/reframe_adts.c",
"function": "adts_dmx_process"
}
},
{
"source": "https://github.com/gpac/gpac/commit/22774aa9e62f586319c8f107f5bae950fed900bc",
"signature_version": "v1",
"id": "CVE-2021-30019-657131c2",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"197185477795747438075566840701096839964",
"133582088252870862700942709230991040706",
"111509101733101854599458563419876650348"
]
},
"deprecated": false,
"target": {
"file": "src/filters/reframe_adts.c"
}
}
]