CVE-2019-20628: 
NixOS vulnerability analysis and mitigation

A Use-After-Free vulnerability was discovered in libgpac.a in GPAC before version 0.8.0, identified as CVE-2019-20628. The vulnerability specifically affects the gf_m2ts_process_pmt function in media_tools/mpegts.c and can be demonstrated using the MP4Box tool. The issue was discovered and reported in July 2019 (GPAC Issue).

The vulnerability exists in the gf_m2ts_process_pmt function within the media_tools/mpegts.c file of GPAC's libgpac.a library. When processing certain MP4 files, the function attempts to access memory after it has been freed, leading to a use-after-free condition. This was confirmed through Address Sanitizer (ASAN) testing which identified the heap-use-after-free error at address 0x60300000efb0 (GPAC Issue).

When exploited, this vulnerability can cause a denial of service condition in applications using the affected GPAC library. The issue can be triggered by processing specially crafted MP4 files (NVD).

The vulnerability was fixed in GPAC version 0.8.0. Users should upgrade to this version or later to mitigate the issue. The fix includes improved validation of PMT processing and stricter PAT processing (GPAC Commit, GPAC Commit).