CVE-2019-20629: 
NixOS vulnerability analysis and mitigation

An issue was discovered in libgpac.a in GPAC before version 0.8.0, specifically affecting the MP4Box functionality. The vulnerability involves a heap-based buffer over-read in the gf_m2ts_process_pmt function located in media_tools/mpegts.c that can cause a denial of service when processing a crafted MP4 file (NVD).

The vulnerability is a heap-based buffer over-read that occurs in the gf_m2ts_process_pmt function within the media_tools/mpegts.c file. The issue manifests when processing MPEG-2 Transport Stream (M2TS) Program Map Table (PMT) data. When MP4Box processes certain malformed input files, it can trigger this buffer over-read condition, potentially leading to a crash (GitHub Issue).

The primary impact of this vulnerability is a denial of service condition. When exploited through a specially crafted MP4 file, the heap-based buffer over-read can cause the application to crash (NVD).

The vulnerability was addressed in GPAC version 0.8.0. Users should upgrade to this version or later to mitigate the risk. A fix was implemented through a code change that corrects the handling of PMT processing (GitHub Commit).