CVE-2019-20630: 
NixOS vulnerability analysis and mitigation

A heap-based buffer over-read vulnerability was discovered in libgpac.a in GPAC before version 0.8.0, as demonstrated through the MP4Box application. The vulnerability was identified in March 2020 and assigned CVE-2019-20630. The issue specifically affects the BS_ReadByte function (called from gf_bs_read_bit) in the utils/bitstream.c file (NVD).

The vulnerability occurs in the BS_ReadByte function when called from gf_bs_read_bit in utils/bitstream.c. The flaw manifests as a heap-based buffer over-read condition that can be triggered when processing specially crafted MP4 files. The issue was discovered through fuzzing testing, which revealed the buffer overflow when executing MP4Box with malformed input (GitHub Issue).

When exploited, the vulnerability can cause a denial of service condition in applications using the affected GPAC library. This occurs when processing maliciously crafted MP4 files that trigger the heap-based buffer over-read (NVD).

The vulnerability can be triggered by processing specially crafted MP4 files through the MP4Box application. A proof of concept exploit was developed and published, demonstrating the heap buffer overflow condition (GitHub Issue).

The vulnerability was fixed in GPAC version 0.8.0. Users should upgrade to this version or later to mitigate the issue. The fix was implemented through a commit that addressed the potential crash on PMT IOD parsing (GitHub Commit).