CVE-2020-35980: 
NixOS vulnerability analysis and mitigation

An issue was discovered in GPAC version 0.8.0 and 1.0.1, involving a use-after-free vulnerability in the function gfisomboxdel() located in isomedia/boxfuncs.c. This vulnerability was assigned CVE-2020-35980 and was later addressed in Debian security updates (Debian Security).

The vulnerability is a heap-use-after-free issue that occurs in the gfisomboxdel function at line 1696 in isomedia/boxfuncs.c. The issue arises when attempting to free memory that has already been deallocated, particularly in cases involving the handling of stco and stsc boxes in the sample table (GitHub Issue).

The vulnerability could potentially lead to program crashes through segmentation faults and denial of service conditions. In some cases, it might also allow for the execution of arbitrary code, though this would require specific exploitation conditions (Debian Security).

The issue was fixed in GPAC through a commit that modified the CleanWriters function to properly remove stco and stsc boxes from the sample table before deletion. The fix involves removing the created stco and stsc from the sample table in case of errors during file writing (GitHub Commit).