CVE-2021-30022: 
NixOS vulnerability analysis and mitigation

An integer overflow vulnerability was discovered in GPAC versions 0.5.2 to 1.0.1, identified as CVE-2021-30022. The vulnerability exists in the gfavcreadppsbsinternal function within the mediatools/av_parsers.c file. The issue was disclosed on April 19, 2021 (NVD).

The vulnerability occurs when ppsid may be assigned a negative number, which bypasses the boundary check condition (ppsid >= 255). Since avc->pps array only has 255 units, this leads to a buffer overflow condition. Additionally, due to the assignment pps->id = pps_id, the vulnerability could potentially lead to an arbitrary address write (GitHub Issue).

Successful exploitation of this vulnerability could result in a system crash due to buffer overflow. Furthermore, due to the arbitrary address write capability, it could potentially lead to code execution in the context of the application (GitHub Issue).

The vulnerability was patched in GPAC through commit 51cdb67ff7c5f1242ac58c5aa603ceaf1793b788, which added safety checks for avc/hevc/vvc sps/pps/vps ID verification. The fix includes additional validation to ensure pps_id is not negative before array access (GitHub Commit).