CVE-2021-40944: 
NixOS vulnerability analysis and mitigation

In GPAC MP4Box 1.1.0, there is a Null pointer reference vulnerability in the function gf_filter_pid_get_packet at src/filter_core/filter_pid.c:5394. The vulnerability was discovered and reported on September 1, 2021 (GitHub Issue).

The vulnerability manifests as a segmentation fault caused by a READ memory access to address 0x000000000000 (null pointer). The issue occurs specifically in the gf_filter_pid_get_packet function within the filter_core/filter_pid.c file at line 5394. The vulnerability was identified using AddressSanitizer which detected the SEGV error during execution (GitHub Issue).

The null pointer dereference vulnerability can lead to a denial of service condition when processing certain inputs through the GPAC MP4Box utility (Debian Security).

The vulnerability can be triggered by running specific commands through the nhmlr filter. A proof of concept exists using the command './gpac nhmlr:reframe=1:gpac:index=1.0:gpac:src=' (GitHub Issue).

The vulnerability has been addressed in subsequent versions of GPAC. For Debian systems, the fix was included in version 1.0.1+dfsg1-4+deb11u2 (Debian Security).