CVE-2022-29340: 
NixOS vulnerability analysis and mitigation

GPAC 2.1-DEV-rev87-g053aae8-master contains a Null Pointer Dereference vulnerability in the gfisomparsemovieboxesinternal function due to improper return value handling of GFSKIP_BOX. The vulnerability was discovered in April 2022 and was assigned CVE-2022-29340. The issue affects GPAC versions up to (excluding) 2022-04-12 and was fixed in commit 37592ad (GPAC Commit). The vulnerability has a CVSS v3.1 base score of 7.5 HIGH (NVD).

The vulnerability occurs in the gfisomparsemovieboxesinternal function when handling return values from GFSKIPBOX. When size=0 and isrootbox=false, gfisomboxparseex returns GFSKIP_BOX, causing *outBox to be set to NULL. The program then executes an empty if block when e>=0 and later attempts to dereference the null pointer, leading to a crash (GitHub Issue).

The vulnerability can cause a Denial of Service condition when processing specially crafted input files. The CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates that the vulnerability can be exploited remotely without requiring privileges or user interaction, affecting system availability (NVD).

The vulnerability was fixed in commit 37592ad by adding additional safety checks for handling GFSKIPBOX return values and improving error handling in the affected functions. Users should upgrade to GPAC versions after 2022-04-12 which include the security fix (GPAC Commit).