CVE-2022-30976: 
NixOS vulnerability analysis and mitigation

GPAC 2.0.0 contains a heap-based buffer over-read vulnerability in the utf8wcslen (renamed to gfutf8_wcslen) function located in utils/utf.c. The vulnerability was discovered and disclosed on April 25, 2022 (GitHub Issue). The affected component is the Unicode string length calculation function used by the GPAC multimedia framework.

The vulnerability exists in the gfutf8wcslen function at line 442 of utils/utf.c. The function performs a buffer over-read when calculating the length of Unicode strings. This can be triggered through the MP4Box tool when processing certain malformed files. The issue was identified using Address Sanitizer (ASan) which detected a heap-buffer-overflow at address 0x6020000011d6, reading 2 bytes beyond a 6-byte allocated region (GitHub Issue).

When exploited, this vulnerability can lead to a heap buffer overflow condition, potentially allowing an attacker to cause program crashes or potentially execute arbitrary code through carefully crafted input files. The vulnerability affects the core functionality of GPAC's Unicode string handling (NVD).

The issue was introduced in GPAC 2.0.0. Users should upgrade to a patched version of GPAC. The fix for CVE-2022-30976 was implemented, though it should be noted that the fix itself later introduced another vulnerability tracked as CVE-2022-3178 (Debian Security).