CVE-2022-46489: 
NixOS vulnerability analysis and mitigation

GPAC version 2.1-DEV-rev505-gb9577e6ad-master was discovered to contain a memory leak vulnerability in the gf_isom_box_parse_ex function located in box_funcs.c. The vulnerability was identified on November 28, 2022 (GitHub Issue).

The vulnerability manifests as a direct memory leak of approximately 1.7GB in one object and an additional 4KB in another object when processing certain MP4 files. The issue occurs specifically in the gf_isom_box_parse_ex function at line 166:13 of box_funcs.c and is triggered during the parsing of root boxes in the MP4 file structure (GitHub Issue).

When exploited, this vulnerability can lead to significant memory leaks in the system, potentially causing system resource exhaustion and degraded performance over time. The leak occurs during the processing of MP4 files, which could affect systems using GPAC for media file handling (GitHub Issue).

The vulnerability can be triggered by processing specially crafted MP4 files. A proof-of-concept file has been publicly disclosed, demonstrating the exploitation of this vulnerability (GitHub Issue).

The issue was identified in GPAC version 2.1-DEV-rev505-gb9577e6ad-master. Users should update to a patched version of GPAC once available. No specific workarounds have been publicly documented (GitHub Issue).