CVE-2022-47090: 
Linux Debian vulnerability analysis and mitigation

GPAC MP4box 2.1-DEV-rev574-g9d5bb184b contains a buffer overflow vulnerability in the gfvvcreadppsbsinternal function located in mediatools/avparsers.c. The vulnerability was discovered in December 2022 and is tracked as CVE-2022-47090. The issue specifically relates to missing checks for numexptilecolumns parameter (GitHub Issue).

The vulnerability occurs in the gfvvcreadppsbsinternal function when processing tile configurations in VVC (Versatile Video Coding) Picture Parameter Sets (PPS). The buffer overflow happens when the index i reaches 30, causing an overflow in the tilecolswidthctb array. The issue was identified through sanitizer testing which reported 'runtime error: index 30 out of bounds for type u32 [30]' (GitHub Issue).

The buffer overflow vulnerability could potentially lead to denial of service (DoS) conditions or remote code execution (RCE) when processing maliciously crafted MP4 files (GitHub Issue).

The vulnerability was fixed in commit 48760768611f6766bf9e7378bb7cc66cebd6e49d, which added safety checks for VVC PPS tile configuration. The fix includes implementing proper bounds checking for tile columns and rows (GitHub Commit).