CVE-2022-47090: 
Linux Debian vulnerability analysis and mitigation

GPAC MP4box 2.1-DEV-rev574-g9d5bb184b contains a buffer overflow vulnerability in the gf_vvc_read_pps_bs_internal function located in media_tools/av_parsers.c. The vulnerability was discovered in December 2022 and is tracked as CVE-2022-47090. The issue specifically relates to missing checks for num_exp_tile_columns parameter (GitHub Issue).

The vulnerability occurs in the gf_vvc_read_pps_bs_internal function when processing tile configurations in VVC (Versatile Video Coding) Picture Parameter Sets (PPS). The buffer overflow happens when the index i reaches 30, causing an overflow in the tile_cols_width_ctb array. The issue was identified through sanitizer testing which reported 'runtime error: index 30 out of bounds for type u32 [30]' (GitHub Issue).

The buffer overflow vulnerability could potentially lead to denial of service (DoS) conditions or remote code execution (RCE) when processing maliciously crafted MP4 files (GitHub Issue).

The vulnerability was fixed in commit 48760768611f6766bf9e7378bb7cc66cebd6e49d, which added safety checks for VVC PPS tile configuration. The fix includes implementing proper bounds checking for tile columns and rows (GitHub Commit).